Privacy policy

1. About this policy

Arct Technology LLC, a Wyoming limited liability company (“Arct Technology”, “we”, “us” or “our”), operates Snap VPN, which comprises the Snap VPN apps, the Snap VPN virtual private network service, the website at www.snapvpn.net and the account portal at accounts.snapvpn.net (together, “Snap VPN”). Arct Technology LLC is the controller of the personal data processed through Snap VPN.

This Privacy policy describes the personal data we collect, the channels through which we collect it, how and why we use it, with whom we share it, how long we keep it, and the rights available to you. In this policy, “personal data” means information relating to an identified or identifiable individual. This policy should be read together with our Terms of service and our Cookie policy.

This policy does not apply to websites, services or content operated by third parties, including those you reach through Snap VPN or through links on our website. Those third parties process personal data under their own terms and privacy policies, and we are not responsible for their practices.

2. Account and device data

Snap VPN does not ask for your name, email address, telephone number or password. When you create an account, we generate a random 16-digit account number, which is the only credential for the account. We do not guarantee that a lost account number can be recovered. For card payments made on our website, we may be able to identify the account from payment details you send us.

Account data. For each account, we store a one-way reference to the account number, its last four digits, the account status, the device limit (up to five devices), the creation date, and a random identifier used to check App Store subscriptions. Each sign-in to the account portal also creates a short-lived server-side sign-in credential, stored in one-way form, that expires after 1 hour; it is separate from the portal’s sign-in cookie described in Cookies.

Device data. For each device added to an account, we store a device credential in one-way form, a public key created on the device, the device platform, a random nickname, and the times at which the device was added or removed. Messages, ratings and the app version that you submit through forms in the app are linked to the device record, as described in Support communications.

None of the data described in this section is linked to a name or an email address.

3. VPN connection data

Snap VPN is designed so that the VPN servers do not log your online activity. We do not log:

• Your DNS queries.
• The websites, services and IP addresses you visit through the VPN.
• The content of the traffic you send or receive through the VPN.
• The IP address from which you connect, on the VPN servers that carry your traffic.
• The amount of data you transfer during a session.

The VPN servers hold the information needed to maintain a connection in memory only, and only while you are connected.

Connection records. Each time you connect, we record the connection key, your private VPN address, the server location, and the times at which the connection opened and closed. We also keep aggregate server totals, such as bandwidth, which are not linked to any account, device or individual.

The app sets up each VPN connection through our web servers, which record the IP address of each request in their access logs, as described in Server access logs. While those logs are kept, they can be linked to your connection records.

4. Purchases and payments

Apple App Store. If you subscribe through Apple’s App Store, Apple processes the payment and holds your Apple ID and payment details under its own privacy policy; we do not receive them. We receive a signed receipt and a transaction identifier, which we link to your account so that one purchase covers one account. RevenueCat verifies App Store subscriptions on our behalf and receives a random identifier, not your account number.

Website purchases. For purchases made on our website through the account portal, we keep the payment method, plan, status, paid period, the related Stripe or Cryptomus identifiers, and your account number in encrypted form so that each payment is credited to the correct account. We do not store card numbers, wallet addresses, names or email addresses.

Card payments (Stripe). Card details are submitted directly to Stripe, which processes card payments; we never receive your full card number or security code. Stripe receives a one-way reference to your account, the plan and its price, but not your account number, and collects device information to prevent fraud. Through Stripe, we can see the card brand, last four digits, expiry date, country, postal code (if collected), payment history, and the IP address and approximate location from which the payment was made. Stripe processes this data under the Stripe Privacy Policy.

Crypto payments (Cryptomus). Cryptomus processes cryptocurrency payments and receives a one-way reference to your account, the plan and its price, but not your account number. Through Cryptomus, we can see the invoice, amount, currency, network, sending wallet address and transaction hash. Cryptomus processes this data under the Cryptomus Privacy Policy. Transactions recorded on a public blockchain are outside our control and cannot be altered or deleted by us.

5. Website delivery and security

This website is hosted and delivered by Cloudflare, which also protects it against attacks and abuse. For these purposes, Cloudflare processes the IP address and request information of each visitor and keeps edge logs, which are usually retained for no longer than 14 days. Cloudflare may set strictly necessary security cookies, as described in Cookies, and processes this data under the Cloudflare Privacy Policy.

Pages of this website look up the IP address from which you are browsing in order to display your connection status. This lookup is performed by our own servers and sets no cookie.

6. Cookies

This website sets one first-party cookie, “snapvpn_consent”, which records whether you selected “Allow all” or “Allow necessary” in the cookie banner. It expires after 12 months and is strictly necessary. Cloudflare may also set strictly necessary security cookies on this website, such as “__cf_bm”, to detect automated traffic.

This website currently uses only strictly necessary cookies. “Allow necessary” limits the website to those cookies; “Allow all” would additionally permit optional cookies, which we do not currently use. You may change or withdraw your choice at any time through the “Cookie settings” link in the website footer, which reopens the banner. The website analytics described in Internal analytics set no cookies and store nothing on your device, so they do not depend on your cookie choice.

The account portal sets one strictly necessary sign-in cookie, “__Host-snap_session”, which expires after 7 days, and uses no analytics. When you pay by card, the portal loads Stripe, which may set its own cookies and use data from other sites that use Stripe, for payment processing and fraud prevention.

We use no advertising cookies, no third-party analytics and no cross-site tracking, apart from Stripe’s fraud prevention at card checkout. We do not respond to Do Not Track signals. Our Cookie policy lists these cookies in detail and explains how to control them.

7. Internal analytics

We use internal analytics to improve Snap VPN and to provide the service properly. We do not use third-party analytics or advertising services.

Website analytics. This website uses a self-hosted analytics tool that sets no cookies and stores nothing on your device. It operates for every visitor, regardless of the choice made in the cookie banner. It records page views and clicks on download and checkout buttons, together with details including the page visited, referrer, browser, device type, screen size, language and approximate location. It does not store your IP address, groups visits by an identifier that changes each month, and is not linked to any Snap VPN account.

Statistics database. For each request made by the Snap VPN apps to our servers, we record the IP address, country, time, address requested, response status and app version in an internal statistics database. The database also holds copies of device, connection and in-app message records, without connection keys or private VPN addresses. We use it for security, fraud prevention, troubleshooting, counting users by country, and improving and providing the service.

The retention periods for analytics data are set out in Data retention.

8. Server access logs

Our account portal and app servers keep access logs that record, for each request, the IP address, time, address requested, response status, referrer, and browser or app type. We use these logs to operate and secure Snap VPN, prevent fraud and abuse, and diagnose faults. This includes the requests the app makes to set up VPN connections, as described in VPN connection data.

Access logs are deleted automatically, usually within 14 days. Application logs may be kept longer, until they are overwritten.

9. Support communications

If you email us, including at or , we receive your email address, the content of your message and any information you choose to include. We use this information to respond to you and keep support emails for 90 days after the matter is resolved, unless the law requires longer retention.

Messages, ratings and the app version that you submit through forms in the app are linked to the device from which you send them and are deleted together with that device record.

Please do not send us your full account number. Where we need to verify a request, we will ask for the information described in Your rights.

10. How and why we use data

We use personal data only for the purposes described in this policy. Where the EU or UK General Data Protection Regulation (“GDPR”) applies, we rely on the following legal bases:

• Performance of a contract: to create and maintain your account and devices, establish VPN connections, process purchases and subscriptions, and respond to support requests.
• Legitimate interests: to secure Snap VPN, prevent fraud and abuse, troubleshoot faults, count users by country, operate website analytics, improve the product and provide the service properly, and establish, exercise or defend legal claims, in each case where those interests are not overridden by your rights and interests.
• Legal obligation: to meet tax, accounting and other legal obligations and to respond to valid legal process.
• Consent: only for optional information you choose to give us, such as additional details in a support message. You may withdraw consent at any time, without affecting processing carried out before the withdrawal.

If a card payment is disputed, our systems automatically end the related subscription and block card payments for the account, and Stripe may decline payments following its automated fraud checks. You may ask for a person to review any such decision by contacting .

Where we rely on legitimate interests, you may object to the processing as described in Your rights.

11. Who we share data with

We disclose personal data only to the following recipients, and only to the extent necessary for the purposes described in this policy:

• Apple, which processes App Store purchases under its own privacy policy.
• RevenueCat, which verifies App Store subscriptions on our behalf and receives a random identifier, not your account number.
• Stripe and Cryptomus, which process card and cryptocurrency payments under their own privacy policies and receive a one-way reference to your account, the plan and its price, not your account number.
• Card networks and your card issuer, in connection with card payments.
• Cloudflare, which hosts, delivers and secures this website.
• Hosting, network and email service providers, which process data on our behalf under written contracts and only to the extent needed to operate Snap VPN.
• Public authorities, courts, arbitrators and our legal advisers, only as described in Legal requests.
• A successor entity, if Snap VPN is sold, merged or otherwise transferred, as described in Changes to this policy.

We do not share your account number with any third party except as described in Legal requests. We do not sell personal data, we do not share it for advertising, and Snap VPN contains no advertising.

12. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, as follows:

• Account and sign-in records: until you delete the account in the app.
• Device and connection records: until the device record is deleted at your request. These records outlast a deleted account, unlinked from it, so that the device continues to work.
• Copies of device, connection and in-app message records in the statistics database (without connection keys or private VPN addresses): replaced at each refresh, so that deleted records are removed at the next refresh.
• App Store records: until the account is deleted, or longer where tax law requires.
• Website purchase records and card data held by Stripe: kept to meet legal, tax and accounting obligations; not deleted automatically, and erased on request where the law permits.
• Server access logs: deleted automatically, usually within 14 days. Application logs may be kept longer, until overwritten.
• App request entries in the statistics database, including IP addresses: no fixed deletion period.
• Website edge logs kept by Cloudflare: usually no longer than 14 days.
• Website analytics: no fixed deletion period; not linked to any account.
• Support emails: 90 days after the matter is resolved, unless the law requires longer. In-app form messages: deleted together with the device record.
• Aggregate server totals: kept without time limit; they contain no personal data.

We may keep personal data for longer where the law requires it or where it is needed to establish, exercise or defend legal claims.

13. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a portable copy of your personal data, to object to or restrict its processing, and to withdraw consent at any time. To exercise these rights, email . We respond within the period set by applicable law, such as one month in the EU and UK or 45 days in California, which may be extended where the law permits.

Because we do not know your name or email address, we may need to verify that a request relates to your account. We may ask for the last four digits of your account number together with an App Store order ID, a card invoice number or a Cryptomus payment ID. Never send us your full account number. We may decline requests that we cannot verify or that applicable law permits us to refuse.

Deleting your account in the app removes the account, sign-in and access records. It does not delete website purchase records or data held by Stripe or Cryptomus; to request erasure of that data, contact us or the relevant processor.

If you are in the EU, the UK or Switzerland, you may lodge a complaint with your local data protection authority. Residents of Quebec may contact our privacy officer at .

14. US state privacy rights

This section supplements this policy for residents of California and other US states with comprehensive privacy laws. We collect the following categories of personal information:

• Identifiers: account and device references, IP addresses, and your email address if you write to us.
• Commercial information: purchase records and limited payment details.
• Internet or other electronic network activity: connection records, device details, server logs and website analytics.
• Geolocation data: approximate location derived from IP addresses.
• Sensitive personal information: your account number, which we use only to provide the service, do not use to infer characteristics about you, and do not disclose to third parties except as described in Legal requests.

We collect this information from you, from your device, and from Apple and our payment processors, and we use and disclose it only as described in this policy. We do not sell personal information, share it for cross-context behavioral advertising, or disclose it for third parties’ direct marketing purposes. Nevada residents may nonetheless submit an opt-out request to . We honor Global Privacy Control signals where the law recognizes them.

Subject to applicable law, you may request to know what personal information we collect and why, and to correct or delete it, as described in Your rights. An authorized agent may submit a request on your behalf with your signed permission. If we deny your request, you may appeal by emailing us with the subject line “Privacy Appeal”; if we deny the appeal, you may contact your state attorney general. We will not discriminate against you for exercising any of these rights.

15. International transfers

We are based in the United States, and personal data we collect is processed in the United States and in other countries where our service providers operate. Transfers of personal data from the EU, the UK, Switzerland and Canada rely on the Standard Contractual Clauses, together with the UK and Swiss addenda and supplementary safeguards. Apple, Stripe and Cryptomus may process data in other countries under their own privacy policies.

16. Legal requests

Except as set out below, we disclose personal data to public authorities only in response to valid legal process, such as a warrant, court order or subpoena. We can provide only records that exist; the data we do not log, as described in VPN connection data, cannot be provided. Requests for payment data held by Stripe or Cryptomus should be directed to them.

Apart from responses to valid legal process, we disclose personal data only where US law permits: to report child sexual abuse material to the National Center for Missing and Exploited Children; in an emergency involving a risk of death or serious physical injury; and, excluding your account number, to courts, arbitrators and our legal advisers to establish, exercise or defend legal claims.

17. Children

Snap VPN is intended only for adults aged 18 or older. We do not knowingly collect personal data from anyone under 18, and we will delete such data if we learn that we have collected it. A parent or guardian who believes that a child has provided us with personal data may contact to request its deletion.

18. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse and alteration, including storing credentials and account number references in one-way form. However, no method of transmission or storage is free from risk, and we cannot guarantee the security of personal data.

Your account number is the only credential for your account. Keep it confidential: anyone who has it can use your account, and we cannot guarantee that it can be recovered if it is lost.

Where the law requires, we will notify the competent supervisory authority and affected individuals of a personal data breach.

19. Changes to this policy

We may update this Privacy policy from time to time. We will post the updated policy on this page with a new “Last updated” date and announce material changes in the app, on this website and in the account portal. Because accounts have no email address, we do not send notices by email. Where the law requires your consent to a change, we will ask for it.

If Snap VPN is sold, merged or otherwise transferred, the successor will take our place under this policy. We will inform you in advance of any material change affecting personal data held at that time, and ask for your consent where the law requires.

20. Contact us

Arct Technology LLC is the controller responsible for your personal data. For privacy questions and requests, email . To report abuse, email or use the report abuse page. Our registered office address is set out in the Terms of service.