This Privacy Policy explains how UMBRA VPN ("UMBRA," "we," "us," or "our") handles information when you use the UMBRA VPN iOS application, this website, and related support services (collectively, the "Services").
1. Scope and operator
This policy applies to the UMBRA VPN application identified by the iOS bundle identifier com.umbra.umbravpn, the UMBRA website, and support communications. It does not govern third-party websites, services, or applications that have their own privacy policies.
2. Information we process
Device and app information
To operate the Services, we may process an app-generated installation identifier, Apple's Identifier for Vendor (IDFV), device model, operating system and version, app version, package identifier, preferred language, region, time zone, request identifiers, and first-open time. The installation identifier is not Apple's advertising identifier and is stored in the iOS Keychain.
Account and authentication information
UMBRA may create a pseudonymous service account based on the installation identifier. The app stores the returned user identifier, user code, UUID, and authentication token on the device so it can request server lists and report connection results. UMBRA does not require your legal name to create this device-based account.
Network and connection information
When needed to operate or diagnose a connection, we may process your public IP address, selected VPN server IP or domain, selected location, protocol type, measured latency, connection result (success, failure, cancellation, or timeout), and event timestamp. Your public IP is requested first from IPinfo and, if unavailable, from ipwho.is. A successful value may be cached on your device.
Subscription information
Subscriptions are processed by Apple through StoreKit. We may receive the product identifier, transaction verification result, entitlement status, expiration date, revocation status, and whether a transaction has been upgraded. Apple processes your payment instrument, billing address, and App Store account credentials. UMBRA does not receive your full card number.
Information stored locally
Selected settings, cached server details, measured latency, onboarding status, connection guidance state, and manually entered server configurations may be stored on your device. Manual server configurations are intended to remain local unless you independently use them to connect to a third-party server.
Support communications
If you contact support, we process the information you provide, such as your email address, message, screenshots, diagnostic details, and correspondence history. Please do not send passwords, complete payment card details, or unnecessary sensitive information.
Website information
This static website does not intentionally set advertising cookies or embed behavioral advertising trackers. Standard hosting infrastructure may process IP address, user agent, request time, requested URL, and security logs to deliver and protect the site.
3. VPN traffic and browsing activity
When connected, network traffic covered by the iOS VPN configuration is routed through the selected VPN infrastructure. The UMBRA app does not intentionally record the content of your communications or build a history of websites you visit. However, VPN infrastructure necessarily processes network packets and may temporarily process source IP, destination information, timestamps, bandwidth, and protocol metadata to transmit traffic, prevent abuse, maintain security, and comply with law.
A VPN does not make you anonymous. Websites and services may still identify you through accounts, cookies, browser or device characteristics, payment information, or activity outside the VPN tunnel. DNS settings, split tunneling, operating-system behavior, and third-party configurations may also affect what traffic is routed through the VPN.
4. How we use information
We use information to:
- authenticate the app and provide available VPN server configurations;
- establish, maintain, troubleshoot, and secure VPN connections;
- measure node latency and show connection status;
- verify subscription entitlements and unlock paid features;
- prevent fraud, abuse, attacks, and unauthorized access;
- respond to support, privacy, and legal requests;
- maintain service reliability and understand aggregate operational performance;
- comply with applicable law and enforce our Terms of Use.
Where applicable, our legal bases include performance of a contract, legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where required.
6. Data retention
We retain information only for as long as reasonably necessary for the purposes described above. Device authentication records may be retained while the pseudonymous account remains active. Operational connection diagnostics are generally retained for no longer than 30 days unless a longer period is required for security investigation, abuse prevention, dispute resolution, or legal compliance. Support records may be retained for up to 24 months after the matter is closed. Local app data remains until removed by the app, iOS, or you; Keychain items may persist after reinstall unless explicitly deleted. Apple retains purchase and billing records under its own policies and legal obligations.
7. Your choices and privacy rights
Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent where processing relies on consent. You may also have the right to appeal a decision or lodge a complaint with a privacy regulator.
- Disconnect the VPN at any time from the app or iOS Settings.
- Manage or cancel subscriptions in Apple ID Settings under Subscriptions.
- Remove ordinary local app data by deleting the app. Contact us if you also want deletion of account-linked server records.
- Request access or deletion by emailing [email protected]. We may ask for limited information needed to verify the request.
UMBRA does not discriminate against users for exercising applicable privacy rights. We do not currently respond to browser-based Global Privacy Control signals because this site does not sell or share information for targeted advertising.
8. Security
We use administrative, technical, and organizational safeguards designed to protect information, including HTTPS transport, iOS Keychain storage for the installation identifier, Apple transaction verification, and access controls. No service can guarantee absolute security. Keep your device and operating system current, protect your Apple ID, and contact us if you believe your account or connection has been compromised.
9. Children
The Services are not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal information from children below the applicable age. A parent or guardian who believes a child provided information should contact us for deletion.
10. International processing
UMBRA, its infrastructure, and service providers may process information in countries other than yours. Privacy laws may differ across jurisdictions. Where required, we use appropriate safeguards for international transfers and honor applicable legal rights.
11. Changes to this policy
We may update this policy to reflect changes in the Services, law, or our practices. We will update the effective date and provide additional notice in the app or on this website when a change is material. Continued use after an update is subject to the revised policy where permitted by law.
12. Contact us
For privacy questions, data requests, technical assistance, or billing support, email [email protected] or visit the Support Center.