Privacy policy | UnitVPN

Version of 19 October 2026

1. Who processes the data

1.1. The data is processed by the UnitVPN Service: its administration (the Administration) is the data controller under Russian law. You can reach it through the support chat (section 13). “Service”, “Administration”, “Account” and “Plan” mean the same as in the terms of service.

1.2. This policy covers the unitvpn.org site, the account area, the UnitVPN apps and the UnitVPN Telegram bot.

1.3. You give consent to the processing of personal data with a separate tick at sign-up or at the first Google sign-in. You can withdraw it under section 9.

2. What data is collected

Account: email, nickname, email language, the password hash (the password itself is not stored). If you sign in with Google: the Google account id, email, name and avatar. If you linked Telegram: your Telegram id and name.
Subscription and money: Plan and dates, Balance, history of top-ups and purchases (date, amount, what was bought, status, payment number at the payment agent). The Administration does not receive card or bank account details.
Devices: name, manufacturer, model, system and app version, which app is connected, when the device appeared and was last online, whether the connection is on, a shortened IP address (the network only, without the last part), an irreversible fingerprint (hash) of the permanent device identifier.
Sign-ins: on which device and in which app the Account is open, the time of last use, a shortened IP address.
Traffic: the volume per day, without site addresses or content.
Settings: app appearance, and on a paid Plan, if you use split tunnelling, the apps and sites you picked, so the setting is the same on all devices.
Support: chat messages, attachments (screenshots and files), survey answers.
Help center search: if no answer is found, I keep the query text, total count and last search time, without linking it to an Account, device or IP. An entry is deleted after 90 days without another matching search. This helps me add missing answers. Please leave personal details out of searches.
Consents: which documents you accepted, which version and when, a shortened IP address.
Growth: who invited you and whom you invited, completed tasks, bonus gigabytes received, entered promo codes.
In-app survey: your answers (ratings, chosen options and any text you wrote yourself), and your Plan, platform and app version at the time of the answer.
How the site and app are used: which pages and screens are open, when and for how long, taps on tasks and download buttons, platform, app version, language, device type (phone or computer), and which site you came from. No IP address, nothing you type and no chat messages. If you are signed in, the records are linked to your Account.
Anonymous app statistics: which server and connection method worked, the network type (mobile or Wi-Fi) and its code. Stored without the Account, device or IP address.

3. What the Service does not collect

Browsing history, site addresses, search queries sent through the VPN and traffic content.
Contacts, GPS location and the full list of installed apps.
Passport data and phone number.

4. Why

to create and keep the Account and give access under the Plan on your devices;
to take payments, keep the Balance and make refunds;
to count traffic and devices within the Plan limit and notice repeated free Accounts of one person and resale of access;
to answer in support;
to protect the Account: email confirmation, sign-in protection, signing out of other devices;
to send service emails and messages: codes, confirmations, reminders that the period ends;
to improve connection quality using anonymous statistics;
to understand which sections are used and make the site and app more convenient, including from survey answers;
to meet legal duties, such as answering lawful requests.

4.1. Marketing emails are sent only with separate consent, and you can opt out at any time.

5. Legal grounds

your consent (article 6, part 1, point 1 of 152-FZ);
performing the terms of service you are a party to (point 5);
duties set by law, such as answering lawful requests (point 2);
the Administration’s legitimate interest in protecting the Service from attacks and fraud, as long as it does not breach your rights (point 7).

6. How data is processed and protected

6.1. Actions with the data: collection, recording, organisation, accumulation, storage, correction, retrieval, use, transfer (provision, access), anonymisation, deletion and destruction. Processing is automated, and manual in support and when resolving disputes.

6.2. Only team members who need the data for their work see it, according to their role. Sign-in to the team panel is protected with a separate password, and team actions are logged.

6.3. Connections to the site and the apps are encrypted (HTTPS). Passwords and sign-in keys are stored only as hashes, IP addresses are shortened, and the database is backed up.

7. Who receives the data

The payment agent: the amount, the order number and the payment status. You pass payment details to the agent and the bank yourself on the payment page.
The email delivery service: the email address and the text of the service email.
Google: if you sign in with Google, the sign-in happens on Google’s side under its rules.
Telegram: if you linked Telegram, the bot sends you messages through Telegram.
Referral programme members: the inviter and the invited friend see each other’s nickname, and the inviter also sees when the friend joined, whether the conditions are met and whether a Plan was paid. They do not see each other’s email or any other data.
Hosting companies: the site, the database and the VPN servers run on their hardware. They do not receive the data for their own purposes.
Government bodies: only on a request made under the law, and only the data that exists.

7.1. Data is not sold and not passed to ad networks.

7.2. Some services work outside Russia: email delivery, Google sign-in, VPN servers in other countries. Only what a feature needs goes there, for example the email address for an email. The VPN servers keep only a technical connection key, without email or name.

8. How long data is kept and how to delete it

Account data is kept while the Account exists.
You can delete the Account in the account settings. Profile, subscription, devices, sign-ins, traffic, settings, bonus gigabytes, survey answers and usage statistics are deleted.
So that the sign-up bonus and the free Plan cannot be claimed again, an irreversible fingerprint (hash) of the email and devices stays after deletion. The email or the device cannot be recovered from it.
Detailed usage statistics are kept for 90 days; after that only daily totals remain, without a link to the Account. The days you opened the site or app are kept for 400 days. All of this is deleted with the Account, and immediately if you turn statistics off in the account settings.
After the Account is deleted, payment history is kept anonymised, without the email or other profile data: it is used to reconcile payments and refunds.
Consent records are kept as proof of consent; the IP address in them is erased when the Account is deleted.
Support attachments are kept up to 90 days after sending, and chat text up to 365 days after the request is closed.
Shortened IP addresses in the security log are kept for 14 days.
An Account whose email was never confirmed is deleted after 30 days, with a reminder by email.
Technical server logs are kept for a limited time to investigate failures and protect against attacks.

9. Your rights

to know what data about you exists and get a copy;
to correct inaccurate data (email and nickname change in the account area);
to delete the Account and the data;
to withdraw consent to processing: the Account is then deleted, except data the law requires to keep;
to opt out of marketing emails;
to appeal the Administration’s actions to the authority that protects the rights of personal data subjects or to a court.

9.1. Send a request to the support chat on the site or in the app (section 13). The reply comes within 10 working days.

10. Cookies and browser storage

10.1. The site sets a sign-in cookie: the account area does not work without it. If you came through a friend’s invitation, a cookie with the invitation code is kept for 30 days. Browser storage remembers small things such as the chosen Plan and hints you have already seen.

10.2. The site has no ad counters or third-party analytics: it counts visits itself, and the data is not passed to other companies. For this, the browser stores a random visitor number and a visit number. If Do Not Track or Global Privacy Control is on in your browser, the site counts nothing. When signed in, you can turn statistics off in the account settings (“Usage statistics”); this also applies in the app.

10.3. The Google sign-in button loads a Google script, which follows Google’s own data rules.

10.4. You can delete cookies in the browser settings; you will then need to sign in again.

11. Age

11.1. Teenagers use the Service too. If you are under 14, a parent or legal guardian gives consent to data processing. No proof of age is requested.

11.2. If you are a parent and your child signed up without your consent, write to support and the Account will be deleted.

12. Changes to the policy

12.1. A new version is published at this address with its date. About significant changes the Administration warns in the account area or by email. The version you accepted is stored with your consent record.

13. Contacts

13.1. Questions about personal data and requests under section 9 are taken in the support chat on the unitvpn.org site and in the UnitVPN app. You can write to the chat after signing in to your Account.