BiliBoba VPNPrivacy Policy
In short: we don't ask who you are, and we don't record the websites or services you connect to. We keep a small amount of technical data about your device so the Service works, to stop abuse, and to know roughly where our users are. We don't sell your data.
What we do not do
- We don't ask for your name, email, phone number or password.
- We don't record the websites, apps or services you visit through the VPN, and we don't store the content of your traffic.
What we do store
- A random device identifier that the app keeps on your iPhone, and the public part of a key created by Apple's device verification (App Attest). They let us treat your iPhone as one user and recognize it again, including after you reinstall the app. They don't contain your name or any personal details.
- Your last IP address and its country, seen when the app contacts our servers before the VPN connects. We use it to prevent abuse and to understand roughly where our users are. We keep only the most recent one and overwrite it the next time.
- Usage totals for your device: how much data it sent and received, when it was last active, and which location you chose. We use them to run and capacity-plan the Service and to spot abuse.
- Connection settings that we issue to your device. They expire after a day and are replaced automatically.
- Subscription and promotion status: whether and until when you're ad-free, based on a purchase record signed by Apple. We never see your payment card or Apple Account details; Apple handles payment.
Servers and logs
The VPN servers do not keep logs of the destinations you connect to or of your connections. The web server that answers the app's requests to our API (these happen before the VPN connects) keeps standard request logs, meaning IP address, time and the requested page, for up to 14 days for security and troubleshooting. Other short-lived technical logs, such as error messages, are deleted regularly.
Ads
The free version shows ads from third-party advertising partners. Depending on the partner and your iOS privacy settings, they may process an advertising identifier and basic device information to show and measure ads. They have their own privacy policies. If you don't allow tracking when iOS asks, ads are not personalized. A paid subscription removes ads.
How we use it
- to provide, secure and improve the Service;
- to prevent abuse, fraud and automated sign-ups;
- to give you the ad-free period you paid for or were given;
- to comply with the law when we are legally required to.
Sharing
We don't sell your data. We share it only with service providers that help us run the Service (for example server hosting and Apple, for purchases and device verification), with advertising partners as described above, and with authorities when the law requires it.
How long we keep it
Device records are kept while the device uses the Service and are deleted on request. The last-seen IP address is overwritten each time. Usage totals are kept in aggregate to run the Service.
Your choices and rights
You can ask what we hold about your device, ask us to correct or delete it, or object to how we use it. Email [email protected] and we'll respond within a reasonable time. Deleting your record also removes your promotional history. Depending on where you live, you may have additional rights, and you may complain to your local data protection authority.
Security
Connections to our servers are encrypted. We limit who can access our systems and keep the data we hold to a minimum. No system is perfectly secure, but we take reasonable care.
Children
The Service is not meant for people under 16, and we don't knowingly collect their data.
Changes
If we change this policy, we'll update the date above and, for significant changes, tell you in the app or here.