Nuvotik VPN — Data Collection Disclosure

Last updated: 15 October 2026

This page lists the data that the Nuvotik VPN apps collect, using the categories of Apple's App Store privacy details ("privacy nutrition label") and Google Play's Data safety section, so that you can compare what the stores show with what we actually do. The Service is operated by Value Brands FZE LLC. Our Privacy Policy is the full description; if anything here appears to conflict with it, the Privacy Policy prevails.

In store terminology, data is "collected" when it is sent off your device and kept for longer than needed to answer a single request. Data processed only on your device, or used only in the moment to answer a request and then discarded, is not "collected".

1. Key facts

• Ads only without a paid subscription, and currently turned off. The apps include the Google Mobile Ads SDK (AdMob). Subscribers never see ads. If you use Nuvotik VPN without a paid subscription, the app may show non-personalized ads from Google when we turn advertising on; advertising is currently turned off, so no ads are shown. Section 4 lists what the Google Mobile Ads SDK collects when ads are on. Whether ads may be shown is decided by our servers from your subscription status. Because the SDK is part of the app, our store privacy details declare its data types even while ads are off.
• No tracking. We do not track you across other companies' apps or websites. The iOS app does not request permission to track (App Tracking Transparency), and ads are requested as non-personalized on both platforms.
• No data sold. No account or VPN data shared for advertising. Nothing about your VPN connections, servers, traffic or account is given to the ad provider.
• Linked to you. The data listed below is associated with your account, because Nuvotik VPN is an account-based subscription service.
• Encrypted in transit. All data sent between the apps and our servers is encrypted with HTTPS (TLS). VPN traffic is encrypted with WireGuard.
• You can delete it. You can delete your account in the app (Account (the person icon at the top of the home screen) → Delete account) or at https://nuvotik.com/account-deletion. Some records are retained afterwards for legal and security reasons, as explained on that page.

2. Apple App Store privacy details

All data types below are linked to the user and not used for tracking. Data collected by the Google Mobile Ads SDK for users without a paid subscription is listed separately in section 4. Because the store label has one entry per data type, the combined label shows:

• Data Used to Track You: none.
• Data Linked to You: Contact Info, Identifiers, Purchases, Usage Data, Other Data. (Device ID and Product Interaction also list the ad SDK's purposes, Third-Party Advertising and Analytics, because we collect those types as well.)
• Data Not Linked to You: Location, Usage Data (Advertising Data), Diagnostics — collected only by the ad SDK.

"App Functionality" here includes authenticating you, providing the VPN connection, enforcing plan limits, and preventing fraud and abuse, which Apple includes in that purpose.

Not collected by us: Health & Fitness, Financial Info (payment details are handled by Apple), Location, Sensitive Info, Contacts, User Content, Browsing History, Search History, Diagnostics (we do not use crash-reporting or analytics SDKs). For users without a paid subscription, the Google Mobile Ads SDK collects the additional types in section 4 when ads are on.

Why VPN session records are "Product Interaction"

Apple describes Product Interaction as how users interact with an app (for example launches and taps, "or other usage data"). Connecting to and disconnecting from a VPN server and choosing a server are the core interactions with Nuvotik VPN, and our session records describe exactly that — when a VPN connection was active, on which server and device, and why it ended — together with per-peer traffic totals. We use this standard type, rather than "Other Usage Data", so that it is easy to see on the label. We do not record taps or screen views in the app. The records contain no browsing activity, which is why "Browsing History" is not declared.

Why device details and hashed IPs are "Other Data Types"

Device model, name and versions are stored to show you your devices and keep them working, not for diagnostics, so they are not declared under "Diagnostics". The keyed IP hash in security logs is not an IP address and is not location data, but it is derived from one, and it is pseudonymous rather than anonymous: we hold the key and can check whether it matches a known IP address (see section 4.6 of the Privacy Policy). We declare it as linked to you rather than omit it.

3. Google Play Data safety

Data shared with third parties: none of the data that we collect ourselves (the table below). Our infrastructure providers and email delivery provider process data only on our behalf, which Google does not count as sharing. Apple and Google are the providers of the store and sign-in services you use. For users without a paid subscription, when ads are on, the Google Mobile Ads SDK collects and shares the data listed in section 4 with Google. Because the store form has one entry per data type, the combined Play listing shows Data shared: Location, App activity, App info and performance, Device or other IDs; and Data collected: Location, Personal info, Financial info, App activity, App info and performance, Device or other IDs.

Security practices: data is encrypted in transit; you can request that your data be deleted.

What each row means in Nuvotik VPN:

• User IDs: account identifier; the identifier from Sign in with Google or Apple, if used; the hashed account identifier given to Google Play to match purchases.
• Purchase history: subscription plan, status, renewal dates and Google Play order identifiers. Purchase tokens are stored only as hashes.
• App interactions: VPN session records (start and end time, server, device, end reason; kept 30 days), per-peer total bytes and last handshake time, device last-active time and favourite servers. We chose "App interactions" because these records describe the actions you take in the app — connecting, disconnecting and choosing servers — and their result.
• Device or other IDs: installation identifier generated by the app (not the advertising ID), the device details stored with it (model, device name, operating-system version and app version), and the keyed (pseudonymous) hash of the IP address kept in security logs for 1 year. The Android app does not currently register for push notifications.

Not collected by us: Location (approximate or precise), Web browsing history, Messages, Photos and videos, Audio, Files and docs, Calendar, Contacts, Health and fitness, Financial info other than purchase history (payment details are handled by Google), App info and performance (no crash logs or diagnostics), Installed apps, In-app search history. (Section 4 covers what the ad SDK collects for users without a paid subscription when ads are on.)

Items processed but not "collected"

• Installed apps (Android split tunnelling): the list of installed apps is read on your device to let you choose which apps use the VPN. It never leaves your device.
• Server latency measurements and optional country code: sent to us only to compute a server recommendation, used in the moment and not stored (ephemeral processing).
• Your IP address when the app contacts our servers: needed to deliver the response. It is not stored in raw form; security logs keep only a keyed hash, which is covered by the rows above.

4. Advertising (users without a paid subscription)

Advertising is currently turned off, so the app requests and shows no ads. Ads can be turned on only from our servers; if we turn them on, we will update this page.

When advertising is on: subscribers (including during a billing grace period) never see ads, and the app never requests ads for them. Users without a paid subscription may see banner ads on the Home, Servers and Notifications screens and, at most a few times a day, a full-screen ad at a natural break (after closing the notifications list or the device list). Ads are requested as non-personalized; they are never shown while a VPN connection is being started or stopped, during sign-in or purchases, or during onboarding, and banner ads never appear on the paywall, settings, sign-in or account screens. No rewarded ads are offered. In the European Economic Area, the UK and Switzerland, Google's consent message lets you choose how ads may use your data, and you can change that choice in Settings → Ad privacy choices.

When ads are on, the Google Mobile Ads SDK sends data to Google, which Google uses for serving ads, measurement and fraud prevention under its own policies (https://policies.google.com/technologies/partner-sites). We give it nothing about your account, VPN connections, servers or traffic. Based on Google's published disclosure for the Google Mobile Ads SDK, our store privacy details include:

Apple App Store (in addition to section 2; not used for tracking, App Tracking Transparency is not requested):

Google Play Data safety (collected and shared with Google; processed only for users without a paid subscription):

Google updates its SDK disclosure from time to time; we update this page and our store privacy details when it does.

5. Questions

Contact support@nuvotik.com if you have questions about this disclosure.