Privacy policy
Who we are
Hostacks VPN is made and run by Hostacks Ltd (company number 14706886), Unit 9, 7 Skyport Drive, Harmondsworth, West Drayton, UB7 0LB, United Kingdom ("Hostacks", "we"). We are the controller of the personal data described here. Contact: contact@hostacks.com.
What we do not collect
- The websites and apps you use, or their addresses.
- Your DNS queries (our DNS resolver runs with query logging off).
- The content of your traffic.
- When you connect or disconnect, how long you stay, or how much data you use, linked to you.
- Your name, email, phone number or payment details. There is no account.
What our servers handle while you are connected
To route your traffic, the server you connect to keeps your device's VPN public key and the private address it gave you, in memory only. It is never written to disk and is removed when you disconnect, after a short idle period, or when the server restarts. To count how many different devices use the service each day, the server also keeps a short fingerprint of each connected device's VPN key, in memory only, until the end of the day (UTC); only the daily total leaves the server. To stop abuse, while a new connection starts the server also keeps a scrambled fingerprint (a keyed hash) of the connecting address, in memory only, for a few minutes, to limit how many new connections one address can open at once; it is never written to disk or sent anywhere. When the app connects, the server also counts, without keeping who: the app version, the app's language, the country of the connecting address (looked up and dropped, using DB-IP's free country table) and whether this is the install's first connection. To count devices across servers and over weeks without a device list, each server also sends an anonymous count summary (a HyperLogLog sketch built from a keyed hash of the device fingerprint) that cannot be turned back into devices. Our servers keep their system journal in memory only, and it holds no user identifiers. Your device's public IP address is used to carry the connection and is not recorded.
What the app can send (optional)
- Crash reports: what went wrong in the app, the device model and the Android version. No IP address and no identity are stored. This uses Sentry (EU region).
- Anonymous usage: counts such as "connected" or "settings opened", with a random install ID that is not linked to you. No IP address is stored. This uses PostHog (EU region).
You choose both on the "Your privacy" screen when you first open the app, and you can change them at any time in Settings. We keep this data for at most 90 days. Our legal basis is your consent for usage data and our legitimate interest in a working app for crash reports, which you can object to by switching them off.
Feedback you send
If you use “Tell us” in the app, we receive the reason you pick, anything you choose to write, and the app version, the app language, your connection setting, the server and how the connection failed. Nothing identifies you: no account, no device ID, and your address is used only to limit how often feedback can be sent, never stored. Please do not write personal details. We keep feedback for 180 days.
The app's configuration service
The app downloads a signed list of our servers. The service sees the IP address of that request to answer it, and does not store it.
Sharing
We do not sell your data and do not share it with anyone for their own purposes. There is no advertising in the app. The two diagnostics providers above process data only for us.
Children
Hostacks VPN is not directed at children under 18.
Your rights
You can ask us to access or delete data or object to its use by writing to contact@hostacks.com. Because we do not keep activity data or accounts, there is usually nothing linked to you to return. You can also complain to your data protection authority.
Changes
If this policy changes we will update the date above, and tell you in the app if the change is significant.