Privacy Policy

1. Information We Collect

• Account & Authentication Information: Your email address, display name, and Firebase Authentication User ID (UID) when you sign up or sign in using Email/Password or Google Sign-In.
• Single-Device License Identifier: A randomly generated local device identifier (deviceId) stored on your device and bound to your user profile in Google Cloud Firestore to enforce single-user license activation and prevent unauthorized account sharing.
• Subscription & Payment Verification Records: When upgrading from the 3-day trial, we process manual bank transfer Transaction IDs (TID) submitted in the Chrome Extension or Google Play Billing purchase tokens (purchaseToken, productId) in the Android app. We do not collect or store raw credit/debit card numbers or banking passwords.
• Local App & Extension Preferences: Selected server node, theme preference, language preference, routing scope (Full VPN or Smart Routing), and recent diagnostics stored locally in chrome.storage.local (Extension) or encrypted/local AsyncStorage (Android App).
• Advertising Identifier (Free Tier Mobile App): On the free/non-VIP tier of the Android app, Google AdMob may process your Android Advertising ID, approximate IP-derived region, and ad interaction events to serve Banner, Interstitial, and optional Rewarded ads. VIP subscribers see zero ads.

2. Network Routing & Browsing Privacy (Android VpnService & Proxy)

NexCodea VPN Pro does not log, track, inspect, or sell your browsing history or traffic payloads. In the Android app, connecting initiates a user-approved OS tunnel via Android’s VpnService (NexCodeaVpnService) that forwards traffic through your chosen remote proxy gateway while automatically bypassing and protecting tunnel control sockets. In the Chrome Extension, Chrome’s proxy engine routes eligible requests via a non-blocking PAC script. Public IP checks query lookup APIs (such as ipwho.is, ip-api.com, and api.ipify.org) solely to display your active virtual IP address inside the app.

3. How We Use Information

• Authenticate your account, manage 3-day trials, and enforce active subscription entitlements.
• Bind your license to your authorized device (with admin-assisted device reset support).
• Deliver regional proxy configurations, smart checkout routing rules, and optional bank OTP pause controls.
• Verify manual bank slips or Google Play in-app purchases and prevent duplicate/fraudulent redemptions.

4. Data Sharing & Third-Party Services

We never sell, rent, or trade your personal data to data brokers. Core authentication and licensing data is securely processed on Google Firebase (Firebase Authentication & Cloud Firestore) under encrypted HTTPS transport. In the Android app, in-app purchases are processed directly by Google Play Billing, and non-VIP ad units are delivered through Google AdMob.

5. Data Retention & Deletion

Local preferences stored in chrome.storage.local or mobile app storage remain on your device until you sign out, clear data, or uninstall. Account and subscription records remain active while your account exists. You can permanently delete your account and associated profile directly inside the Android app under Settings → Delete Account & Data, or via our Account Deletion Request Page.