Privacy policy
What we hold, what we do not, and what the network sees anyway.
Effective date: to be set before publication
SecureSS ("we") sets out below how personal information and traffic are handled in homeVPN ("the service").
1. We do not carry your traffic
The service connects two Android devices of your own: one you leave at home and one you carry. Your traffic does not pass through our servers. We operate no VPN servers and are not in a position to see the content, the destinations or the volume of your traffic.
What we operate is a small signalling service (Cloudflare Workers and Durable Objects) that helps your two devices find each other. It takes part only while a connection is being established.
2. What the signalling service holds
For each household it holds only the following.
| Held | Content | Retention |
|---|---|---|
| Household public key | The public key of the device you leave at home | Until you stop using the service |
| Device list | Public keys of paired devices and their encrypted display names | Until you stop using the service |
| Encrypted connection details | Address information the devices need to reach each other, encrypted with a key only your devices hold; neither we nor Cloudflare can read it | Latest only. Expires after 30 minutes. No history |
| Connection state | Which device is connected right now | While connected |
| Last seen | When each device last communicated | Latest only |
We keep no connection logs — no record of when you connected, to where, or how much you transferred. Display names are encrypted on your device before they are stored, so we never hold them in the clear. Remote status checks and remote restarts are encrypted between your own devices too; the signalling service passes them on without reading or storing them.
3. What we do not keep, but the network sees anyway
So that this policy is accurate rather than flattering:
- Your connection address. Cloudflare necessarily sees the address a connection comes from. We do not read it or record it: our code does not reference it, and request logging and analytics are switched off.
- Address discovery. Your device asks an external STUN server for its own external address. That operator sees the address the question came from.
- The distributed fallback. If that option is enabled and used, your connection address is visible to other participants in a public distributed network. What you are doing and who you are talking to stay encrypted. The option can be switched off in the app, and while it is off nothing is sent.
- Sites you visit. Your traffic leaves through your home line, so the services you use see your home address, as they would if you were sitting at home.
4. What stays on your devices
Keys, the list of paired devices, settings and connection state are stored on your devices and are not sent to us. Where we collect usage statistics, they cover the type of connection route only, in a form that identifies neither you nor your traffic.
5. Payment
Payment is handled by Google Play (Google LLC) when you subscribe in the app, and by Stripe (Stripe, Inc.) when you subscribe on this site. We never receive your card details. We handle only what is needed to tell whether a subscription is valid, how many devices it covers and when it ends. If you subscribe on this site, your contact details are registered with Stripe and handled under their privacy policy.
6. When you contact us
If you write to us, we receive your name, your email address and your message, and use them to reply and to improve the service. We delete them once they are no longer needed for that.
7. Sharing
We do not pass your information to third parties except where the law requires it. We use the following providers to run the service: Cloudflare, Inc. (signalling), Google LLC (app distribution and payment in the app), Stripe, Inc. (payment on this site).
8. Security
Keys are held in protected storage on your devices, and traffic is encrypted. Connection details left with the signalling service are encrypted with a key only your devices hold.
9. Access, correction and deletion
Write to us if you want to see, correct or delete what we hold. Where we do not hold something — the content of your traffic, or a history of your connections — we will tell you so.
10. Changes
If we change this policy we will publish the new version here with the date it takes effect.
11. Contact
Please use the contact page.