DejaVPN Privacy Policy

Last updated: 15 November 2026

In short: DejaVPN has no accounts, no ads and no analytics. We (the app's developer) do not run your VPN servers and receive none of your data. Your configs and settings stay on your device. The app talks to the VPN provider you add, checks our website for new versions, and, while connected, to two public services used to show your exit location and ping (plus a leak-test service, only when you run Leak Check).

This policy explains how the DejaVPN apps for Android, Windows and Linux (“the App”) handle information. DejaVPN is a client for the OpenVPN protocol. It connects to VPN servers that your VPN provider gives you, either as a subscription link or as a .ovpn file.

Who we are

The App is published by DejaVPN's developer (“we”, “us”). Contact: [email protected].

For the little information that reaches us (section 3, our website), we are the data controller under data protection law (such as the UK and EU GDPR). For the data your VPN provider receives (section 2), your provider is the controller, not us.

1. Data stored on your device

Configs. Subscription links, the server configurations they return (addresses, certificates, usernames/passwords or tokens) and imported .ovpn files. Also subscription details shown in the App (name, traffic used, expiry date, status).
Settings. Your choices such as DNS, split tunnelling (the list of apps you exclude), whether servers update when the App opens, local network access, and which configs you pinned.
Connection details. Pings measured per server (for Auto Select) and a connection log used by the VPN engine. When you copy or share the log, public IP addresses and login names in it are hidden first.
Plan reminders. The App notifies you when a subscription is about to expire or run out of data. This is worked out on your device from the details your provider already sends; nothing extra is sent anywhere.

This data is kept in the App's private storage. It is never sent to us. Delete a config in the App, or uninstall the App, to remove it.

2. Data sent to your VPN provider

When you add a subscription link, and each time the App refreshes it or checks it before connecting, the App contacts the address in that link (your provider's server) over HTTPS and sends:

a device identifier (HWID): a random-looking code derived one-way (SHA-256) from Android's per-app device ID (on a computer: from the system's installation ID). It is unique to DejaVPN on your device, cannot be used to find your device's hardware IDs, and changes if you factory-reset the device or reinstall the system;
your device model (e.g. “Pixel 10”), system version (Android, Windows or Linux) and the App version;
which response format the App understands (a technical header), so the provider can send its server names, notices and backup addresses in a form the App can read.

Your provider may in turn send the App information about its service: plan usage and expiry, server names and labels, short notices, fallback addresses to use if its main address stops responding, and for verified partner providers a DNS server for its connections and a request to pin its subscription. The App checks this information and only uses it on your device.

Providers use these to enforce device limits (how many devices can use one subscription) and to show you which devices use your subscription. When you connect to a subscription server, the same HWID and the standard OpenVPN client information (platform and client version) are sent to that VPN server during the handshake. For configs you import as .ovpn files, no HWID is sent.

While connected, all your internet traffic goes through the VPN server you picked. The provider runs that server and decides what, if anything, it logs. Please read your provider's privacy policy. The provider, not us, is responsible for data on its servers.

3. Other services the App contacts

Service	Why	What it receives
Our website (`dpediem.com`)	Checks whether a newer version of DejaVPN is available, so the App can tell you, and fetches a signed list of provider keys that are no longer trusted. At most a few times a day.	A request for a small public file. It carries only the App's version and platform; no identifier, config or personal data. Like any website, our server notes the requesting IP address in short-lived access logs used only for security.
Your VPN servers	Auto Select measures the ping to each server of a subscription before connecting, to pick the fastest.	A standard ping (or an empty connection attempt) to the server addresses your provider gave you. No data is sent.
GeoJS (`get.geojs.io`)	Shows the real country and city of your VPN exit on the connection card.	A single request through the VPN, so it sees the VPN server's IP address, not yours. Nothing about you or your device is sent.
Cloudflare (`1.1.1.1`)	Measures ping (connection speed) shown in the App and the notification.	A plain connection attempt through the VPN, no data is sent over it.
bash.ws (`bash.ws`)	Only when you open Leak Check in Settings: shows which IP address and DNS servers the internet sees, to confirm nothing leaks outside the VPN.	A few requests and lookups of random test names. It sees the IP address and DNS servers your connection uses at that moment (through the VPN when connected). Nothing about you or your device is sent.
DNS provider you choose	Resolves website names while connected, if you pick Cloudflare, Google, Quad9, AdGuard or a custom DNS in Settings.	The website names your apps look up, as with any DNS service. By default (Provider) your VPN provider's DNS is used: either the DNS its VPN server sets, or, for a verified partner provider, a DNS server it names for its connections. Your own choice in Settings always takes priority.

4. What we do not do

The App has no account system, no advertising, and no analytics or crash-reporting SDKs. We do not collect, receive, sell or share your browsing activity, DNS queries, IP address, location, contacts or any personal identifiers. Apart from the version check described above, the App sends nothing to us.

5. Permissions

VPN service. Creates the encrypted tunnel. Android asks for your consent before the first connection.
Internet and network state. Downloads configs and connects.
Notifications and foreground service. Keeps the VPN running and shows its status, traffic and ping while connected.
Start at boot. Used only if you turn on “Connect on startup”.
Camera. Used only while you scan a subscription QR code. The image is read on your device and is never stored or sent anywhere. You can add subscriptions without it by pasting the link.
List of launchable apps. Used only on the Split tunnelling screen, on your device, so you can choose apps that don't use the VPN. The list is not sent anywhere.

6. Security

Subscriptions are fetched over HTTPS only. Traffic between your device and the VPN server is encrypted by the OpenVPN protocol (TLS). The kill switch uses Android's own “Always-on VPN” and “Block connections without VPN” settings.

7. Children

The App is not directed to children under 13 and we do not knowingly collect information from children.

8. Your choices

You can delete any config or subscription in the App at any time, change DNS and other settings, or uninstall the App to erase everything it stored. For data your VPN provider holds (such as device lists or usage), contact your provider.

9. Legal basis, retention and transfers

Legal basis. The version check and our website's access logs rely on our legitimate interest in telling you about updates and keeping the website secure (GDPR Article 6(1)(f)). Everything else stays on your device.
Retention. Our web server's access logs (IP address, time, requested file) are deleted automatically after 15 days. We keep nothing else about you.
Transfers. Our website is hosted in Germany (EU) and delivered through Cloudflare, which may process requests in other countries under its own data processing terms and the safeguards data protection law requires.

10. Your rights

Under data protection law (such as the UK and EU GDPR) you can ask us for access to, correction of or deletion of personal data we hold about you, object to or restrict its use, and ask for a copy in a portable form. Since the App sends us no identifiers, we usually hold nothing that can be linked to you; write to [email protected] and we will answer within one month. You can also complain to the data protection authority where you live.

11. Changes

If this policy changes, we will update the date at the top. Significant changes will be noted in the App's release notes.

12. Contact

[email protected]

DejaVPN is built on the open-source ics-openvpn engine and is licensed under the GNU GPL v2. OpenVPN is a registered trademark of OpenVPN Inc. DejaVPN is not affiliated with or endorsed by OpenVPN Inc.