Privacy Policy

OQOS is a VPN. Your VPN traffic does not pass through our own servers, so we have no record of the sites you visit. This policy explains the small amount of data we do need to run your account, why we need it, and the rights you have over it.

EFFECTIVE 30 SEPTEMBER 2026

The OQOS service is operated by MKV IT Solutions Ltd, a private limited company incorporated in England and Wales (Companies House No. 17172181), registered office 128 City Road, London, EC1V 2NX, United Kingdom. MKV IT Solutions Ltd is the data controller for your personal data under the UK GDPR and the EU GDPR.

For any privacy question or to exercise your rights, contact support@oqos.io with the subject prefix [GDPR].

We collect only what is needed to give you an account and a working VPN connection:

• Free access on a device. When you start free access in the iOS app, we create an account for that device. The app sends us the device identifier that iOS assigns to the app on your device (identifierForVendor) and the platform ("ios"). We issue a device token, which the app keeps in the device Keychain. We store the identifier, a hash of the token, and the account's start and end dates.
• Free access on Android. When you start free access in the Android app, the app creates a device identifier from values Android provides (including the Android ID) and sends it with the platform ("android"). We issue a device token. The app keeps it on the device and saves a copy in Google Block Store so that free access can be restored after a reinstall. Block Store keeps the copy on your device and includes it in your Google cloud backup only when that backup is end-to-end encrypted. We store a hash of the device identifier, a hash of the token, an account number and the account's start and end dates.
• Access code accounts. When you redeem an access code, we link the device to the account behind that code. If you bind an email address for recovery, we store it and send one-time sign-in links to it.
• Server logs. Our web server records the IP address, time, requested path, referrer and User-Agent (for the apps: app version and OS version) of each request to our website and API. We use these logs to keep the service running and to investigate abuse.
• Support chat logs. The chat button on each page loads from our own server at chat.oqos.io, and that server's logs record the IP address of each request to it. These logs are capped by size, not by a fixed period.
• Rate limiting. To stop repeated free-access requests, we keep your IP address for up to 24 hours.
• Subscription and payment records. Your plan, its start and expiry dates, and a record that a payment succeeded (amount, currency, provider transaction reference). Card and banking details are entered on the payment provider's own hosted page and are never seen or stored by us.
• Support correspondence. If you email support@oqos.io, we keep the thread to answer you and for our records.

Your VPN traffic goes from your device to the VPN server and never passes through our API, database or web servers. Our systems hold no record of the websites or services you connect to, your DNS queries, or the contents of your traffic.

The OQOS apps contain no third-party advertising or analytics SDKs. We do not use Google Analytics, Firebase Analytics, advertising identifiers, or cross-site trackers. The apps use Firebase only to fetch remote configuration values (such as which server list to show); this feature does not profile you.

App mode (Android). If you choose to route only some apps through the VPN, the app reads the list of installed apps to show it to you. This list stays on your device and is not sent to us.

• Google Firebase Remote Config (Google Ireland Ltd / Google LLC, as our processor). At each launch the app fetches settings. Firebase receives a Firebase installation ID, your country and language settings, time zone, the operating system version, the app version and app identifier (bundle ID or package name), and your IP address. Firebase keeps installation IDs until we delete them, and then up to 180 days in backups. We do not use Firebase Analytics, Crashlytics, or advertising features. The Android app also keeps a connection open to Firebase while it runs, so that settings updates arrive without a restart.
• GitHub. The iOS app downloads public routing data files from github.com. GitHub sees your IP address and the request, as with any download.
• Connectivity check. After you connect, the iOS app opens a few public pages (Apple, Microsoft, Cloudflare, Google, Wikipedia) through the VPN to confirm the connection works. These sites see the VPN server's address, not yours.
• Google Play (Android). The Android app asks Google Play whether an update is available, using Google Play's in-app update service. It also uses Google Block Store, described in section 02.

We process the data above to perform our contract with you — creating your account, delivering the VPN service, and processing renewals (Art. 6(1)(b) UK/EU GDPR). We rely on our legitimate interests (Art. 6(1)(f)) to prevent fraud and abuse of the service and to keep it secure. Where you enable optional notifications, we act on your consent (Art. 6(1)(a)), which you can withdraw at any time in your device settings.

We do not sell your personal data. We share it only with the processors needed to run the service:

• Payment provider — to take payment and confirm your subscription. They receive the transaction data you enter on their page; we receive only confirmation and a reference.
• Email delivery and support — Forward Email (mail hosting) and Telegram (the tool our team uses to read and answer support email), to send your sign-in links and replies to support requests. In the Android app, the support buttons open our Telegram bot (@oqos_support) and pass your device identifier to it, so that we can find your account. This happens only when you tap such a button. Telegram then processes your Telegram account data under its own policy.
• Google Firebase — remote configuration, as described above.
• Infrastructure and VPN servers — our API and database run on servers we operate in Finland (EU, Hetzner). VPN servers are rented from hosting providers in the EU, the UK, the US, Canada, Turkey and Brazil, and are managed through the server management panel of an infrastructure partner. The panel holds your VPN account (an ID and expiry date).

We may disclose data where we are legally required to, but we cannot produce records of the sites you visit: our systems do not hold them.

• Times at which the app fetched its configuration, with the device identifier: the latest one is kept with the device record; earlier ones stay in an event log capped by number of entries, not by time.
• IP-based rate-limit records: 24 hours.
• Account and device records: while the account exists. After deletion we keep the device record without contact details, marked as deleted, and a one-way hash of the device identifier, so the same device does not get a second free access period.
• Database backups: rolling copies covering about the last 7 days, plus one earlier copy from 20 July 2026.
• Payment records: as required by tax law.
• Support threads: up to 24 months.

Under the UK and EU GDPR you can request access to your data, correction of inaccurate data, deletion, restriction or objection to processing, and portability. To make a request, email support@oqos.io with the prefix [GDPR]. You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO).

To delete your account in the iOS app, tap the profile icon on the main screen, then Delete profile. In the Android app, tap the account icon on the main screen, then Delete account. Either way this revokes VPN access at once, removes your VPN account from the server panel, and erases the email and settings on your account. Accounts activated with a code are deleted on request to support@oqos.io. Deleted data leaves our backups within 3 months.

OQOS is not directed at children and is intended for users aged 18 and over. We do not knowingly collect data from children.

If we change this policy we will update the effective date above and, for material changes, notify you in the app or by email. Continued use of the service after a change means you accept the updated policy.