Privacy Policy

2.1This Privacy Policy (the "Policy") sets out what User data the Operator processes, for what purposes and on what legal grounds, how long it is kept, and how Users can exercise their rights.

2.2The following terms are used in this Policy:

"Operator" means the UnlockVPN service administration, which organises and carries out the processing of User data. The Operator is identified through the Service's official contact channels listed in section 15.

"Service" means the UnlockVPN VPN service, including the unlockvpn.org website, the Dashboard, the @WinterVpnBot Telegram bot and Telegram mini app, the iOS, Android, and macOS apps, and the Operator's VPN infrastructure.

"User" means an individual who visits the website or uses the Service.

"Account" means the User's record in the Service through which the User accesses the Dashboard and manages the Subscription. "Dashboard" means the area of the website and apps available to the User after signing in.

"Subscription" means a paid or trial right to access the Service's VPN infrastructure for a set period.

"Personal data" means any information relating directly or indirectly to an identified or identifiable User.

2.3By using the Service, creating an Account, or paying for a Subscription, the User confirms having read this Policy and consents to the processing of their data to the extent and for the purposes set out in it. A User who does not agree with this Policy must stop using the Service.

2.4This Policy forms an integral part of the Terms of Service (unlockvpn.org/en/terms) and applies in accordance with applicable personal data law.

2.5The Operator follows the principle of data minimisation: it processes only the information without which it cannot provide the Service, accept payment, secure the Account, or provide support.

3.1Account: email address, display name, profile image (if uploaded), password hash (bcrypt), email verification status, interface language, registration date.

3.2Linked accounts and sign-in: if Telegram is linked, the Telegram ID, username, name, and profile photo; if you sign in with Google, the Google account identifier, email address, and name; an encrypted two-factor authentication (TOTP) secret or a flag for Telegram sign-in confirmation; one-time app sign-in codes sent by email.

3.3Account security events: the IP address and browser or app details (user agent) at the time of sign-in, app session creation, sign-in code request, password reset, or Account deletion request; active sessions and refresh tokens for each device with an app. This information is used only to protect the Account and send sign-in notifications, and is not related to VPN traffic.

3.4Subscription and VPN profile: plan, term, number of device slots, Subscription status; the VPN profile in the access management panel (email address, internal profile name, subscription link, and connection keys); date of first connection, time of last activity, and last server used; aggregate traffic volume counters per period (in bytes), including LTE traffic and purchased packs. The counters are used only to apply plan limits and contain no information about where or what data was sent.

3.5Connected devices: hardware device identifier (HWID), platform, operating system version, device model, app user agent, the device name set by the User, last-online time. This information is used to enforce the device limit and show the device list in the Dashboard.

3.6Payments, balance, and promo codes: transaction details (section 07), the Account's internal balance, and promo codes applied.

3.7Referral and partner programmes: who invited whom, rewards credited, withdrawal requests and the payout details the User provides; attribution of clicks on referral and marketing links (section 09).

3.8Support: requests, messages, and attachments the User sends via the website, Telegram, or email.

3.9Notifications: Dashboard notifications, the address for service emails, and push notification tokens for the mobile apps.

3.10App diagnostics: mobile app error logs — platform, app and operating system version, device model, error message. Used only to fix crashes and bugs.

3.11Blog: an anonymous key used to count post views; likes and comments if the User posts them.

4.1The Operator does not collect or store: the history of websites and services visited; DNS queries; traffic content; the originating IP addresses from which the User connects to VPN servers; VPN session logs, meaning connection start and end times linked to User activity.

4.2An IP address is recorded only for the Account actions listed in clause 3.3 and is not recorded when connecting to VPN servers.

4.3The information listed in section 3 (aggregate traffic volume, a device's last activity time, the last server used) cannot reveal which resources the User visited or what data the User sent.

4.4The Operator does not use third-party analytics or advertising trackers, does not build behavioural profiles, and does not sell, trade, or share User data for advertising or any other commercial purpose.

4.5To protect website forms from automated abuse, the website uses Cloudflare Turnstile, which processes technical browser data under Cloudflare's own terms and is not used by the Operator to track the User.

In short: we do not store information about what you do online through the VPN, so such information cannot be handed to anyone — whether on request or under compulsion. We do not voluntarily disclose Account data to anyone.

5.1The Operator does not on its own initiative transfer, and does not voluntarily disclose, User data to government authorities, including law enforcement, or to any other organisations or persons.

5.2The Operator refuses to provide data in response to informal requests; requests that are not legally binding on the Operator; requests that do not follow the procedure required by law; and requests from bodies that have no jurisdiction over the Operator, including foreign bodies.

5.3The Operator does not build hidden access mechanisms ("backdoors") into the Service, does not hand the Service's cryptographic keys to third parties, does not give them access to the infrastructure to monitor traffic, and does not sell or trade User data.

5.4If the Operator receives a properly issued demand that it is legally obliged to comply with, the Operator will: verify the demand's authenticity, its lawfulness, and the authority of the issuing body; challenge the demand through the procedure provided by law where there are grounds to do so; disclose only the minimum information expressly specified in the demand; and notify the affected User unless such notice is prohibited by law or a court order.

5.5Even then, disclosure can concern only Account-level data that the Operator actually holds (section 3) — for example, the email address and Subscription and payment details. Information about the User's online activity (resources visited, DNS queries, traffic content, originating IP addresses, and VPN session logs) cannot be disclosed, because the Operator does not collect or store it.

5.6If the approach described in this section changes, or the Operator receives a demand that forces it to depart from these principles, the Operator will publish a notice in the official Telegram channel @WinterVpnOfficial to the extent not prohibited by law.

6.1Data is processed to: register and identify the User; provide access to the Dashboard and VPN infrastructure; deliver the Subscription and apply plan limits; accept and account for payments; run the referral and partner programmes; send service and security notifications; restore access; prevent fraud and abuse; handle support requests; fix technical failures; and comply with legal obligations.

6.2The legal grounds for processing are: the User's consent; performance of the Terms of Service to which the User is a party; the Operator's legitimate interest in securing the Service and preventing abuse; and compliance with obligations imposed on the Operator by law (in particular, payment accounting).

6.3The Operator does not process special categories of personal data or biometric personal data and does not use User data to show advertising.

7.1Payments are accepted through the payment providers Lava, Pally, Platega, CryptoBot (cryptocurrency), and Telegram Stars, and through App Store and Google Play in-app purchases.

7.2The Operator stores transaction details: amount, currency, status, provider, the provider's transaction ID, plan or payment purpose, and creation and completion dates.

7.3The Operator does not receive or store bank card numbers or CVV/CVC codes. Payment data is processed by the providers under their own terms and applicable payment law.

7.4For referral and partner payouts, the Operator processes the payout details the User provides in a withdrawal request, solely to make and account for the payout.

8.1Data is shared only with providers without which the Service cannot operate, and only to the extent they need to provide their services:

— hosting and VPN server providers in several countries (including Germany, the Netherlands, the USA, Italy, and Russia — for the route available on mobile networks operating in allowlist mode); VPN servers receive the internal profile name and the keys needed to verify access rights;

— the payment providers listed in section 07;

— the email delivery provider; Telegram — when you use the bot, the mini app, or Telegram sign-in; Apple and Google — for app distribution, in-app purchases, and push notifications;

— the file storage provider (profile images and support attachments) and Cloudflare (Turnstile) — for form protection.

8.2Data may be processed on servers located outside the User's country of residence. The Operator selects providers that ensure adequate data protection and shares only the necessary minimum with them.

8.3The Operator does not sell User data and does not share it with advertising networks, data brokers, or other third parties. Requests from government authorities are handled under section 05.

9.1The website uses only necessary cookies: to maintain the session and sign-in, remember the language and theme (wv_theme), and protect against cross-site request forgery (CSRF).

9.2When you follow a referral or partner link, the website sets its own first-party cookie containing a random identifier so that the visit can be attributed and the referrer rewarded. The last click within 30 days is counted. This cookie is not used to track the User on other websites.

9.3No advertising cookies or third-party analytics cookies are used.

9.4You can restrict or delete cookies in your browser settings; in that case signing in to the Dashboard and some website features may stop working.

10.1Account data is kept for as long as the Account exists. After the Account is deleted (by the User in the Dashboard or on request), the data is removed from the live database; backups are overwritten within no more than 90 days.

10.2Payment, payout, and other accounting records are kept for the period required by accounting and tax law or, where no such period is set, for no more than 3 years from the transaction date, including after the Account is deleted.

10.3Security events and sign-in records are kept for no more than 6 months. App error logs are kept for no more than 90 days.

10.4Support requests are kept until the User asks for them to be deleted or the Account is deleted, unless they are needed to resolve a payment, technical, or legal dispute — in which case until the dispute is resolved.

10.5When the retention period ends, the data is deleted or anonymised.

11.1Data in transit between the User and the Service is protected by TLS. Passwords are stored only as hashes (bcrypt); two-factor authentication secrets are stored encrypted.

11.2Only authorised Operator staff have access to data, and only to the extent required for their duties. Staff sign-in to internal systems is protected by two-factor authentication, and staff actions are recorded in an audit log.

11.3The Operator applies rate limiting, access control, backups, monitoring of suspicious activity, and data minimisation.

11.4If an incident affecting User data is detected, the Operator takes steps to contain it and notifies the affected Users, and any other parties where such notice is required by law.

12.1The User has the right to: obtain information about the processing of their data and a copy of it in a machine-readable format; have inaccurate data corrected; have their data and Account deleted; withdraw consent; object to processing based on the Operator's legitimate interest; and lodge a complaint with the competent data protection authority or a court.

12.2To exercise these rights, the User can write to help@wintervpn.ru from the address linked to the Account or contact support at @WinterVpnSupportBot. The User can delete the Account in the Dashboard (unlockvpn.org/account/delete).

12.3The Operator responds within 30 days of receiving a request. To prevent unauthorised access, the Operator may ask for confirmation that the request comes from the Account holder. Requests are handled free of charge.

12.4Withdrawing consent or deleting data without which the Service cannot be provided ends access to the Service. Data that must be kept by law (clause 10.2) is retained until the relevant period expires.

13.1The Service is not intended for persons under 18 or under the age of majority in their country of residence.

13.2If the Operator learns that an Account was created by a minor, the Operator may delete it together with the related data.

14.1The current version of this Policy is always available at unlockvpn.org/en/privacy; the revision date is shown at the top of the document.

14.2The Operator notifies Users of material changes by email or in the Service interface at least 14 days before they take effect, unless the law requires a different procedure. Changes that worsen the User's position do not apply to previously collected data without the User's consent.

15.1The Operator is the UnlockVPN service administration.

15.2The Operator's official contact channels are: email help@wintervpn.ru, the support Telegram bot @WinterVpnSupportBot, and the official Telegram channel @WinterVpnOfficial.

15.3These are the only official channels for requests, including requests relating to personal data processing and Account deletion. Messages sent through any other channel, or claiming to come from the Operator through any other channel, are not official.