Privacy Policy

1. Who we are

The application is published by AdaptGroup LLC, a limited liability company registered in the State of Wyoming, USA, filing ID 2026-002012463, at 30 N Gould St Ste R, Sheridan, WY 82801, USA.

For anything in this policy, and to exercise any right described in section 11, write to [email protected]. We answer in English and Russian.

2. The commitment this policy exists to make

Avelir does not sell, use, or disclose to third parties any data for any purpose.

We can make that commitment without carving out exceptions because of how the application is built: no data from the app reaches us at all. We operate no analytics service, no crash reporting service, and no server that receives anything the app produces. There is no account, no sign-in, and no profile of you anywhere on our side, because there is nowhere on our side for one to exist.

Section 5 explains the one case where data does leave your device, and why it is not us who receives it.

3. We are not in the path of your traffic

Avelir is a client, not a VPN service. The servers your traffic passes through belong to the provider whose subscription link you added. We do not see that traffic, we do not log it, and we could not: there is no server of ours between you and the internet.

What is recorded on your provider's servers is decided by whoever runs them. Ask them; we cannot answer for it and we cannot see it.

4. The installation identifier

On first run the application generates a random identifier — a version 4 UUID produced by the operating system's cryptographic random number generator. It is never derived from your device: not from an IMEI, not from a MAC address, not from a serial number, not from an advertising identifier, not from the Android ID or the iOS identifierForVendor. This is deliberate. Non-resettable hardware identifiers are prohibited by both Google Play and App Store policy, and a random value counts devices just as well.

The identifier is stored as an ordinary file inside the application's private storage on your device. It does not survive uninstalling the application: on every platform, deleting Avelir deletes the identifier with it, and a fresh install generates a new one. We say this out loud because a reinstall will look to your provider's panel like a new device, and may use up one of the device slots on your subscription until they release the old one.

You can stop it being sent. Settings → Advanced → Send device identifier. It is on when you install the app, and you can turn it off at any time. If you turn it off, most provider panels will refuse to return a server list, because counting devices against your subscription is what they use the identifier for — the app will tell you when this happens rather than failing silently.

5. What leaves your device, and who receives it

5.1 The request to your provider's panel

When the application asks a subscription address for the server list, it adds five headers to the request:

These go to the address you typed in, and only there. They do not come to us: we operate no endpoint that receives them. Under the GDPR the provider whose address you entered is the controller of what they receive; we are neither controller nor processor of it, because we determine neither the purpose nor the means, and never hold a copy.

Values are truncated to 128 characters and stripped to printable ASCII before they are sent. Nothing else is added to the request by the application. The subscription link itself is deliberately kept out of the app's own diagnostic records — it grants access to your VPN.

5.2 Connections the application makes on its own

Everything in this list is a connection the app makes without being told to. It is complete.

Checking that the tunnel actually carries traffic. Before the app is willing to say Connected, it asks two hosts for an empty page — connectivitycheck.gstatic.com and, if that stays silent, connectivity-check.ubuntu.com. These requests go through the tunnel, so those hosts see the exit server's address, not yours. Two hosts on different infrastructure, so that one being unreachable where you are cannot condemn a working tunnel. The check can be switched off in Settings.

Resolving your VPN server's own name. A tunnel cannot resolve the address of the server it has not connected to yet. Before the tunnel exists, the application asks a public resolver for that one name, outside the tunnel: 9.9.9.9 or 8.8.4.4 on Android, Windows and Linux; 1.1.1.1 or 8.8.8.8 on Apple platforms. Those resolvers therefore see your real address and the hostname of the server you are about to connect to. This is unavoidable in any VPN client and we prefer to name it rather than leave it out.

Geographic routing data. On Android, if your subscription uses rules that need them, the app downloads geoip.dat from GitHub Releases. GitHub sees your address and the fact that a file was fetched. Nothing about you is sent with the request, and the file is verified against a SHA-256 hash pinned in the build.

Checking whether a resolver you entered works. If you use the DNS check in Settings, the app sends one query for example.com to the resolver you named. It goes outside the tunnel on purpose — the point is to test that resolver, and the answer would be meaningless through a tunnel. Nothing is sent to example.com; it is only the name being asked about.

Measuring latency to your servers. Connections go to the servers in your own subscription, and nowhere else.

Checking for a new version — builds installed from our website only. Builds you install from avelir.app, from GitHub Releases, or with the Windows installer ask https://avelir.app/version.json whether a newer version exists. That request reaches a server we control, and its web server logs can contain your IP address and the version you are running. It carries no identifier and no headers about your device. Builds installed from Google Play or the App Store do not make this request at all — the store handles updates, and the code that would make it is not in those builds.

5.3 What the application never does

It contains no analytics, no crash reporting, no advertising, and no tracking of any kind — not ours and not anyone else's. There is no third-party SDK in the application that sends anything anywhere. Nothing about how you use the app, which servers you choose, when you connect, or how much traffic you move is transmitted off your device by the application.

6. What stays on your device

All of the following is stored on your device, is never transmitted by the application, and is deleted when you uninstall it:

• Your subscriptions, including the subscription link and the servers, credentials and routing rules that came with it.
• Your own settings: routing rules, DNS entries, split-tunnelling choices, language, theme.
• Traffic counters — how many bytes moved through the tunnel, by day and by server. Kept for 92 days and then deleted automatically. The application removes the file itself rather than emptying it, because an empty file still records the dates of its own existence.
• A diagnostics log, in memory only, holding the last 500 entries. It is never written to a file and does not survive closing the application.

Credentials are removed from diagnostics entries as they are written, not when they are displayed. Subscription links, node passwords, UUIDs and key-shaped strings are replaced before an entry is stored, so the log can be sent to your provider's support as it is. You are the only one who can send it: the app copies it to your clipboard when you ask, and has no other way to move it.

How this data is protected, plainly. It sits in the application's private storage, which the operating system keeps other applications out of. On Android, system backup and device-transfer are switched off for this application specifically so that the subscription link and node credentials are not copied to a cloud backup. The files are not encrypted by the application itself. On a device where someone has root or administrator access, or on a computer where someone has your user account, they can be read. If that is part of your threat model, use full-device encryption, which every platform we ship on provides.

7. The website

avelir.app has no analytics, no tracking pixels, no third-party scripts and no advertising. It sets no cookies of its own and asks for no consent, because there is nothing to consent to.

The site is served through a content delivery network and a web server, and both keep request logs. Those logs can contain your IP address, which is personal data under the GDPR. We keep them to run the site and to deal with abuse — that is our legitimate interest under Article 6(1)(f) — they are not used to build a profile of anyone, and they are not combined with anything from the application. Logs are retained for 30 days and then deleted.

8. Legal bases, for readers in the European Union

9. Children

The application is not directed at children, is offered for people aged 18 and over, and collects nothing that would identify anyone of any age. Since it collects nothing about anyone, no age-based distinction is possible or necessary.

10. California

We do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act as amended. We have no advertising, no data brokers and no analytics, so there is nothing to sell or share. If you want to exercise any right under that Act, write to [email protected]; we will tell you in writing what we hold, which in practice is nothing that identifies you.

11. Your rights

Under the GDPR and comparable laws you may ask what personal data we hold about you, ask for a copy, ask for it to be corrected or erased, object to processing based on legitimate interest, and complain to your supervisory authority.

In practice we hold nothing that identifies you: there is no account, no profile, and no server-side record of your use of the application. Write to [email protected] and we will tell you exactly that, in writing, with the reasoning above, within one month.

To delete everything the application holds, uninstall it. Everything described in section 6 lives on your device and goes with it — including the identifier from section 4. There is nothing left behind on our side, because nothing was ever sent there.

Data your provider holds is not ours to delete. Ask them.

12. Third parties

We share no user data with anyone, so the confirmation Apple requires about third parties providing equal protection has nothing to attach to. For completeness, the only parties that see anything at all as a consequence of using Avelir are:

• your provider, at the address you entered — see section 5.1;
• the connectivity, resolver, and geodata hosts named in section 5.2, each of which sees only what that section describes;
• our own website, and only for builds installed outside the app stores.

None of them receives data from us. Each of them receives, at most, a connection from your device, described above.

13. Changes

When this policy changes, the date at the top changes with it. This page is the only place where the current version lives, and it is published in the same six languages as the rest of the site.

14. Language

If a translation and the English version disagree, the English version governs.