Home/Legal/Privacy Policy

Privacy Policy

ROOT VPN LTD · Version 1.1 · Last updated 4 October 2026

1. Introduction and scope

1.1 This Privacy Policy explains how ROOT VPN LTD ("we", "us", "our") collects, uses, shares and protects personal data when you use our products and websites. It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications Regulations 2003 (PECR).

1.2 This Policy applies to the following products and services (together, the "Services"):

• ROOT VPN: our consumer virtual private network application for desktop computers and for iPhone and Android. ROOT VPN offers a free tier and a paid subscription tier. In the desktop app only, free tier users may choose opt-in idle-bandwidth sharing; paid subscriptions disable it. The ROOT VPN apps for iPhone and Android do not include bandwidth sharing (see section 1A).
• Peer SDK: a software development kit that enables opt-in bandwidth sharing within participating partner applications. It is not part of the ROOT VPN mobile apps.
• Business Network: a business-to-business (B2B) residential and ISP proxy network, made available only to verified (KYC'd) business customers. It is not part of the ROOT VPN mobile apps, and no data from the mobile apps is made available to it.
• Our websites, dashboards, support channels and related systems.

1.3 Because the ways in which we process personal data differ significantly between these Services, this Policy identifies, for each processing activity, the personal data involved, the purpose, and the lawful basis relied upon.

1.4 Separate contractual terms (for example, our Terms of Service, Acceptable Use Policy, B2B Customer Agreement and Bandwidth Sharing Consent) govern the use of the Services. Where those documents address privacy matters, they should be read alongside this Policy.

1A. The ROOT VPN mobile apps (iPhone and Android)

1A.1 This section applies to the ROOT VPN apps on the Apple App Store and Google Play (the "mobile apps"). Where it is more specific than the rest of this Policy, this section applies to the mobile apps.

1A.2 Our commitment. The ROOT VPN mobile apps do not sell, use or disclose to third parties any data for any purpose. We handle the data listed in 1A.4 only so that we can provide the VPN service you have asked for. The service providers who help us do that (listed in 1A.5) act only on our instructions under contract and may not use the data for their own purposes. We do not use it for advertising, profiling or tracking, and we do not share it with data brokers, business customers or anyone else.

1A.3 No bandwidth sharing. The mobile apps do not include bandwidth sharing. They never use your device, your connection or your IP address to carry anyone else's traffic. Sections 4.3 and 6, the Peer SDK and the Business Network do not apply to the mobile apps.

1A.4 What the mobile apps collect. This is the complete list:

• Account: your email address and either a hashed password or, if you sign in with Apple or Google, the identifier they give us. A display name only if you choose to add one.
• Subscription status: whether you have a paid plan, which plan, and the purchase identifiers that Apple or Google provide through RevenueCat, the service we use to check in-app purchases. Apple or Google take your payment; we never see or store your card details.
• Device: a device identifier we assign, the device name and platform, the WireGuard public key your device creates, and the tunnel IP address we assign to it.
• Connection: the IP address your device connects from, the start and end time of each session and the amount of data used. We use these to run the connection, enforce device limits and prevent abuse, and we delete them after 30 days. When you connect, we also look up the country of that IP address to choose a suitable server; the result is not stored.

1A.5 What the mobile apps do not collect. We keep no activity logs: no browsing history, no record of the websites or services you visit, no DNS query logs and no traffic content. The apps do not access your location, contacts, photos or files, and they contain no advertising, analytics or tracking software.

1A.6 Who processes it for us. Our hosting providers (servers and VPN network), our transactional email provider, Apple and Google (sign in and in-app purchases) and RevenueCat (purchase validation). See section 9.

1A.7 Deleting your account. You can delete your account in the app (Account, then Delete account), on the web at rootvpn.app/account/delete, or by emailing privacy@rootvpn.app. In the app or on the web, this erases your account, devices, VPN keys and connection records straight away. See section 10 for what is kept.

2. Who we are (data controller) and how to contact us

2.1 The data controller responsible for your personal data is ROOT VPN LTD, registered in England and Wales. See the Company details section at the end of this Policy for our registered office and company number.

2.2 We have appointed a Data Protection Officer (DPO). You can contact the DPO with any question about this Policy or about how we handle your personal data:

• Email (DPO): dpo@rootvpn.app
• Email (general privacy enquiries): privacy@rootvpn.app
• Email (ROOT VPN support): support@rootvpn.app

2.3 If your query relates to the Peer SDK inside a partner application, the partner (the app publisher) may be a separate or joint controller for some data. Where that is the case, we will tell you and provide the partner's contact details.

3. Summary of what we collect (at a glance)

3.1 The table below is a high-level summary only. The detailed processing descriptions in section 4 are authoritative.

4. Personal data we collect, why, and our lawful basis

For each activity below we state (a) what we collect, (b) why, and (c) the lawful basis under Article 6 UK GDPR (and, where relevant, PECR).

4.1 Account data

(a) What: your email address; either a securely hashed password (we never store passwords in plaintext) or an OAuth identifier from your chosen provider (for example, the Google or Apple sub subject identifier); your display name; and email-verification and authentication tokens (including short-lived session and refresh tokens).

(b) Why: to create and secure your account, verify your email address, authenticate you at sign-in, maintain your logged-in session, and communicate essential service messages.

(c) Lawful basis: Article 6(1)(b): performance of a contract (creating and operating your account so we can provide the Services you request). Where we send security-related notifications, we may also rely on Article 6(1)(f): legitimate interests (protecting account security).

4.2 Device and VPN session data

(a) What: device name and platform (e.g. iOS, Android, Windows, macOS, Linux); the WireGuard public key generated by your device and the tunnel IP address we assign to it; the IP address your device connects from; session timestamps (connect/disconnect events); and user-agent/client version information.

(b) Why: to establish the encrypted WireGuard tunnel, assign and route your traffic, associate a device with your account, maintain and troubleshoot connectivity, manage concurrent-device limits, and protect the network from abuse.

(c) Lawful basis: Article 6(1)(b): contract (operating the VPN you have asked us to provide). Certain minimal, short-retention records used to prevent fraud, abuse or attacks rely on Article 6(1)(f): legitimate interests (see section 5 for the "no-log" scope and section 4.7 for abuse logs).

4.3 Bandwidth-sharing (peer) data: opt-in only

This section applies only if you have separately and explicitly opted in to share idle bandwidth (on the ROOT VPN free tier in the desktop app, or through a partner app using the Peer SDK). It never applies to the ROOT VPN apps for iPhone and Android, which do not include bandwidth sharing. Sharing is off by default and paid ROOT VPN subscriptions disable sharing.

(a) What we collect from a sharing peer:

• the fact and record of your consent, stored in a consent ledger (consent version, opt-in timestamp, any withdrawal timestamp, and the mechanism used);
• the exit IP address presented to the destination and coarse geolocation (e.g. country/region) and ASN (network operator), used for routing and quality;
• bytes metered (volume of shared traffic), used to calculate rewards and enforce fair-use limits;
• connection health signals (e.g. latency, uptime, error rates).

(b) What we do NOT collect from a sharing peer. We do not collect, inspect, store or sell:

• the content of traffic that passes through your connection;
• the files, messages, documents or media on your device;
• your own personal browsing history or personal internet traffic;
• any application data belonging to you as the peer beyond the routing/metering signals listed in (a).

(c) Why: to route business-customer requests through the shared network, measure usage fairly, calculate any rewards or credits, monitor and maintain network quality, and prevent misuse.

(d) Lawful basis: Article 6(1)(a): consent, given separately for bandwidth sharing. Where the sharing feature stores or accesses information on your device (for example, reading connection/network information for routing), we also rely on your consent under PECR regulation 6. This consent is separate, specific, unbundled from other terms, freely given and revocable at any time: see section 6.

4.4 B2B customer (Business Network) data

(a) What: business contact details, account administrator identities, and Know-Your-Customer (KYC)/identity-verification information required to onboard a business customer (which may include documents identifying individuals such as directors or beneficial owners), plus authentication credentials and API keys.

(b) Why: to verify the legitimacy of business customers, prevent illegal or abusive use of the proxy network, operate the customer's account, and meet our own legal and regulatory obligations.

(c) Lawful basis: Article 6(1)(b): contract (providing the B2B service), Article 6(1)(c): legal obligation and/or Article 6(1)(f): legitimate interests (fraud prevention, anti-abuse and network integrity) for KYC and screening.

4.5 Billing and subscription data

(a) What: your subscription status, plan/tier, and the customer and subscription identifiers issued by our payment providers (Stripe for purchases on our website, and the Apple App Store / Google Play billing systems for purchases in the mobile apps, which we check through RevenueCat). We do not store your full payment-card number, CVC or bank details. Card data is captured and processed directly by the payment provider.

(b) Why: to take payment, manage renewals and cancellations, apply the correct tier (including disabling bandwidth sharing on paid tiers), and provide receipts and support.

(c) Lawful basis: Article 6(1)(b): contract. Records kept for tax and accounting purposes rely on Article 6(1)(c): legal obligation.

4.6 Support communications

(a) What: the contact details you use and the content of your messages to support@rootvpn.app, privacy@rootvpn.app or other channels, together with related account context.

(b) Why: to respond to and resolve your enquiry and keep a record of the interaction.

(c) Lawful basis: Article 6(1)(b): contract where support relates to a Service you use, otherwise Article 6(1)(f): legitimate interests (responding to enquiries).

4.7 Abuse-prevention and security logs (minimised)

(a) What: deliberately minimised security records, for example, rate-limiting counters, authentication-failure events, indicators of fraud or attack, and records necessary to investigate abuse reports or respond to lawful requests.

(b) Why: to protect users, peers, business customers and the network from fraud, abuse, attack and unlawful use, and to comply with legal obligations.

(c) Lawful basis: Article 6(1)(f): legitimate interests (network and information security), balanced against your rights (see 4.8), and Article 6(1)(c): legal obligation where we must retain or disclose data by law.

4.8 Legitimate-interests balancing (summary)

Where we rely on legitimate interests, we carry out a Legitimate Interests Assessment (LIA) weighing our interest in security and abuse-prevention against your rights and expectations. We limit these activities to what is necessary, minimise the data involved and keep it only as long as needed. You may object to processing based on legitimate interests: see section 12.

5. The "no activity logs" position: precise scope

5.1 We aim to operate ROOT VPN with strong privacy and to minimise the data we retain. To avoid over-claiming, we set out precisely what is and is not logged.

5.2 What we do NOT log for the VPN service:

• the websites, domains, IP addresses or services you visit through the tunnel;
• the content of your traffic (which is in any case encrypted in transit);
• DNS query logs tied to your identity for the purpose of building a browsing profile;
• a persistent, retained mapping of your source IP to your online activity.

5.3 What we may process or retain (and for how long):

• operational session data described in section 4.2 (e.g. connect/disconnect timestamps, assigned tunnel IP, device association), retained for the periods in section 10;
• minimised abuse and security data described in section 4.7, retained only as long as necessary for the purpose;
• data we are legally required to retain or disclose (see section 13).

5.4 Use of the phrase "no activity logs". We only use marketing language such as "no activity logs" where it is accurate and consistent with sections 5.2–5.3, and we qualify such claims appropriately pending an independent audit of our logging practices.

6. Bandwidth-sharing consent: special provisions

6.1 Consent to share idle bandwidth (ROOT VPN free tier in the desktop app, and Peer SDK) is treated as a distinct, high-transparency consent. It is:

• Separate: presented apart from account creation and from acceptance of general terms;
• Specific: limited to bandwidth sharing and the data in section 4.3;
• Unbundled: not a condition of creating an account or using unrelated features;
• Freely given: you can use the paid tier (no sharing) or decline sharing;
• Informed: accompanied by a plain-language explanation of what sharing does and does not involve;
• Revocable: you can withdraw at any time in the app settings or by contacting privacy@rootvpn.app, without affecting the lawfulness of processing before withdrawal.

6.2 We keep a consent ledger recording the consent version, timestamps and mechanism, so we can demonstrate valid consent as required by Article 7 UK GDPR.

6.3 On the paid subscription tier, bandwidth sharing is disabled. If you downgrade to the free tier, sharing is only enabled again if you actively opt in.

7. Cookies and similar technologies

7.1 Our websites and apps use cookies and similar local-storage technologies. Essential/strictly-necessary storage (such as session and authentication tokens) is used to operate the Services; analytics or other non-essential technologies are used only with your consent under PECR.

7.2 Full details, a cookie table and how to manage your choices are in our separate Cookie Policy.

8. Automated decision-making and profiling

8.1 We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing within the meaning of Article 22 UK GDPR.

8.2 We use automated signals for routing and network quality (for example, selecting exit routes using coarse geo/ASN and connection-health data). These are operational decisions about traffic and network paths, not evaluative decisions about you as an individual, and they do not determine your rights, pricing or access based on a profile of you.

8.3 Automated systems used for fraud and abuse prevention may flag activity for human review; material decisions affecting a customer are subject to human involvement.

9. Sharing your data: recipients and sub-processors

9.1 We do not sell your personal data. We share it only as needed to run the Services, and with appropriate contracts in place. For the ROOT VPN mobile apps, the commitment in section 1A.2 applies. Categories of recipient include:

• Payment providers: Stripe and the Apple App Store / Google Play billing systems (subscription processing), and RevenueCat, which checks in-app purchases and subscription status for us;
• Hosting and infrastructure providers: the providers that run our servers and network;
• Email/communications providers: our transactional email provider, for verification and service messages;
• OAuth identity providers: Google and Apple, where you choose to sign in with them (they authenticate you and return an identifier);
• Analytics providers: used on the website only with consent; where we use no third-party analytics, none are engaged;
• Professional advisers, auditors and authorities: where necessary for legal, accounting or security reasons (see section 13).

9.2 Where recipients act on our behalf, they are engaged as processors under Article 28 UK GDPR contracts and may only process data on our instructions. A current list of sub-processors is maintained separately.

9.3 Business customers of the Business Network are independent controllers for their own use of the proxy network and are contractually required to use it lawfully. We are not responsible for their independent processing but we require lawful use and carry out KYC to reduce abuse. No personal data from ROOT VPN app users is disclosed to business customers.

10. Retention

10.1 We keep personal data only for as long as necessary for the purposes described in this Policy, then delete or anonymise it. The periods for each category are set out below.

10.2 Where we are legally required to keep data for longer (for example, financial records or in response to a lawful order), we will retain it for that period only.

10.3 When you delete your account we keep an anonymous record that a deletion took place, with no email address, IP address or other identifying detail. Copies in our encrypted backups are removed as those backups expire on their normal cycle, and we do not restore deleted accounts from them.

11. International transfers

11.1 By its nature, our network involves connections across borders: peers, business customers and exit points may be located in different countries. As a result, personal data may be transferred to or accessed from countries outside the UK.

11.2 Where we transfer personal data outside the UK, we protect it using an appropriate safeguard, such as:

• transfers to countries with UK adequacy regulations; or
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs); together with
• a Transfer Risk Assessment (TRA) and any additional technical or organisational measures needed.

11.3 You can ask us for information about the safeguards we use by contacting dpo@rootvpn.app.

12. Your rights

12.1 Under UK GDPR you have the right to:

• access a copy of your personal data;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten") in certain circumstances;
• restrict processing in certain circumstances;
• data portability: receive certain data in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time where we rely on consent (including bandwidth-sharing consent), without affecting prior lawful processing; and
• not be subject to solely automated decisions producing legal or similarly significant effects (see section 8).

12.2 How to exercise your rights. To delete your account, use Account, then Delete account in the ROOT VPN app, or our account deletion page, which also explains the email route. For any other request, contact privacy@rootvpn.app or dpo@rootvpn.app. We may need to verify your identity. We will respond within one month of a valid request, extendable by up to two further months for complex requests, in which case we will tell you.

12.3 Exercising your rights is normally free. We may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, and will explain our reasons.

12.4 Complaints. You can complain to the Information Commissioner's Office (ICO) (ico.org.uk, helpline 0303 123 1113) though we would welcome the chance to resolve your concern first.

13. Legal requests and disclosure

13.1 We may retain or disclose personal data where we are legally required to do so (for example, in response to a valid court order or lawful request from a competent authority) or where necessary to establish, exercise or defend legal claims, or to protect the rights, safety and security of our users, peers, customers, the public or ROOT VPN LTD.

13.2 We assess the validity of any request, disclose only what is legally required, and, where lawful and appropriate, record such requests. Our Law Enforcement Guidelines set out further detail.

14. Children

14.1 The Services are intended for users aged 18 or over. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If we learn that we hold such data, we will delete it. If you believe a child has provided us with personal data, contact privacy@rootvpn.app.

15. How we protect your data (security)

15.1 We apply appropriate technical and organisational measures to protect personal data, including, at a high level:

• encryption in transit (including the WireGuard-encrypted VPN tunnel and TLS for our web/API traffic);
• encryption at rest for stored data where appropriate;
• password hashing using a strong, modern algorithm (Argon2id), with no plaintext password storage;
• least-privilege access controls, authentication and, where appropriate, multi-factor authentication for staff and systems;
• network segmentation, monitoring and logging of security events (minimised as described above);
• data minimisation and secure development and change-management practices.

15.2 No system is perfectly secure, but we work to protect your data and to detect and respond to incidents, including notifying you and the ICO where we are legally required to do so.

16. Changes to this Policy

16.1 We may update this Policy from time to time. We will change the "Last updated" date above and, where changes are material, provide more prominent notice (for example, by email or in-app). Your continued use of the Services after an update takes effect indicates you are aware of the changes; where a change requires fresh consent, we will ask for it.

17. Contact

• General privacy enquiries: privacy@rootvpn.app
• Data Protection Officer: dpo@rootvpn.app
• ROOT VPN support: support@rootvpn.app
• Supervisory authority: Information Commissioner's Office (ICO), ico.org.uk

Company details

ROOT VPN LTD
Registered in England and Wales
Company number: 17448757
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

ROOT VPN LTD, registered in England and Wales. Terms · Cookies · Acceptable Use