Privacy policy: XGo VPN

1. How XGo uses Android's VPN service

XGo is a VPN client. Creating a VPN connection is its core function, and it uses Android's VpnService to do it:

• The VPN starts only when you tap Connect and accept Android's VPN permission dialog. It stops when you tap Disconnect in the app or in its notification.
• While it runs, Android shows a key icon in the status bar and XGo shows an ongoing notification.
• The connection between your device and the VPN server is encrypted by the protocol of the config you selected (VLESS, VMess, Trojan, Shadowsocks, ShadowsocksR, Hysteria2, WireGuard, AmneziaWG, OpenVPN, IKEv2, SSTP or Cisco AnyConnect). How strong that encryption is depends on the server's own settings, which are chosen by whoever runs the server.
• You choose which apps use the VPN.
• XGo does not inspect, record, redirect or modify your traffic, does not inject anything into it, and does not use the VPN to show, insert or change ads.

2. Your traffic and the servers you add

XGo does not provide VPN servers. When you connect, your traffic goes to the server in the config you added. The people who run that server can see your connection to it, and their own privacy policy applies to it, not this one.

• Your configs, subscription links and settings are stored only on your device. When you refresh a subscription link, the app downloads it directly from the address you entered.
• Latency tests connect directly from your device to your servers.
• After you connect, XGo asks Cloudflare's public page at 1.1.1.1, through the VPN, which country your traffic leaves from, so it can show the right flag. Cloudflare sees your VPN server's address, not your own.

3. Data that stays on your device

• Installed apps. To let you choose which apps use the VPN, XGo reads the list of apps on your device. The list is used only on your device and is never sent anywhere.
• Camera. Used only while you scan a QR code. The image is read on your device and not stored or sent.
• Imported files. WireGuard, AmneziaWG and OpenVPN profiles and IKEv2 certificates you import are stored inside the app on your device.

4. What the app sends to us

When it starts, the app registers with our server over an encrypted (HTTPS) connection and sends:

• an installation ID that the app derives from your device and passes through a one-way hash, so it is not your name, email address, phone number or Google account;
• the app version and your Android version.

We use this to keep the app working, to prevent abuse and to count active installations. The app also downloads its own settings, such as the address of our server, from Google Firebase Remote Config.

5. Analytics and install measurement

• Google Analytics for Firebase records how the app is used, such as which screens are opened, so we can find problems and improve it. Google receives an app instance identifier, your device model, Android version and an approximate country derived from your IP address.
• AppsFlyer tells us where installs come from, for example which campaign or store page led to them. It receives your device's advertising ID, device model, Android version, IP address and install referrer.

Neither of them receives your VPN traffic, your configs, your servers or your browsing. You can reset or delete your advertising ID at any time in Android's settings. Each provider processes data under its own privacy policy.

6. Sponsor page

XGo is free. At most once a day, after you disconnect, XGo may open a sponsor web page in your browser. To get the page, the app sends its installation ID to our server. It is an ordinary web page that you can close at any time. The app contains no advertising SDKs.

7. What we do not do

• No user accounts or sign-in.
• No logging of your traffic, browsing or DNS queries.
• No sale or rental of personal data.
• No access to your location, contacts, microphone or files beyond the ones you choose to import.

8. Children

XGo is not directed at children under 13, and we do not knowingly collect data from them.

9. Your choices and deletion

• Delete everything stored on your device at any time by clearing the app's storage or uninstalling it.
• To have your installation's registration deleted, or to exercise any right you have under the GDPR (access, correction, deletion, restriction, portability or objection), email us. We reply within one month.
• You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

10. Security

All communication between the app and our server uses HTTPS. Your configs and keys never leave your device except to connect to the servers in them.

11. Changes

If we change this policy we will update the effective date above and post the new version on this page.

12. Contact

Climax Cyber Tech OÜ, Tallinn, Estonia: [email protected]