Privacy Policy

Effective date: 2026-04-26 Last updated: 2026-04-26

TL;DR

Gena VPN encrypts your traffic and routes it through our servers. We need a tiny bit of data to run the service: your email and password to log you in, a receipt from Apple or Google to confirm you paid, and short-lived metadata about your connections (volume of data, when you connected) for billing and abuse prevention. We do not keep logs of the websites you visit, the apps you use, or the contents of your traffic. Read on for the details.

1. Who we are

Gena VPN ("Gena VPN", "we", "us", "our") is operated by Samvel Vardanyan, a sole proprietor based in the Republic of Armenia. We are the data controller for the personal data described below.

You can reach us at genavpndev@gmail.com.

2. Scope

This Privacy Policy applies to the Gena VPN mobile applications for iOS and Android, our backend service, and the VPN servers we operate. It does not apply to third-party websites, apps, or services that you may access through the VPN.

3. What we collect

3.1 Account data

Email address — to identify your account and contact you about the service.
Hashed password — we store passwords using a one-way hash, not in cleartext.
Internal user ID (UUID) — generated when you sign up, used to link your account to your subscription and devices.

3.2 Subscription data

In-app purchase receipt or token from Apple or Google.
Transaction ID and product ID of the subscription you bought.
Subscription expiration date as reported by Apple or Google.

3.3 Connection metadata (server-side)

When you connect to a VPN server, the server temporarily processes:

Your source IP address while the connection is open — this is required to route traffic back to you. We do not store it after the session ends, except in aggregate counters described below.
Aggregated bandwidth counters (total bytes sent/received per session) — used for fair-use enforcement and to detect abuse patterns.
Connection start and end timestamps — used to calculate concurrent-session limits and to investigate operational issues.

3.4 Device metadata

App version, OS version, device model, and language — sent with API requests so we can support your device and diagnose bugs.

3.5 What we do NOT collect

We do not log:

Websites you visit, domains you resolve, or DNS queries you make.
The contents of your traffic.
Apps you have installed or how you use them.
Your contacts, photos, microphone, camera, location, calendar, or health data.
Advertising identifiers (IDFA, GAID).

We do not sell your data. We do not run advertising in the app.

4. How we use your data

Purpose	Data used	Lawful basis (GDPR, where applicable)
Create and authenticate your account	email, hashed password, UUID	Performance of contract
Activate and verify your subscription	IAP receipt, product ID, expiration	Performance of contract
Route VPN traffic	Source IP (in memory only)	Performance of contract
Prevent abuse, enforce fair use	Aggregated bandwidth and timestamps	Legitimate interest
Customer support	Email, account ID, device metadata	Legitimate interest
Comply with legal obligations	Any of the above, when required	Legal obligation

5. Sharing with third parties

We share data only as follows:

Apple processes your in-app purchase. We never see your payment instrument. Apple's privacy practices are described in Apple's Privacy Policy.
Google processes Play Billing transactions on Android. See Google Privacy Policy.
DigitalOcean hosts our backend. They process the data only to provide infrastructure and do not have access to your traffic content.
Voiden is the upstream VPN provider that operates a portion of the network we route through. They receive aggregated traffic; they do not receive your account email or your identity.
Law enforcement and courts — if compelled by a valid legal process under Armenian law or a treaty Armenia is party to. We will challenge overbroad requests where reasonable.

We do not sell, rent, or trade your personal data.

6. International transfers

Our backend is hosted in Europe. VPN servers are located in several jurisdictions. By using the service you understand that your data may be processed outside the country where you reside. Where required, we use appropriate safeguards (e.g. standard contractual clauses) for international transfers of personal data.

7. How long we keep data

Data	Retention
Account data (email, hashed password, UUID)	Until you delete your account
Subscription records	Until you delete your account, plus up to 7 years for tax / accounting where required by law
Connection metadata (aggregated bandwidth, timestamps)	Up to 30 days
Source IP during a session	Only while the session is open
Support correspondence	Up to 2 years after last contact

8. Your rights

Depending on where you live, you may have the following rights:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate data.
Deletion — ask us to delete your account and associated data, subject to obligations we cannot waive (e.g. tax records).
Export — receive your data in a machine-readable JSON format.
Object / restrict — ask us to stop using your data for legitimate-interest purposes.
Withdraw consent — where we rely on consent.

To exercise any of these rights, write to genavpndev@gmail.com from the email address on the account, or via the app's "Delete account" flow when available. We respond within 30 days.

If you are in the EEA, UK, or Switzerland and believe we have not handled your data lawfully, you can lodge a complaint with your local supervisory authority. If you are in Armenia, you may contact the Personal Data Protection Agency of the Republic of Armenia.

9. Children

Gena VPN is not intended for, and we do not knowingly collect data from, children under 13. If you believe a child has provided us with personal data, contact genavpndev@gmail.com and we will delete it.

10. Security

We use TLS for all client-server traffic, store passwords as one-way hashes, and limit internal access to data on a need-to-know basis. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

If a breach affects your data and is likely to result in a high risk to your rights, we will notify you and the relevant authorities as required by law.

11. Payments are handled by Apple and Google

When you buy a subscription on iOS, payment is processed by Apple under Apple's privacy policy. On Android, payment is processed by Google under the Google Privacy Policy. We receive a receipt that confirms your subscription is active; we never see your card number, billing address, or other payment details.

12. Changes to this policy

We may update this Privacy Policy from time to time. If a change is material, we will notify you at least 30 days before it takes effect, by email or via an in-app notice. Continued use of Gena VPN after a change takes effect means you accept the updated policy.

13. Contact

Email: genavpndev@gmail.com
Postal: Samvel Vardanyan, Adonts street 17/2, Yerevan, Armenia

Effective date: 2026-04-26.