Nuvotik VPN — VPN Privacy Disclosure
Last updated: 7 October 2026
This page explains, in plain language, what happens to your data when you connect to Nuvotik VPN: what our servers can technically see, what we keep, what we do not keep, and the limits of what a VPN can do for you. It supplements our Privacy Policy. The Service is operated by Value Brands FZE LLC.
1. How the connection works
- Your device creates a WireGuard key pair. The private key is generated on your device and never leaves it — we never see it. Only the public key is sent to us.
- When you connect, our control system registers your device's public key on the VPN server you chose (or that we recommended), assigns your device a private internal address in the 10.x.x.x range, and sends your app the settings it needs.
- Your device then sends its traffic directly to that VPN server through an encrypted WireGuard tunnel. Your traffic never passes through our account and control systems — they only issue configuration.
- The VPN server decrypts the tunnel and forwards your traffic to the internet, so websites see the server's IP address instead of yours.
2. What we see and keep
| What | Kept? | Details |
|---|---|---|
| Your account email and devices | Yes | Needed to run your account and enforce device limits. Deleted with your account. |
| WireGuard public key of each device | Yes | Needed to recognise your device on the server. The private key stays on your device. |
| Internal tunnel address (10.x.x.x) | Yes | A private address inside our network, not your real IP address. |
| When a VPN session started and ended, which server and device, and why it ended | Yes, 30 days | No IP addresses and no destinations. Deleted automatically after 30 days. |
| Total bytes sent and received per peer, and last handshake time | Yes | Running totals only. They do not show what you did or where traffic went. |
| Overall server load (CPU, memory, bandwidth, number of connected peers) | Yes, 30 days | Describes the server as a whole, not any individual user. |
| Security log entries (sign-ins, account changes) with a keyed hash of an IP address | Yes, 1 year | Never the raw IP address. The hash is pseudonymous, not anonymous: we hold the key and can check whether it matches a known IP address, so for up to 1 year these entries can show that an account was used from a particular IP address. See section 4.6 of the Privacy Policy. |
3. What we do not keep
| What | Kept? | Details |
|---|---|---|
| Websites you visit, URLs | No | Not recorded anywhere. |
| DNS queries | No | Each server runs its own DNS resolver with query and reply logging disabled. |
| Content of your traffic | No | Not inspected, recorded or stored. |
| Destination IP addresses, domains and ports | No | Not recorded. The servers' firewall rules have logging disabled. |
| Your real IP address on VPN servers | No | Our server software never reports it to us and it is not logged. |
| Your location | No | No GeoIP lookups on your IP address. |
We describe this as having no activity logs: we do not log what you do online through the VPN. We do keep the limited connection and account records listed in section 2, and we think it would be misleading to call that "no logs".
4. What exists only briefly in server memory
For the VPN to work at all, a few things must exist in the memory (RAM) of the server you are connected to while you use it. They are not written to disk, logged or reported to us:
- Your current network address. WireGuard remembers the most recent public IP address and port your device connected from, so it can send replies back to you. It changes when your network changes and disappears when your device is removed from the server or the server restarts.
- Active connection table. Like every router that translates addresses, the server's operating system tracks currently open connections so replies reach your device. Entries expire automatically shortly after a connection closes.
- DNS cache. The resolver keeps recent DNS answers in memory to speed things up. The cache does not record who asked.
Our VPN servers are hosted by infrastructure providers. As with any hosted server, we rely on those providers' contractual and physical security controls for the hardware our servers run on.
5. What the app does on your device
- iOS: the app uses Apple's Network Extension framework (a Packet Tunnel Provider running the WireGuard protocol). iOS asks you to allow the app to add a VPN configuration the first time you connect.
- Android: the app uses Android's VpnService. Android asks you to approve the VPN connection the first time you connect, and shows a key icon in the status bar while the VPN is active.
- The VPN app can technically route all of your device's internet traffic. It uses this ability only to send that traffic through the encrypted tunnel to our server; the app does not inspect, record or upload your traffic.
- Split tunnelling (Android, where available): if you choose apps to include or exclude from the VPN, the list of installed apps is read on your device to show you the choices. Your selection stays on your device and is not sent to us. Traffic from excluded apps does not use the VPN.
- Connect on demand (iOS, where available): rules such as "connect automatically on untrusted Wi-Fi", including any Wi-Fi network names you mark as trusted, are stored on your device and are not sent to us.
- Server recommendation: the app may measure how quickly it can reach our servers and send those measurements, and optionally a country code, so that we can suggest a fast server. They are used only to make the recommendation and are not stored.
- Ads in the app: the apps include the Google Mobile Ads SDK (AdMob). Users without a paid subscription may see ads in the app when we turn advertising on; advertising is currently turned off, and subscribers never see ads. Ads are shown inside the app only: the VPN never inserts ads into your traffic or changes the content you load, and we never give Google anything about your VPN connections or traffic. On Android, if you choose only specific apps to use the VPN, the Nuvotik VPN app itself is not one of them, so its own requests (including any ad requests) use your regular connection. See section 7 of the Privacy Policy.
6. Kill switch
A kill switch prevents traffic from leaving your device outside the VPN if the connection drops.
- iOS: where the app offers a kill switch setting, it uses the system's VPN options so that iOS blocks traffic that would bypass the tunnel. Apple may exempt some system services from VPN routing; this is controlled by iOS, not by the app.
- Android: Android provides the kill switch at system level. Open the app's kill switch setting, which takes you to Android's VPN settings, then turn on Always-on VPN and Block connections without VPN for Nuvotik VPN. Some Android versions or device manufacturers label these settings differently. Some system traffic may still be exempted by Android itself.
Without a kill switch, traffic can briefly use your regular internet connection while the VPN reconnects. The app only shows "Connected" after the operating system reports the tunnel is up and a WireGuard handshake has completed.
7. What a VPN cannot do
A VPN is a useful privacy tool, but it is not an invisibility cloak:
- It does not make you anonymous. If you sign in to a website or service, it knows who you are. Websites can also recognise you through cookies, browser fingerprinting and information you provide.
- It does not encrypt traffic beyond our server. Between our server and the website, your traffic is protected only by the website's own encryption (such as HTTPS).
- It does not protect against malware, phishing or unsafe websites.
- It requires trust in us. Any VPN provider is technically in a position to observe traffic passing through its servers. We have designed our systems not to record your activity and we describe their limits honestly on this page.
- It does not override the law. We must comply with valid legal process that applies to us, but we cannot hand over data we do not have. See section 8 of the Privacy Policy.
8. Questions
If anything on this page is unclear, write to support@nuvotik.com.