Privacy Policy

This policy explains what personal data the Crew VPN apps (Android, iPhone and iPad, desktop) and the Crew VPN VPN service collect, why, who receives it, how long it is kept and how to delete it. It also covers this website. It is effective from 2026-10-17.

Summary

• We do not collect the content of your traffic, the websites or apps you use, or your precise location.
• We do not sell personal data, and we use no analytics or tracking tools of our own, in the apps or on this website.
• Ads: if you have no paid plan, the Android and iPhone/iPad apps show a short ad from Google AdMob before each free session. Google uses your advertising ID or IDFA only if you allow it; otherwise you see non-personalised ads. Paid plans have no ads. See Ads in the free version.
• News & offers notifications are off until you turn them on.
• Data is encrypted in transit (HTTPS between the apps and our servers).
• You can delete your account in the app or on the account deletion page.

Who is responsible

The Crew VPN service is operated by Crew VPN, India, which is the controller of your personal data. Contact: support@crew-vpn.com.

What we collect

Account

• Your email address and, if you give it, your name (Sign in with Apple shares your name only on the first sign-in, and only if you allow it).
• If you sign in with Google or Apple: the account identifier that Google or Apple gives us for you, and the email address on that account. If you use Apple’s “Hide My Email”, we only receive the relay address.
• If you create an account with email and password: only a scrambled, one-way fingerprint (a hash) of your password. We never store the password itself.
• Your role, account status, and when your latest free session(10 minutes) started and ended.
• One-time codes we email to you to confirm a new account, reset a password or delete an account. A code expires after 15 minutes.

Free-use records

To give each person only one free session per day, when a free session starts we store scrambled one-way fingerprints of your normalised email address (lower case, without “+tags”, and for Gmail without dots) and of your Google or Apple account IDs, with the time of that session. These hashes do not contain your email address and cannot be turned back into it. They can only show whether an email address or account has already used today’s free session. They are kept when you delete your account, so a new account with the same email or Google/Apple account does not get an extra free session.

Country

For each account we store only a country code (for example “DE”), and where it came from. We take it, in this order, from the country of your store purchase (Google Play or the App Store), or from the country of the request to our service: either the country our network provider (Cloudflare) attaches to the request, or an offline country lookup of the request’s IP address on our own server. The IP address is not stored for this, we never derive a city or precise location, and VPN traffic is never inspected for it. We use the country only for aggregate statistics (for example how many accounts are in each country) and to decide where to add VPN servers.

Activity days

For each day, we record whether your account used the app, connected to the VPN, or started a free session, and the time your account was last active. We do not record what you did, for how long, or where you went. Day-by-day records are deleted after 35 days. After that only aggregate statistics remain (for example the number of active accounts per day, per platform or per country), which contain no personal data and are kept for about 13 months (400 days).

Sign-in sessions

For each signed-in app or browser: a hash of the session token (not the token itself), when it was created and expires, and the app’s or browser’s user agent.

Devices and VPN connection data

• For each device you connect: the device name, the platform (for example Android or iOS), the device’s public key (a connection key that is not secret) and the VPN IP address we assign to it inside the VPN.
• From the VPN server: the last connection time (when the device last made contact with the server) and the total bytes received and sent by the device. These are running totals, not a record of what you did or where you went.
• The secret key that protects your traffic is created on your device and never leaves it.

Purchases

Payments are processed by Google Play or the App Store. We never receive your card or bank details. For each purchase we store the store, product, plan, number of devices, the store’s purchase token or transaction ID, its status (for example active, cancelled, expired or refunded), whether it renews, its start and end dates, the store environment and the purchase data the store returns when we verify it. To verify a purchase we send its ID to Google or Apple, and we receive their notifications about renewals, cancellations and refunds.

Security logs

• An audit log of security-relevant actions: sign-in, failed sign-in (with only the domain of the email address tried), sign-up, starting the trial, adding and removing devices, deleting an account, and changes made by our staff. Each entry records the account ID, the action, the time and the IP address of the request.
• Our web servers for the service and this website write standard access logs: IP address, time, request path, response status and user agent.
• The service’s own request log records only the method, route, status, duration and a request ID, without IP addresses.

Support

If you email us, we receive your email address and what you write, and use them only to answer you.

On your device

The apps keep your session token, device key, server address and VPN settings on your device, in the secure storage built into your phone or computer. “Copy diagnostics” copies a redacted report to your clipboard only when you tap it; it is not sent anywhere automatically.

What we do not collect

• The content of your traffic, the websites you visit or the apps you use.
• DNS queries, by default. The VPN server software has a switch that logs DNS lookups (the domain name and the device’s VPN address) for diagnosing problems. It is off by default. If we ever turn it on for a server, for example to investigate a fault, the log stays on that server and we turn it off again when the problem is solved.
• Your precise location, contacts, photos, files or other content on your device.
• Analytics or crash-reporting data. The apps contain no analytics or crash-reporting SDKs. The only third-party SDK that collects data for advertising is Google’s ad SDK, described in Ads in the free version; we never receive your advertising ID from it.
• Card or bank details, and your Google or Apple password.

While you are connected, the VPN server you connect to necessarily sees your device’s public IP address in order to send traffic back to you. The server software does not report it to our account database. Websites you visit through the VPN see the VPN server’s IP address instead of yours.

To keep the servers healthy, each VPN server reports server-level metrics only: CPU, memory and disk use, total network throughput, uptime, and how many devices are connected in total. These metrics contain no user data: no account, device, IP address or destination.

These statements describe how our software works and how we run it. They have not been independently audited.

Ads in the free version

If you do not have a paid plan, the Crew VPN apps for Android and iPhone and iPad show ads from Google AdMob (Google LLC, or Google Ireland Limited for users in the EEA, UK and Switzerland): a short ad you choose to watch before each free session, and sometimes our own messages about plans. Paid plans (passes and subscriptions) have no ads: with a paid plan the apps do not request ads. The desktop app and this website show no ads.

Your consent

• Before any ad loads, the apps use Google’s consent tool (User Messaging Platform) to ask for your consent where the law requires it, for example in the EEA, the UK and Switzerland.
• On iPhone and iPad, the app then asks for permission to track through Apple’s App Tracking Transparency prompt. Google receives the device’s advertising identifier (IDFA) only if you tap “Allow”.
• On Android, Google’s SDK reads the device’s advertising ID. It is used for personalised ads only where you have consented; you can delete or reset it at any time in your device settings.
• If you say no, you still get free sessions. You see non-personalised ads, which are chosen from context such as the app and your approximate location (from your IP address) rather than your profile.

What Google receives

Google’s SDK in the app collects data directly and processes it under Google’s own policies. It can include: your IP address (and an approximate location derived from it), the advertising ID or IDFA if you allowed it, device information (model, operating system, language, screen), the app’s identity, and ad interactions (which ads were shown, taps, whether a rewarded ad was watched), plus diagnostic data about ad loading. Google uses it to show, measure and limit ads, to prevent fraud and, with consent, to personalise ads. We do not send Google your email address, name, VPN traffic or the websites you visit. Read How Google uses information from sites or apps that use its services, how Google uses data for ads and the Google Privacy Policy.

What we receive

• Anonymous daily counts: how many ads were shown, tapped, rewarded or failed to load per day, ad format and platform. They contain no account ID, device ID or IP address.
• If reward verification is switched on, Google confirms to our server that a rewarded ad was watched. We store the confirmation’s transaction ID, the ad unit and your account ID (which the app passes to Google for this purpose only), to start one free session. These records are deleted with your account.
• The app tells our server that an ad was shown when it starts a free session.

Your choices

• No ads at all: buy any plan.
• iPhone and iPad: Settings → Privacy & Security → Tracking, and turn off Crew VPN. This stops Google receiving the IDFA.
• Android: Settings → Privacy (or Google) → Ads, then delete or reset your advertising ID.
• Where Google’s consent form applies, you can open it again from the app’s Settings and change your choice.
• Manage or turn off personalised ads across Google in My Ad Center.

Notifications

• Push token: if you allow notifications, the app registers the device’s push token with our server, with the platform, the push provider, the app’s language and version and when it was last seen. Push messages are delivered by Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iPhone, iPad), which receive the token and the message. The token is removed when you sign out or delete your account, and turned off when the provider reports it is no longer valid.
• Inbox: every message we send to you is also kept in the app’s inbox. We store which messages were delivered to you on which channel (inbox, push, email), whether delivery failed, and when you read them.
• Your settings: two switches in Settings → Notifications. Account & plan reminders (for example a pass ending or a payment problem) are on by default. News & offers (new locations, seasonal greetings, offers) are off by default and sent only if you turn them on; you can turn them off again at any time. Service messages (maintenance, security notices and important announcements) are always delivered.
• We do not send automated messages at night (22:00–08:00 in our server’s time zone), and at most one News & offers message every 3 days.

How we use data, and why

• To provide the service you asked for (performance of a contract): your account, sign-in, connecting your devices, the device limit of your plan, checking purchases, and emailing codes.
• To keep the service secure and prevent abuse (legitimate interests): security and access logs, the free-use records, and rate limits.
• To run the service and plan its capacity (legitimate interests): your country code, activity days, aggregate statistics and server-level metrics, to count active users, see which plans and platforms are used, and decide when and where to add VPN servers. We do not use them for advertising or to build a profile of you.
• To fund free use with ads: showing ads before free sessions and counting them (legitimate interests, and performance of a contract for the free session you ask for). Personalised ads and the use of your advertising ID or IDFA rely on your consent, which you can withdraw at any time.
• To send notifications: account and service messages (performance of a contract and legitimate interests); News & offers only with your consent.
• To answer you when you contact support (legitimate interests, or steps before a contract).
• To comply with the law (legal obligation), for example when a court order requires us to disclose data we hold. We can only disclose what is described above.

We do not use your account data (email, name, devices, traffic counters) for advertising, we do not give it to Google for ads, and we make no automated decisions with legal effects. Marketing messages (News & offers) are sent only if you turn them on.

Who we share data with

We do not sell or rent personal data. We share it only with:

• Google: when you sign in with Google (Google verifies the sign-in) and when you buy through Google Play (Google processes the payment and we verify the purchase with Google). See Google’s privacy policy.
• Apple: when you sign in with Apple or buy through the App Store, in the same way, and to deliver push notifications on iPhone and iPad (Apple Push Notification service). See Apple’s privacy policy.
• Google AdMob (Google LLC / Google Ireland Limited): in the free version of the Android and iPhone/iPad apps, Google collects the data described in What Google receives directly through its SDK, as an independent controller for its own purposes, under the Google Privacy Policy.
• Google Firebase Cloud Messaging: delivers push notifications on Android. It receives the push token and the message.
• Microsoft Azure: Hosts the Crew VPN servers and database(India).
• Upstream DNS resolvers configured on our VPN servers receive the DNS lookups the server forwards for you, without your identity.
• Authorities, only when the law requires it.

Our service providers act on our instructions and may only use the data to provide their service to us.

Where data is stored

Our account database is hosted in India (Microsoft Azure, Central India region). VPN servers are in the locations listed in the app; your traffic and the connection data described above pass through the server you choose. Google, Apple and our service providers may process data in other countries, including the United States. Where the law requires it, such transfers are covered by appropriate safeguards such as the European Commission’s standard contractual clauses.

How long we keep data

• Account, devices, sessions, sign-in identities and purchase records: while your account exists. They are deleted when you delete your account. Expired sessions and removed devices may stay attached to your account until then.
• One-time codes: until used, or for at most 15 minutes.
• Free-use hashes: kept after account deletion, for as long as we offer free use, to prevent extra free sessions.
• Country code and last-active time: while your account exists.
• Activity days: 35 days.
• Aggregate statistics (no personal data): about 400 days.
• Push tokens and notification settings: while your account exists; a push token is removed earlier when you sign out of the app.
• Inbox and delivery records (including read status): up to 90 days, and deleted with your account.
• Rewarded-ad confirmations: deleted 7 days after use, and with your account.
• Anonymous daily ad counts: up to 180 days.
• Data Google collects for ads: under Google’s retention policy.
• Audit log: up to 365 days.
• Web server access logs: up to 14 days.
• Backups: up to 30 days. Data you delete disappears from backups when they expire.
• Support emails: as long as needed to handle your request; ask us to delete them at any time.

Deleting your account

You can delete your account at any time, in the app (Settings → Delete account) or on our account deletion page without installing the app. This immediately deletes:

• Your account: email address, name, password hash (if you set one), role and trial dates
• Your linked Google and Apple sign-in identities
• All your devices: name, platform, connection key (public key), VPN address, last connection time and traffic byte counters. Their VPN access stops within seconds.
• All your sign-in sessions
• Your country code, last-active time and activity days (which days you used the app, connected or used free minutes)
• Your notification settings, push notification tokens and your inbox (which messages were delivered to you and when you read them)
• Records of rewarded ads Google confirmed you watched (if reward verification is on)
• Your purchase records on our server (store, product, plan, purchase or transaction ID, status and dates)

The free-use hashes and security-log entries described above are kept for the periods stated. Deleting your account does not cancel a subscription: cancel it in Google Play or in your Apple ID settings, or you will keep being charged.

Your rights and choices

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you have the right to access your data, to correct it, to delete it, to receive it in a portable format, to object to or restrict its use, and to withdraw consent. To use these rights, email support@crew-vpn.com from the address of your account. We answer within one month. You can also complain to your local data-protection authority. We do not sell personal information. Personalised ads from Google in the free version may count as “sharing” under the CCPA; you can opt out with the choices in Your choices (refuse tracking or consent, or reset your advertising ID). We do not treat you differently for using your rights.

Security

• HTTPS (TLS) between the apps, this website and our servers.
• VPN traffic is encrypted.
• We store only a scrambled, one-way fingerprint (hash) of your password, and of your session tokens. The secret key of each device stays on the device.
• Store and server credentials are stored encrypted. Only authorised Crew VPN staff can use our internal management tools, and their actions are recorded in the audit log.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you and the authorities as the law requires. Report vulnerabilities to security@crew-vpn.com.

Children

Crew VPN is not directed at children. You must be at least 16 years old (or the minimum age for consent to online services in your country, if higher) to create an account. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

This website

• It sets no cookies, uses no browser storage, and loads no analytics, tracking, advertising or third-party scripts. Fonts are served from this site. See the Cookie Policy.
• The contact form does not send anything itself. It opens your own email app with a pre-filled message.
• The account deletion form sends the email address and code you enter to our server, only to delete your account.
• Our web server writes the access logs described in Security logs.

Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it applies.

Contact

Crew VPN, India
Privacy and support: support@crew-vpn.com
Security: security@crew-vpn.com