Privacy Policy

Last Updated: November 13, 2026 · Effective Date: November 13, 2026 · Version: 1.12

1. Introduction

CasperVPN ("we," "us," "our," or "CasperVPN") operates the CasperVPN application and related services (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, how we share it, and your rights regarding that information.

We are committed to protecting your privacy and operating under a strict minimal-data-collection approach. This policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Lebanese Law No. 81/2018 on Electronic Transactions and Personal Data, and other applicable privacy laws.

Operating Entity: CasperVPN is operated by App-Link Offshore S.A.L. (Single Partner), registered in Lebanon (Beirut Commercial Register no. 1808496), with its registered address at Metlisco Building, Beirut, Lebanon.

Data Protection Officer Contact: Email: [email protected]

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — required when you create an account with e-mail, and used for communication and password recovery. Not needed to start using the app (see "Account without e-mail" below).
• Account without e-mail (device account) — when you tap Connect in the app before creating an account, we create a free account for that phone without asking for an e-mail address. It is tied to a random install identifier that the app creates itself (it is not your phone's advertising identifier or serial number); we store only a one-way scrambled form (hash) of it. We use it to give each phone one free data allowance, to stop the free allowance from being claimed again by reinstalling the app, and to keep your plan and usage if you later save the account. We also record which version of our Terms of Service and Privacy Policy was shown under the Connect button and the time you tapped Connect. If you later save the account with Apple, Google or an e-mail address, the install identifier stays linked to that same account. We never send e-mail to an account without an e-mail address.
• Partner code — if a partner (for example a creator who recommends us) gave you a code and you type it on the plans screen in the app, or you redeem that partner's App Store offer code, we save the partner's code on your account. It is saved once and cannot be changed, and it does not change your price. Each time your account pays for a plan through the App Store or Google Play, we record a sale for that partner: the date, the plan, the amount, the partner's commission and the store's order number, so that we can pay the partner. The partner sees only the date, the plan, whether it was paid or a free month, whether it was bought on iPhone or Android, and their commission. They never see your name, e-mail address or account.
• Password — stored as a salted bcrypt hash. We never store or have access to your plaintext password.
• First and last name — optional, provided at your discretion.
• OAuth identifiers — if you sign in via Apple Sign-In or Google Sign-In, we receive an opaque user ID from the provider. We do not receive or store your OAuth provider password.
• Notification preferences — your selected alert categories (security alerts, connection issues, subscription reminders, promotional offers, feature updates, weekly reports, maintenance windows), preferred delivery channels (push, email, in-app), and quiet hours schedule. Stored server-side to ensure your communication preferences are respected across all your devices.
• Push notification device token — if you enable push notifications, your device's push notification token (APNs token on iOS, FCM token on Android) is sent to our servers and stored alongside your account. This token is used exclusively to deliver push notifications you have opted into (e.g., security alerts, connection status, subscription reminders). The token is deleted from our servers when you disable push notifications, log out, or delete your account. We do not use push notification tokens for advertising, analytics, tracking, or any purpose other than delivering notifications you have requested.

2.2 Payment Information

Subscriptions bought in the app are processed through Apple App Store In-App Purchase (StoreKit); payment is handled entirely by Apple. Plans bought on caspervpn.com can be paid in cryptocurrency through NOWPayments (see Section 4). If an Android app becomes available, purchases in it will be processed by Google Play Store Billing.

We do not see, receive, or store:

• Your credit card number, CVV, or expiration date.
• Your banking or financial account details.
• Your full billing address.
• Any other payment instrument information.

We receive only:

• Transaction confirmation — a receipt or notification that a purchase succeeded or failed.
• Subscription status — whether your subscription is active, cancelled, or expired, and the Apple or Google product identifier.
• Renewal events — automatic notifications from Apple or Google when a subscription renews or is cancelled, used to keep your account access in sync.

For purchases on iOS and macOS, refer to Apple's privacy policy at https://www.apple.com/legal/privacy/. For purchases on Android, refer to Google's privacy policy at https://policies.google.com/privacy.

Future Payment Processors: Future product releases may introduce additional payment processors for web-based or direct subscriptions. We will update this Privacy Policy and notify you at least 30 days before any new payment processor begins receiving or processing your personal data.

2.3 Connection Metadata

When you connect to our VPN servers, our system records the following minimal operational data:

• Connection timestamps — when you connected and disconnected.
• Server selected — which VPN server you connected to.
• Protocol used — WireGuard, IKEv2, OpenVPN, or CasperCloak (obfs4).
• Bandwidth consumed — bytes uploaded and downloaded (for data cap enforcement on free/limited plans).
• Connection status — whether the connection succeeded, failed, or timed out.
• Device identifier and app version — a random identifier the app creates on install (not your phone's hardware ID) and the app version, stored with each session. They enforce the 3-device limit and let us tell real app connections from scripted abuse. They are not used for advertising and are not shared.
• Failed-connection reports — when a connection fails, the app reports the country, the mobile carrier network, the app version and the stage that failed (name lookup, handshake, first data), so we can fix it for that network. No IP address is included.
• Crash and performance reports (iPhone and iPad app) — when the app crashes or hits an error, it sends a technical report to an error-tracking server that we run ourselves (it is not a third-party service): the device model, operating-system version, app version, the error, and a picture of the app's own screen at that moment. For a small sample of sessions it also reports how long app screens and network calls take. These reports are linked to your account ID and email address so we can fix the problem and reply to you. They are not used for advertising and are not shared.
• App screens (iPhone, iPad and Android apps) — when you leave the app, it sends the name of the app screen that was showing (for example "servers" or "plans"), how many seconds you were on it, whether the VPN was connected and your plan type. It also records when the free-trial screen is shown, started or skipped. It never records what you type, what you tap, or anything you do on the internet. These records are linked to your account, used only to improve the app, never used for advertising and never shared.
• Setup screens before you sign in — before you have an account, the app records which first screens were shown, whether sign-up failed and the type of error, with the random install identifier described above. If you then sign in, these records are linked to your account. They are used only to find where sign-up breaks; they are not used for advertising and are not shared.
• Network checks — when your phone joins a new network, the app runs up to five quick yes/no tests against our server (name lookup, a secure connection, the tunnel start) and sends the results and their timings, the network type (Wi-Fi or mobile), your phone's region setting and, if you allow it, the mobile network's name. No IP address, phone number or SIM details. Linked to your account and used only to find and fix connection problems.
• Which ad brought you here (iPhone and iPad app) — if you installed the app after tapping one of our ads in the App Store, the app asks Apple once, on first launch, for a short-lived code that says the install came from an ad. Our server sends that code to Apple and gets back which of our campaigns, ad groups and search words led to the install, and the country. We keep that with your install identifier, and with your account once you sign in, to learn which ads work. It contains no advertising identifier (IDFA), it is not used to follow you in other companies' apps or websites, and it is not shared. If you did not come from an ad, Apple returns nothing and we store nothing.
• Multi-Hop routing — if you use our Double VPN (Multi-Hop) feature, we record only the entry and exit server identifiers and the multi-hop session prefix (e.g., "mh-"). We do NOT log the intermediate routing path, and no additional IP addresses are recorded beyond standard connection metadata. Multi-Hop sessions are subject to the same no-log policy as standard connections.

We do NOT log your originating IP address or the VPN IP address assigned to your session. As of March 2026, our backend infrastructure has been modified to eliminate all IP address fields from connection records. This change has been deployed across all production servers.

Infrastructure note: our VPN servers are standard servers with normal disk storage. We do not claim that they run from memory only ("RAM-only"). What we keep is listed in this section and in Section 5.

2.4 Security and Anti-Fraud Data

To protect accounts from unauthorized access and detect abuse, we process:

• Failed login attempts — email, a one-way hash of the IP address, timestamp, and failure reason (e.g., invalid password, locked account). Five failures in 15 minutes lock the account for 15 minutes.
• Sign-up and login context — at sign-up we keep a one-way hash of your IP address and of its network, the country it resolved to, and the browser or app type; at each login we keep the country, the app or browser type and the time of your last login. We never keep the IP address itself.
• Password checks — when you set a password we check part of a one-way hash of it against a public list of passwords exposed in data breaches (the "k-anonymity" method: neither the password nor its full hash leaves our server).
• Fraud risk indicators — risk scores computed at signup/login using IP reputation, email validity checks, and device metadata.
• Anomaly detection events — unusual patterns such as impossible travel (login from two distant locations in rapid succession).
• Two-Factor Authentication (2FA) — if you enable 2FA, we store: a TOTP shared secret (encrypted at rest), your 2FA enablement status, and backup recovery codes (hashed). QR code generation for authenticator app setup is performed server-side and transmitted via TLS 1.3; the QR code is not stored after delivery. Failed 2FA verification attempts are logged with timestamp only (no IP address) for brute-force protection.

This data is used exclusively for security purposes and is not shared with third parties.

2.5 Customer Support Data

When you contact us for support through the in-app support ticket system or via email, we collect and store:

• Support ticket content — the subject, description, and message history of your support request.
• Ticket metadata — creation timestamp, status (open/in-progress/resolved), priority level, and category.
• Support chat messages — if you use the in-app chat feature within a support ticket, the conversation history is stored server-side for resolution tracking and quality purposes.
• In-app bug reports — when you send a report from the app's "Report a Bug" screen, we receive the title and description you write and, if you add one, a contact e-mail address. If you leave "Include diagnostic data" on, the report also includes your device model, operating-system version, app version, language and region setting, the server and protocol in use, the connection state, the data counters, and a short technical log of the app's recent connection steps. Keys and login tokens are removed from the log before it is stored. If you are signed in, the report is linked to your account. If the app offers to send reports automatically after repeated failed connections and you accept, it sends such a report by itself, at most once every 30 minutes. Bug reports are used only to find and fix problems; they are not used for advertising and are not shared.

Support ticket data is linked to your account (email and user ID) to provide continuity across interactions. We retain support ticket records for 2 years after ticket closure (for bug reports, see Section 5) for quality assurance and to identify recurring issues. You may request deletion of support records via [email protected] (subject to any legal retention obligations).

2.6 Local Device Data (iOS/Android App)

The following data is stored locally on your device only and is never transmitted to our servers (except push notification tokens as described in Section 2.1):

• VPN configuration keys — stored in iOS Keychain (encrypted, device-only) or Android Keystore.
• Authentication tokens — JWT access and refresh tokens stored in encrypted device storage.
• Local connection logs — up to 1,000 entries stored in the app's sandboxed storage for your personal reference and troubleshooting.
• Data usage counters — bytes consumed in current billing cycle.
• Privacy guard results — DNS leak, IP leak, and WebRTC leak test results (processed locally, never sent to servers).

2.7 Information We Do NOT Collect

• Browsing activity — we do not monitor, log, or store any websites you visit, DNS queries you make, or content you access while connected to CasperVPN.
• Traffic content — we do not inspect, log, or store the contents of your internet traffic.
• Advertising identifiers — we do not collect IDFA (iOS) or GAID (Android).
• Device fingerprints for tracking — we do not build cross-session device fingerprints for advertising purposes.
• Location data — we do not access GPS, Wi-Fi, or cell tower location services.
• Contacts, photos, or other device data — we do not access any data on your device beyond what is described above.
• Third-party analytics — we do not integrate Firebase Analytics, Mixpanel, Amplitude, Segment, or any third-party analytics SDK.

3. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your information for:

• Targeted advertising
• Selling to data brokers
• Building user profiles for marketing
• Sharing with government agencies beyond what is legally compelled

4. How We Share Your Information

4.1 Service Providers

We share limited data with the following categories of service providers, each bound by data processing agreements:

• App Store payment processors (Apple, Google) — Apple Inc. processes all iOS and macOS subscription payments via the App Store; Google LLC processes all Android subscription payments via Google Play Billing. We do not transmit payment instrument data to these processors; they receive payment instrument data directly from you in their respective payment flows. We receive only transaction confirmations and subscription status.
• NOWPayments (cryptocurrency payments) — NOWPayments processes cryptocurrency payments made on caspervpn.com (USDT or USDC on BNB Smart Chain, Bitcoin or Ether). When you choose to pay in cryptocurrency we transmit your email address, an order reference and the amount due so that NOWPayments can issue and settle the invoice. We do not receive or store your wallet address, private keys, or any payment instrument data. NOWPayments determines its own purposes and means for the payment transaction and acts as an independent controller for it; its own privacy policy applies to the data you provide to it directly. No card-based web payment processor (such as Stripe, Paddle or LemonSqueezy) is currently active; if one is added, this list will be updated with at least 30 days' advance notice.
• Infrastructure providers — server hosting providers that host our VPN infrastructure. They do not have access to decrypted user traffic.
• Email service provider — for transactional emails (account verification, password reset). Receives email address only.

4.2 Legal Requirements

We may disclose information if required by law, subpoena, or court order. However:

• Due to our minimal data collection practices, we have very limited data to provide in response to any legal request.
• We will challenge overly broad or legally deficient requests.
• We will notify affected users before disclosure unless legally prohibited from doing so.

4.3 No Sale of Personal Data

We do not sell, rent, or trade your personal information to any third party. This applies under both GDPR and CCPA definitions of "sale."

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

5. Data Retention

After the retention period expires, data is permanently deleted or irreversibly anonymized.

6. Your Rights

6.1 Rights Under GDPR (EU/EEA Residents)

You have the right to:

• Access — request a copy of your personal data (Art. 15).
• Rectification — correct inaccurate personal data (Art. 16).
• Erasure — request deletion of your personal data ("right to be forgotten") (Art. 17).
• Restrict processing — limit how we use your data (Art. 18).
• Data portability — receive your data in a structured, machine-readable format (Art. 20).
• Object — object to processing based on legitimate interests (Art. 21).
• Withdraw consent — where processing is based on consent, withdraw at any time (Art. 7(3)).
• Lodge a complaint — with your local data protection authority.

6.2 Rights Under CCPA (California Residents)

You have the right to:

• Know — what personal information we collect and how it is used.
• Delete — request deletion of your personal information.
• Opt out of sale — we do not sell personal information, but you may submit a request at [email protected].
• Non-discrimination — we will not discriminate against you for exercising your rights.

Categories of personal information collected (CCPA disclosure): Identifiers (email, name), commercial information (subscription status), internet activity information (connection metadata), and inferences (fraud scores).

Categories sold: None. Categories disclosed for business purposes: Subscription transaction status (received from Apple App Store / Google Play to confirm purchase entitlements).

6.3 Rights Under Lebanese Law No. 81/2018

Under Lebanese data protection law, you have the right to:

• Access your personal data held by us.
• Request correction of inaccurate data.
• Object to processing of your data.
• Request deletion of data that is no longer necessary for its original purpose.

6.4 How to Exercise Your Rights

Submit requests to: [email protected]

We will respond within:

• 30 days for GDPR requests (extendable by 60 days for complex requests)
• 45 days for CCPA requests (extendable by 45 days)

We will verify your identity before processing any request. For most requests, we will verify ownership of the email address associated with your account.

Note: Due to our minimal data collection practices, in many cases the response to a data access request will confirm that we hold very little personal data beyond your email address and subscription status.

7. Data Security

We implement the following technical and organizational security measures:

• Encryption in transit — all data transmitted between the app and our servers is encrypted using TLS 1.3.
• Encryption at rest — sensitive data stored on servers is encrypted using AES-256.
• VPN tunnel encryption — WireGuard (ChaCha20-Poly1305), IKEv2 (AES-256-GCM), OpenVPN (AES-256-CBC/GCM), CasperCloak/obfs4 (WireGuard tunneled through obfs4 — our own protocol).
• Password hashing — bcrypt with unique salt per account.
• Credential storage — authentication tokens stored in iOS Keychain / Android Keystore with hardware-backed encryption.
• Access controls — role-based access control (RBAC) for administrative systems. All admin actions are audit-logged.
• Infrastructure security — regular security updates on all servers.

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence, including the Netherlands, United States, Germany, and France (VPN server infrastructure) and Lebanon.

For transfers from the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Ensuring that receiving jurisdictions provide adequate protection or that appropriate safeguards are in place.

9. Children's Privacy

CasperVPN is not directed at children under 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it promptly. Contact [email protected] if you believe a child has provided us with personal data.

10. Warrant Canary

We do not publish a warrant canary today. If we start one, we will publish it at https://caspervpn.com/canary and update this section.

11. No-Log Commitment and Roadmap

Current State

CasperVPN operates under a strict data minimization approach. Since February 2026 our connection records hold no IP addresses. Our servers are not RAM-only, and no independent audit has been done yet.

Completed Milestones

1. ✅ Originating IP logging eliminated — ClientIp and AssignedVpnIp fields permanently removed from the backend connection log model and database schema. No code paths populate these fields. Completed February 2026.
2. ✅ Connection metadata minimized — connection logs reduced to operational minimum (timestamps, server, protocol, bandwidth for metered plans). No IP addresses. Sessions carry an app-generated device identifier and app version (device limit and abuse detection, see 2.3), never a hardware fingerprint.
3. ✅ DNS lookups inside the tunnel — while you are connected, the app sends your DNS lookups (the step that turns a website name into an address) through the encrypted VPN tunnel, so your internet provider cannot see them. Our servers then pass them on to public DNS services (Cloudflare and Quad9; Google on OpenVPN connections) from the server's own address, never yours. We do not log your DNS lookups.

Remaining Milestones

1. 🔲 RAM-only servers — not in place today. Our VPN servers use normal disk storage.
2. 🔲 Independent audit — not started. If an audit is done, we will publish the results here.
3. 🔲 Publish transparency report — annual report detailing the number and nature of legal requests received and our response.
4. 🔲 Our own DNS answers — answering DNS lookups on our own servers, without public DNS services. Planned, not in place today.

We will update this Privacy Policy and notify users as each milestone is completed.

12. Third-Party Links and Services

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party service you access through our platform.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a revised "Last Updated" date.
• Sending an email notification to the address associated with your account.
• Displaying an in-app notification.

Your continued use of the Service after a material change constitutes acceptance of the updated policy. If you do not agree with changes, you may delete your account.

Change log

• 13 November 2026 (version 1.12): added the partner code you can enter in the app, what is saved and what the partner sees (Section 2.1), and in-app bug reports (Section 2.5); both added to the retention table (Section 5).
• 13 November 2026 (version 1.11): the app can now be used before creating an account. Tapping Connect creates a free account without an e-mail address, tied to a random install identifier (stored only as a hash); we record the Terms and Privacy version you accepted and when. Sections 2.1 and 5.
• 30 October 2026: Until 29 October 2026, the server that handles IKEv2 logins kept connection records that included the IP address you connected from. We stopped this and deleted the records on 29 October 2026, and we now check every server weekly.

14. Cookie Policy

Website (caspervpn.com)

Our website uses only strictly necessary cookies required for site functionality (e.g., session cookies, CSRF protection). We do not use:

• Advertising or tracking cookies
• Third-party analytics cookies
• Social media tracking pixels

Mobile Applications

Our mobile applications do not use cookies.

15. Contact Us

For any questions, concerns, or requests related to this Privacy Policy:

Email: [email protected] Legal Inquiries: [email protected] General Support: [email protected] Mailing Address: App-Link Offshore S.A.L. (Single Partner), Metlisco Building, Beirut, Lebanon

Data Protection Authority Complaints: If you are unsatisfied with our response to a privacy concern, you have the right to lodge a complaint with your local data protection authority. For EU residents, a list of supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

16. Jurisdiction-Specific Disclosures

European Union / European Economic Area

Our legal basis for processing personal data is described in Section 3. Our Data Protection Officer can be contacted at [email protected].

California

This Privacy Policy serves as our notice at collection under the CCPA. You may designate an authorized agent to submit requests on your behalf by providing written authorization to [email protected].

Lebanon

In accordance with Lebanese Law No. 81/2018, we process personal data lawfully, transparently, and for specified purposes. Data subjects may exercise their rights under this law by contacting [email protected].

This Privacy Policy was last reviewed on March 16, 2026.