Privacy Policy – OkayFreedom VPN for Android

Preliminary Remarks

OkayFreedom VPN for Android (hereafter: the app) is a Virtual Private Network service (hereafter: VPN service) that routes the internet traffic of your Android device through servers in different countries (VPN servers). This conceals your IP address from the websites and services you use and encrypts your data traffic. The service is offered by Steganos Software GmbH, Rüppurrer Straße 1a, 76137 Karlsruhe, Germany (hereafter "Steganos" or "we"). The app is free of charge and financed by advertising: you watch a short rewarded video and receive a fixed amount of VPN data volume in return.

This privacy policy explains which data the app processes, for what purpose, on which legal basis under the General Data Protection Regulation (GDPR), and which rights you have. The general privacy policy of the Steganos website (www.steganos.com) applies to the website; this document applies to the app.

§ 1 No Logging of Your Activity on the VPN Servers

The VPN servers do not record which websites, services or contents you access, nor the contents of your data traffic. It is technically not possible for Steganos to determine what you do over the VPN connection.

For the operation of the service the VPN servers record, per connection, the pseudonymous identity of the app installation (§ 2), the start and end time of the connection, the amount of data transferred (only the volume, never addresses or contents), the VPN server used, the IP address assigned to your device inside the VPN, and the IP address from which your device connected to the VPN server. These records are used to keep track of your data volume, to enforce the usage limits of the service, to detect misuse and to resolve technical faults. They are kept for the current billing period and deleted after 90 days at the latest. The websites and services you use over the VPN see only the address of the VPN server, never your own.

§ 2 Pseudonymous Identity Instead of an Account

Using the app does not require an account, an email address or any other personal detail. When the app is started for the first time, our server assigns a random identifier (client ID) to the installation. It is not derived from any property of your device and cannot be traced back to you or your device by Steganos. Together with the client ID the app receives the access credentials for the VPN servers, which it stores encrypted on your device.

Your data volume (the balance shown in the app) and the number of advertising videos watched today are stored on your device.

§ 3 Advertising (Google AdMob)

The app shows rewarded video advertising through Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), and, where applicable, advertising partners that bid through Google AdMob. Advertising is shown only while the VPN is disconnected; it is never shown or requested over the VPN connection.

To request and show an advertisement, Google and its partners process data from your device: your IP address (from which an approximate location is derived), the advertising ID of your device, device model, operating system version, language, and information about the interaction with the advertisement (shown, completed, tapped). Steganos does not receive this data.

If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your consent before any advertising is requested (consent dialog according to the IAB Transparency & Consent Framework). Without consent to personalized advertising, only non-personalized advertising is shown, or none. You can change your choice at any time under "Privacy options" in the app menu. The list of advertising partners and their privacy policies is shown in the consent dialog. Google's privacy policy: https://policies.google.com/privacy; how Google uses data from partner apps: https://policies.google.com/technologies/partner-sites.

Legal basis: your consent (Art. 6 (1) (a) GDPR) where consent is required; otherwise our legitimate interest in financing a free service (Art. 6 (1) (f) GDPR).

§ 4 Usage Statistics (Google Analytics for Firebase)

To understand whether the service works and how it is used, the app sends usage events to Google Analytics for Firebase, a service of Google. Events include: app start and first start, completion of the introduction, advertising requested / shown / rewarded / failed, connection established and ended (with the server country, the duration, the data volume the app counted and technical diagnostics of the data counter), balance exhausted, daily limit reached, consent dialog shown and its result. Each event carries device model, operating system version, app version, the app language and an approximate country derived from the IP address by Google; Steganos does not store IP addresses in the statistics. In addition the app records as user properties: the source of the installation (the campaign parameters passed by Google Play at install time), the app variant, and your client ID (§ 2), so that connection statistics can be compared with the server records of § 1 for the purpose of verifying the data counter.

The statistics are pseudonymous. They are not merged with your advertising identity. If you are in the European Economic Area, the United Kingdom or Switzerland, usage statistics are only collected after you have given consent in the consent dialog; otherwise they are collected on the basis of our legitimate interest in operating and improving the service (Art. 6 (1) (f) GDPR).

§ 5 Data Sent to Our Servers by the App

Besides the connection records of § 1, the app communicates with our servers to register the installation (§ 2), to fetch the list of available server countries, to determine your public IP address for display in the app (the address is shown to you and not stored), and, when a connection is established, to report the network address of your device together with the VPN server it connects to. The latter is used for statistics on which servers are in use; only the most recent value per client ID is kept, it is overwritten on the next connection and deleted together with the client record (§ 10). Legal basis: performance of the service and our legitimate interest in operating the server network (Art. 6 (1) (b) and (f) GDPR).

§ 6 Diagnostic Logs You Send Us

The menu item "Send logs" collects the app's recent technical log lines together with your client ID and the data counter statistics and hands them to an app of your choice (email, messenger) for sending to Steganos support. Nothing is sent without your action. The logs may contain IP addresses and server names. We use them exclusively to analyse the problem you report and delete them when the case is closed.

§ 7 Notifications and Device Permissions

The app shows local notifications about the running VPN session and when your data volume is used up. It does not use push notifications. It requests the VPN permission of Android in order to establish the tunnel, and the notification permission. It does not access your location, contacts, files, camera or microphone. The server country you select in the app is a setting, not a location measurement.

§ 8 Recipients and Transfers to Third Countries

Recipients of personal data are Google (advertising and statistics, §§ 3 and 4) and the hosting providers from which Steganos rents the servers of its network; they act on our behalf and are bound by data processing agreements. Google may process data in the United States; the transfer is based on the EU-U.S. Data Privacy Framework and standard contractual clauses.

VPN servers are located in the countries offered in the app. When you select a country outside the European Economic Area, your traffic and the connection records of § 1 are processed on a server in that country. This transfer is necessary to provide the service you have requested and takes place on the basis of your choice (Art. 49 (1) (b) GDPR). Our registration and licence servers are located in Germany.

Beyond this, Steganos does not disclose personal data to third parties unless legally obliged to do so.

§ 9 No Payments in the App

The app currently contains no purchases and processes no payment data. Should a paid, unlimited version be offered in the future, payment would be handled by Google Play; Steganos would not receive your payment details.

§ 10 Retention

The client ID, the VPN access credentials and the most recent network address (§ 5) remain stored on our servers for as long as the installation exists. Because the app has no account, we cannot tell when you uninstall it; you can have the record deleted at any time by sending us your client ID (§ 11). Connection records: § 1 (90 days). Event-level usage statistics are kept by Google Analytics for Firebase for 2 months; aggregated statistics without any identifier are kept longer. Advertising data is subject to Google's retention rules. Uninstalling the app deletes all data stored on the device, including your balance.

§ 11 Your Rights

You have the right to access the personal data we hold about you, to have it rectified or erased, to restrict its processing, to object to processing based on legitimate interest, and to data portability (Art. 15–21 GDPR). Consent given in the app can be withdrawn at any time under "Privacy options". Because we do not hold your name or contact details, please quote your client ID (shown in the app's log header, "Send logs") so that we can find the records belonging to your installation. You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for Steganos: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

§ 12 Children

The app is not directed at children under 16 years of age.

§ 13 Changes

Steganos may update this privacy policy when the app or the legal situation changes. The current version is available at the address linked from the app menu.

§ 14 Questions and Comments

If you have questions, comments or requests regarding the protection of your data, contact us at privacy@steganos.com or by post at the address above.

Version: September 1st, 2026