Privacy Policy

Effective 4 November 2026. This policy describes the current Fly VPN Android application, its control APIs and the VPN nodes used to provide the service.

Information processed

When the app registers or loads servers, it processes a random Fly VPN installation identifier, platform, app and Android versions, device model, locale and a public configuration-encryption key. For compatible server pools it also processes a device-scoped Android identifier, a separately generated account identifier, SIM or network country, and the device's public IP address and approximate country or region. These identifiers are used to obtain server lists and short-lived connection credentials; they are not advertising identifiers.

The Fly VPN control service also processes connection events such as the selected server endpoint and protocol, VPN engine, connection state, whether a control endpoint was reachable through the tunnel, coarse network type, connection duration, non-sensitive error category and event time. Connection events use random event and session identifiers and do not include browsing history, website destinations, message contents or raw error messages.

Fly VPN uses Google Firebase Analytics and Crashlytics for product analytics, app reliability and crash investigation. Firebase may process app-instance or installation identifiers, the Android advertising identifier when available, app interactions, app and device information, approximate region derived from network information, performance data and crash or diagnostic details.

Starting with version 1.4.8, builds with AppMetrica enabled use it after you accept the in-app disclosure. AppMetrica processes app sessions, app and device information, an SDK-generated identifier, approximate region inferred from IP addresses and VPN connection outcome events. The custom VPN events contain only a fixed event name, such as a connection attempt, engine start or node probe result. Fly VPN uses these statistics to measure app usage and VPN reliability. Releases before 1.4.7 may use GameAnalytics to measure app usage and aggregate VPN connection outcomes.

Why it is processed

With your consent, Fly VPN records Bobr Link promotion views and clicks on its own servers. A random click code in the Google Play link lets Bobr Link report whether that click led to an installation. The promotion records contain the placement, event times and a hash of the random code. We retain them for up to 90 days to measure promotion performance.

This information is used to select a compatible regional server pool, authenticate the installation, issue short-lived connection credentials, deliver encrypted VPN configurations, operate and secure the service, measure reliability, diagnose failures, prevent abuse and revoke compromised devices. SIM or network country is used for service routing; public IP and approximate region are used for compatible node selection and fraud or abuse controls.

Security

API traffic uses HTTPS. Device tokens and pending connection events are encrypted with Android Keystore-backed keys, VPN configuration envelopes are encrypted for the registered device, and temporary core configurations are removed after use. On the service, connection-event payloads are encrypted with a dedicated server-side AES-256-GCM key held outside the source code and database. The database retains the encrypted payload, a random installation-record reference, receipt time and keyed non-reversible fingerprints needed for reliability totals; event details can be decrypted only by the protected service.

VPN traffic

The control APIs do not receive the contents of websites or messages carried through the tunnel. VPN nodes necessarily receive the device's source IP and process network packets and destination addresses long enough to route the requested traffic. Fly VPN does not use tunnel contents or browsing history for advertising or sale. The app keeps a size-limited local diagnostic log of its own lifecycle and VPN engine errors; browsing content is excluded and common identifiers, hosts, addresses and secrets are redacted.

Service providers and sharing

Fly VPN uses service providers to operate hosting, server-list and credential APIs, public-IP location lookup and VPN nodes. Google Firebase provides analytics and crash reporting, AppMetrica provides product analytics in enabled builds, and GameAnalytics provides product analytics in older releases. Those providers receive only the information needed for their role, such as identifiers and network information needed to issue a credential, the packets needed to provide a tunnel, or app usage and stability information needed to measure and improve the application. Information may also be disclosed when legally required or to investigate abuse and protect users or the service. Fly VPN does not sell personal information and does not share it for cross-context behavioural advertising.

Retention

Structured Fly VPN connection events are retained for up to 90 days so we can measure reliability and diagnose aggregate service failures. Server-list and connection credentials are short-lived or replaced when refreshed. Installation and account records are retained while needed to provide and secure the service. Diagnostic logs are never uploaded automatically. If you explicitly select the diagnostic-report option, review the notice and confirm upload, the service stores the sanitized report for up to 30 days and returns a support code. Service providers may retain limited security and operational logs under their own retention controls.

International processing

Because Fly VPN provides servers in multiple regions, information may be processed in countries other than the one where you live. We use operational and security controls intended to protect the information wherever it is processed.

Your choices

You can decline diagnostic upload and continue using the VPN. Android lets you reset or delete the device advertising identifier in system privacy settings. You may stop using the service and uninstall the app at any time. To request access to or deletion of installation-linked operational records, or early deletion of a diagnostic report, email support@flyspeed.app and include the report support code when applicable. We may retain limited records when required by law or reasonably necessary for security, fraud prevention and dispute resolution.

Contact and changes

Privacy questions can be sent to support@flyspeed.app. We may update this policy as the app or service changes. The effective date above identifies the latest revision, and material changes will be presented through the app or this page where appropriate.

This policy covers the current Fly VPN Android release. New account, payment or advertising features will require an updated disclosure before they are introduced.