Privacy policy
What we hold, what we do not, and what the network sees anyway.
Effective date: 6 October 2026
SecureSS ("we") sets out below how personal information and traffic are handled in homeVPN ("the service").
1. We do not carry your traffic
The service connects devices of your own: one you leave at home and one you carry. Each can be an Android device, an iPhone or an iPad. Your traffic does not pass through our servers. We operate no VPN servers and are not in a position to see the content, the destinations or the volume of your traffic.
What we operate is limited to two small services: a signalling service (Cloudflare Workers and Durable Objects) that helps your two devices find each other, and a subscription service (Cloudflare Workers; see section 5) that checks the state of your subscription. Neither carries your traffic. The signalling service takes part only while a connection is being established.
2. What the signalling service holds
For each household it holds the following.
| Held | Content | Retention |
|---|---|---|
| Household public key | The public key of the device you leave at home, and when it first connected | Kept after you stop using the service. We handle deletion requests as described in section 9 |
| Device list | Public keys of paired devices, their encrypted display names, and when each was added | Until the device is removed from the list |
| Encrypted connection details | Address information the devices need to reach each other, encrypted with a key only your devices hold; neither we nor Cloudflare can read it | Latest only. Expires after 30 minutes. No history |
| Connection state | Which device is connected right now | While connected |
| Last seen | When each device last communicated | Latest only |
It also handles, without storing them, requests to add a device (for up to 10 minutes) and the signals two devices exchange to connect (for about 10 seconds).
We keep no connection logs — no record of when you connected, to where, or how much you transferred. Display names are encrypted on your device before they are stored, so we never hold them in the clear. Remote status checks and remote restarts are encrypted between your own devices too; the signalling service passes them on without reading or storing them.
3. What we do not keep, but the network sees anyway
So that this policy is accurate rather than flattering:
- Your connection address. Cloudflare necessarily sees the address a connection to the signalling service or the subscription service comes from. We do not read it or record it: our code does not reference it, and request logging and analytics are switched off.
- Address discovery. Your device asks a Cloudflare STUN server for its own external address. Cloudflare sees the address the question came from.
- The IP address shown in the app. To show your IP address and country on screen, the app asks Cloudflare. While the device you carry is connected, it asks through your home line. The answer is only shown on screen and is not sent to us.
- Connections to Apple. Because of how the encryption method works, the device you leave at home connects to a web server of Apple Inc. (www.apple.com). Apple can see your home line's IP address.
- When you subscribe. Stripe, or Apple if you subscribe through the App Store, can see the IP address of the device you subscribe from (section 5).
- Sites you visit. Your traffic leaves through your home line, so the services you use see your home address, as they would if you were sitting at home.
4. What stays on your devices
Keys, the list of paired devices, settings and connection state are stored on your devices and are not sent to us. The app counts, on the device, how often each type of connection route succeeds or fails; these counts are not sent to us either.
5. Payment
You sign up and pay in the app on the device you leave at home. You cannot subscribe on this site. If that device is an Android device, payment is handled by Stripe (Stripe, Inc.); if it is an iPhone or iPad, by Apple Inc. through the App Store.
Paying through Stripe (when the device at home is an Android device). You enter your email address and card details on the payment screen inside the app.
- Card details. In the app, you type them into an input component provided by Stripe, which sends them straight to Stripe. Our app and our servers never receive your card number or other payment details.
- Email address. It is registered with Stripe for receipts and notices about your subscription. When you subscribe in the app, it passes through the subscription service on its way to Stripe; the subscription service does not store it. We may look up the registered email address in Stripe's dashboard to deal with receipts or your enquiries.
- Device information. The Stripe software built into the app sends the device identifier (Android ID), technical information such as the device model, OS version and app version, and a record of how the card form is used to Stripe, to process payments, prevent fraud and investigate faults. When your card issuer verifies you (3D Secure), device information such as the model, screen size, language, time settings and mobile carrier is sent through Stripe to your card issuer for that verification. Stripe's software also has a separate feature that collects detailed device information for fraud detection; we have turned it off.
The iPhone / iPad app does not include Stripe’s code. The device information above is sent only when you sign up through Stripe in the app on an Android device you leave at home.
Stripe handles this information under its own privacy policy.
Paying through the App Store (when the device at home is an iPhone or iPad). You subscribe with an auto-renewing App Store subscription. Apple handles payment, renewal, cancellation and refunds, and we do not receive your card details, Apple ID, name or email address. To link the subscription to your household, the app sends the purchase record (signed by Apple) to the subscription service, and the subscription service receives the subscription’s status from Apple (the App Store Server API and App Store Server Notifications). All we give Apple is a random identifier that says nothing about your household. Apple handles this information under its own privacy policy.
To check the state of your subscription, the subscription service holds the following for each household. It does not hold your email address or Stripe's customer or subscription numbers.
| Held | Content | Retention |
|---|---|---|
| Subscription record | A household identifier (derived from the public key of the device you leave at home), and the subscription's state, end date, number of devices and whether it is a free trial | Kept after you cancel (so that the free trial is limited to once per household). We handle deletion requests as described in section 9 |
| Link to Stripe | A random identifier that links your Stripe subscription to your household | Same as above |
| Link to the App Store | A random identifier that links your App Store subscription to your household, the subscription’s number (Apple’s original transaction ID), and its product, status and expiry date | Same as above |
| Linking code | The code the device you leave at home issues when you subscribe | Stops working after 30 minutes and is deleted a day later |
To check the state of your subscription, the device you leave at home sends its public key and a signature to the subscription service (about once a day, more often near the end date). The subscription service keeps no logs.
6. When you contact us
If you write to us, we receive your name, your email address and your message, and use them to reply and to improve the service. We delete them once they are no longer needed for that.
7. Sharing
We do not pass your information to third parties except where the law requires it. We use the following providers to run the service: Cloudflare, Inc. (signalling, subscription checks, and address and IP address lookups), Google LLC (app distribution), Stripe, Inc. (payment when the device at home is an Android device), Apple Inc. (distribution of the iPhone / iPad app, and payment through the App Store).
8. Security
Keys are held in protected storage on your devices, and traffic is encrypted. Connection details left with the signalling service are encrypted with a key only your devices hold.
9. Access, correction and deletion
Write to us if you want to see, correct or delete what we hold. Where we do not hold something — the content of your traffic, or a history of your connections — we will tell you so.
10. Changes
If we change this policy we will publish the new version here with the date it takes effect.
11. Contact
Please use the contact page.