Privacy Policy

1. Introduction

Fexyn VPN (“Fexyn,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our VPN service, website, and related applications.

By using Fexyn VPN, you agree to the practices described in this policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

Account Information

• Email address (for account creation and communication)
• Display name (optional, for personalization)
• Account credentials (securely hashed, never stored in plaintext)
• Advertising click identifier — only if you arrived through one of our own paid advertisements, and only to attribute your signup to that advertising campaign (see Section 11).
• Affiliate referral identifier. Only if you arrived through an affiliate or partner referral link, and only to credit the referring affiliate if you subscribe (see Sections 8 and 11).

Payment Information

Payments are processed by Stripe. We do not store your credit card numbers, CVV, or full card details. We retain only a transaction reference and the last four digits of your card for billing history.

Device Information

• Device name (as provided by you during registration)
• Fexyn app version (so we can tell which build a problem affects)
• Connection timestamps (when a VPN session starts and ends)

Connection Metadata

• Server connected to (e.g., Frankfurt, Amsterdam)
• VPN protocol used (Fexyn Bolt, Fexyn Stealth, Fexyn Secure)
• Bandwidth consumed per session
• Whether a connection attempt succeeded or failed, and if it failed, which stage it failed at and how long it took. We use this to find protocols and servers that are being blocked.
• The country the connection came from, at country level only. We determine your country from a header our network provider adds or, when that is missing, from a location database on our own servers. We use your IP address for that lookup and do not store it with these reports. Our server logs are described under “Website and API logs”. Connection reports that include a country are not linked to your account or device, and their time is rounded to the hour. To make this work, our servers keep a temporary note of your device's country for up to one hour, and a copy can stay in the database's recovery file for a few more hours until it is overwritten.

Aggregate Bandwidth Usage

We record the total number of bytes each account uploads and downloads, aggregated per account and updated periodically. We use this for capacity planning, service quality monitoring, and to enforce the bandwidth fair use rules in our Acceptable Use Policy.

This figure is a count and nothing more. It does not include the websites you visit, your DNS queries, the content of your traffic, the IP addresses you connect to, or the timestamps of individual connections, so it cannot reveal what you did while connected. This aggregate usage data is retained for 90 days and then deleted. It is fully compatible with our commitment to keep no browsing-history, DNS-query, or traffic-content logs.

3. What We Do NOT Collect

4. How We Use Information

• Account management — To create and maintain your account, process authentication, and enable device management.
• Service provision — To allocate VPN resources, manage server connections, and enforce device limits.
• Billing — To process payments, manage subscriptions, and provide invoices.
• Abuse prevention and fair use. To detect and prevent misuse of our service, and to enforce the bandwidth fair use rules in our Acceptable Use Policy, in accordance with our Terms of Service.
• Service improvement — To understand aggregate usage patterns and improve infrastructure performance.

5. Data Retention

• Connection metadata is automatically purged after 90 days.
• Token link fetches. When an app fetches your token link, we record the IP address the request came from, to spot a link shared beyond your devices, and clear it 30 days after the fetch.
• Website and API logs. Our web server logs each request with a shortened form of the address it came from (the last part removed) and deletes these logs after 14 days. It keeps the full address for up to 48 hours, only for requests that failed or were rate-limited and for sign-in, sign-up and sign-out requests, to prevent abuse. The application behind the website keeps its own logs for 30 days, with only the shortened address in them. Our sign-in service keeps a record of each sign-in attempt, sign-up, sign-out and password change for 90 days, with the full address for the first 48 hours and the shortened form after that. While you stay signed in, it also keeps the address you signed in from with your session, for the security of your account, and deletes it when the session ends: after 30 days without use, or 90 days after you signed in at the latest.
• Account data is retained while your account is active.
• Account deletion. Deleting your account from your dashboard starts erasing your personal data from our live systems at once. A deletion request sent to us is carried out within 30 days of receiving it, or we tell you within that time why we need longer.
• Backups of our databases are kept for 35 days and then deleted, so something you deleted can remain in a backup until then.
• Record of an erasure. We keep a minimal record that the erasure was carried out, for 3 years, so we can show that we did it. It holds no name, email address, IP address or payment details.
• Billing records may be retained for up to 7 years as required by tax and financial regulations.

6. Law Enforcement Requests

Fexyn complies with valid legal process, including subpoenas, court orders, and search warrants issued by courts of competent jurisdiction.

When we receive a legal request, our process is:

• Verify validity — We review every request for legal sufficiency and narrow scope before responding.
• Notify the user — We will notify the affected user of the request unless we are legally prohibited from doing so (e.g., by a gag order).
• Limit disclosure to data actually possessed — Because we do not log browsing history, DNS queries, or traffic content, we cannot provide this information in response to any request. We can only disclose account-level data (email, subscription status, connection metadata) as described in Section 2.

For transparency about government data requests we have received, see our Warrant Canary.

7. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your data under the following legal bases:

You may object to legitimate interest processing at any time by contacting privacy@fexyn.com.

8. Third Parties

• Stripe. Payment processing. Stripe's privacy policy applies to payment data they handle.
• 0xProcessing. Cryptocurrency payment processing. When you pay with cryptocurrency, we send 0xProcessing your email address and your account identifier with the payment. 0xProcessing's privacy policy applies to that data.
• Cloudflare. Network delivery and protection for fexyn.com. Every request to the website passes through Cloudflare, which therefore sees your IP address, browser user agent and the address of the page you request. Our sign-in service (auth.fexyn.com) is not routed through Cloudflare. Cloudflare's privacy policy applies.
• Keycloak. Authentication (self-hosted on our infrastructure). No data is shared with third parties through Keycloak.
• Resend. Transactional email delivery (account notifications, password resets). Resend's privacy policy applies to email delivery data.
• Google Analytics. Website analytics, only if you accept cookies. Google Analytics then receives the pages you visit, your IP address and browser details, and sets its own cookies (see Section 11). Its requests go to Google domains including google-analytics.com, google.com and doubleclick.net. If you reject cookies or have not chosen, it is not loaded.
• Google Ads. Measuring which of our Google ads lead to signups, purchases and app downloads, only if you accept cookies. Google Ads is loaded by the same Google tag as Google Analytics, so if you reject cookies or have not chosen, neither is loaded. When you create an account on this website, buy a plan by card, download the Windows app or open our Google Play listing, the tag tells Google Ads that the action happened. After you accept, the tag also contacts Google on each page of this website you open outside your account dashboard, sending the page address and title, so Google Ads can connect a later signup or purchase to an ad click. These requests go to Google domains including google.com, googleadservices.com and doubleclick.net. For a purchase it also sends the plan price in US dollars and the Stripe subscription reference, so the same purchase is never counted twice. No report contains your name, your email address, or anything about your VPN usage. As with any request to Google, Google receives your IP address and browser details, and sets its own cookies (see Section 11). We do not use Google Ads for remarketing or personalized advertising. Google's privacy policy applies.
• Have I Been Pwned. When you run the breach check in your dashboard, your account email address is sent to Have I Been Pwned to look it up in known data breaches. Nothing is sent unless you run the check.
• Google (STUN). The WebRTC leak test and the connection diagnostics page ask Google's public STUN server for the address your browser appears from, which is how they detect a leak. Your browser makes that request directly, so Google receives your IP address. It happens only when you run one of those tools.
• YouTube. The product video on our home page is served by YouTube from youtube-nocookie.com. It starts loading when you scroll to it, so YouTube receives your IP address and browser details from that point. YouTube's privacy policy applies.
• Endorsely. Affiliate attribution. If you arrive through an affiliate or partner referral link, our page sends the referral code, the page path, our Endorsely account identifier, and any other query string parameters present on that link to Endorsely at app.endorsely.com. As with any request to an external service, Endorsely also receives your IP address and browser user agent. Endorsely returns a referral identifier which is stored in the cookie described in Section 11. Endorsely's privacy policy applies to that data. It is used only to credit the referring affiliate.

When you create an account after clicking one of our own advertisements on an advertising network other than Google, our servers report that conversion back to that network so the campaign can be measured. Google Ads measurement is described in its entry above. Where our agreement with a network pays it a share of the revenue, we also report each subsequent subscription payment, and a reversal if a payment is refunded or charged back. Each report contains the network's own click identifier, the type of event, the amount paid where that amount is in US dollars, and your country. It never contains your name, your email address, or anything about your VPN usage (see Section 11). Beyond those reports and the recipients listed above, we do not sell, rent, or share your personal data with advertisers or any other third parties. We do not engage in data brokering.

9. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit using TLS 1.2 or higher.
• Databases are encrypted at rest.
• VPN connections use state-of-the-art encryption (Fexyn Bolt: ChaCha20-Poly1305, Fexyn Stealth: TLS 1.3 Reality, Fexyn Secure: AES-256-GCM).
• Authentication credentials are protected with short-lived certificates and secure hashing.
• Infrastructure is hardened with firewalls, intrusion detection, and regular security audits.

10. Your Rights

You have the right to:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate personal data.
• Deletion: ask us to delete your account and the personal data associated with it, apart from the records described in section 5.
• Data export: ask for your data in a portable format.

To exercise any of these rights, contact us at support@fexyn.com.

11. Cookies

• Session cookies — Used for authentication and maintaining your login session. Essential for service operation.
• Preference cookies. Used to remember your language and theme preferences, and your cookie choice (cookie_consent, kept for one year).
• Affiliate referral cookies. We use two affiliate attribution mechanisms when you arrive through an affiliate or partner referral link (for example a link containing ?ref=). First, we set fexyn_ref, a first-party, same-site cookie recording which affiliate referred you and a random correlation token. Second, we use Endorsely, a third-party affiliate attribution service, which sets a separate cookie called endorsely_referral. The Endorsely cookie is configured as a cross-site cookie (SameSite=None; Secure), and the referral details listed in Section 8 are transmitted to Endorsely's servers. Endorsely sets the lifetime of its own cookie. Both cookies exist solely to credit the correct affiliate if you later subscribe. Neither is used for advertising, for behavioral profiling, or to follow you around other websites beyond attributing the affiliate who referred you. Neither contains information that identifies you personally beyond the referral source identifier, and you can clear both at any time through your browser settings.
• Advertising attribution cookie — If you arrive through one of our own paid advertisements (a link carrying the ad network's click identifier), we set a separate first-party cookie holding that identifier and basic campaign context (ad zone, country, cost, creative). If you then create an account, we store the identifier with your account and echo it back to the advertising network that showed you the ad, so it can count the signup against the campaign you arrived from. Where our agreement with that network pays it a share of the revenue, we also report each subscription payment you make, and a reversal if one of those payments is refunded or charged back. The identifier is kept only for as long as it is needed to report those outcomes: no longer than 90 days for a signup-only campaign, and where renewals are reported, for as long as your subscription can still renew plus 90 days after it ends. It is never used to profile you or follow you across other websites, and it is processed on the basis of your consent. An explicit cookie rejection limits it to your current browser session. It has no connection to your VPN usage, which remains covered by our no-logs commitment.
• Analytics cookies. Only if you accept cookies, Google Analytics sets its own cookies (named _ga and _ga_ followed by an identifier) to count visits and see which pages are used. If you reject cookies they are not set, and any left from an earlier visit are removed.
• Google Ads conversion cookies. Only if you accept cookies, the Google tag sets _gcl_au, which lets Google Ads link a signup or purchase on this site to an ad click, and, if you arrived by clicking one of our Google ads, _gcl_aw, which holds Google's identifier for that click. Both last 90 days. If you reject cookies they are not set, and any left from an earlier visit are removed. When you create an account on this website after accepting cookies, we also set gads_signup for at most 10 minutes. It holds no identifier. The first page you open outside your account dashboard reads it, has the Google tag report the signup, and deletes it.

Apart from the Google Ads conversion cookies described above, which are set only if you accept, we do not use advertising cookies. We do not use any cookie for remarketing, to build advertising or behavioral profiles, or to track you across unrelated websites.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or through a prominent notice on our website. The “Last updated” date at the top of this page indicates when the policy was last revised. Continued use of our services after changes constitutes acceptance of the updated policy.

Changes. November 6, 2026: updated how we determine the country on connection reports, and described the temporary note of your device's country.

13. Contact

If you have any questions about this Privacy Policy or our data practices, contact us at:

support@fexyn.com