Privacy Policy

Controller: FinDech UAB, company code 307632436
Registered office: Architektų g. 56-101, Vilnius, LT-04111, Lithuania
Effective date / last updated: 2026-08-27

This Privacy Policy explains how FinDech UAB (FinDech, EVPN, we, us) processes information when you use evpn.com, the EVPN iOS application and VPN service, and any other EVPN client later released through the Download page (together, the Service).

The website, VPN control plane, VPN gateways, application features and commercial-placement system process different data. We describe them separately below so that a website request is not confused with VPN traffic or an aggregate promotion count.

1. The short version

  • You do not need an account, name, email address or payment method to connect with the current iOS application.
  • EVPN creates a random, pseudonymous installation record and short-lived tunnel records needed to authenticate and operate the VPN.
  • EVPN VPN gateways are designed not to log browsing history, DNS queries, destination IP addresses or packet contents.
  • Optional approximate location is used on the iOS device to help draw map routes. The EVPN application does not send that coordinate to EVPN’s servers or store it.
  • EVPN does not include third-party advertising, analytics or mobile-attribution SDKs.
  • Commercial placements are first-party, clearly labelled and are not selected or measured using VPN traffic.
  • We do not sell personal data or VPN traffic data.

An account-free installation is not the same as collecting no data. The random installation identifier and related service records may be personal data under applicable law even though they do not contain your civil identity.

2. Information processed on the website

2.1 Requests and security

When your browser requests a page, ordinary internet infrastructure processes technical data such as your source IP address, user agent, requested URL, date and time, response status and security signals. Website hosting, delivery and security providers may process or retain some of this data under their configured security and diagnostic logs.

EVPN does not use this request data to create an advertising profile or connect website browsing to a VPN installation.

2.2 Contact and support

If you submit a contact form or email us, we process the information you provide, which may include:

  • Your name and email address
  • The subject and contents of your message
  • Attachments or diagnostic details you choose to include
  • Our correspondence and actions taken in response

We use this information to answer the request, provide support, investigate a report and maintain an appropriate record of the communication. Please do not send private keys, passwords or unnecessary sensitive information.

The contact form uses a short-lived, salted hash derived from the source IP address to limit abuse. The hash is held for approximately 10 minutes; the EVPN application does not store the raw IP address for that rate-limit record.

2.3 Cookies and analytics

EVPN’s current website code does not set analytics, advertising or cross-site tracking cookies and does not load third-party behavioural-analytics or advertising pixels. See the Cookie Policy for the current position and information about external links.

3. Information processed by the VPN service

3.1 Installation and authentication data

On first registration, the iOS application sends:

  • Platform (iOS)
  • Application version
  • Application locale
  • A public device-signing key generated on the device

EVPN returns a random installation identifier. The control plane stores that identifier, the fields above, creation and last-seen times, credential status and limited credential-rotation metadata. The associated private signing key stays in the device keychain and is not sent to EVPN.

We use this data to recognise a valid installation without an account, authenticate signed service requests, rotate or revoke credentials, maintain compatibility and protect the Service from replay and abuse.

3.2 Tunnel allocation data

To establish and operate a tunnel, the client sends or the control plane creates a short-lived allocation record containing:

  • The installation identifier
  • A WireGuard public key generated on the device
  • The selected EVPN location identifier, or an instruction to choose automatically
  • Any supported latency hints used to choose a healthy location
  • The assigned gateway, exit, protocol and internal tunnel address
  • Allocation status and creation, expiry and release times

The current iOS client requests an allocation lasting one hour. Finished allocation records are normally removed within 48 hours of creation after infrastructure cleanup has completed. A record may remain longer when cleanup is unresolved, a security incident is being investigated, a legal hold applies or law requires retention.

Short-lived security records are also used to reject replayed or duplicate requests. Request-nonce records are kept only for the short signature-validity window; idempotency records are removed after approximately 24 hours.

3.3 Information the VPN data plane is designed not to log

EVPN does not intentionally record or retain on its VPN gateways or in a tunnel allocation:

  • DNS queries or responses attributable to an installation
  • Domains or websites visited
  • Destination IP addresses or ports
  • Packet contents
  • Browsing history
  • Per-installation traffic or bandwidth history
  • The source public IP address linked to an installation or allocation
  • Promotion or campaign identifiers linked to an installation or allocation

Network equipment must process live packet headers and payloads in memory to route a tunnel. Internet, hosting, data-centre and anti-abuse providers may also transiently observe ordinary connection metadata. The statement above describes EVPN’s application records and logging configuration; it does not mean that data is never technically handled while a live connection is routed.

DNS sent through an EVPN tunnel is resolved by the configured EVPN gateway resolver. Query and reply logging is disabled. Public resolvers can still be used outside the tunnel if your device, another application or a network condition bypasses the VPN.

3.4 Operational and security data

EVPN processes aggregate infrastructure metrics such as gateway health, CPU and memory use, active tunnel counts, aggregate throughput, packet loss and service errors. These metrics are used for capacity, reliability and security and are not intended to identify what an individual installation does online.

Application logs are designed to redact IP addresses and cryptographic material. VPN gateways use volatile, size-limited system logs for operation and debugging; those logs are not intended to contain browsing or DNS activity.

EVPN has not completed an independent no-logs audit as of the date above. We will not describe the Service as independently audited unless and until a completed engagement supports that claim.

3.5 Public connection checks

After a tunnel handshake, the current iOS application may make a small HTTPS request through the tunnel to a public Cloudflare (1.1.1.1) endpoint and, if needed, a Quad9 (9.9.9.9) endpoint to confirm that internet traffic can pass. The request does not include the EVPN installation identifier. Those providers receive the shared EVPN egress IP and the technical data ordinarily involved in an HTTPS connection and process it under their own privacy terms.

4. Information used only on your device

The iOS application keeps limited state in the app’s local or shared container, including the random installation identifier, selected EVPN location, active allocation identifier, privacy-disclosure version and appearance preference.

Device-signing and WireGuard private keys are stored in the iOS keychain with this-device-only protection and are not included in device backups. The iOS VPN configuration contains the non-secret details needed by Apple’s Network Extension framework, such as gateway, DNS, route and allocation information; private tunnel keys remain in the keychain.

You can rotate the device credential in EVPN settings. You can disable or remove the EVPN VPN configuration in iOS settings. Clearing application data or uninstalling the application affects on-device state according to Apple’s operating-system behaviour; some keychain items can persist until removed or replaced by the application or operating system.

5. Optional location and map data

The iOS application may ask for when-in-use location permission. Permission is optional and denial does not prevent VPN use.

If granted, the application requests reduced-accuracy, approximate location once to position you on the network map and draw a visual route to the selected EVPN location. The EVPN application:

  • Does not request background location
  • Does not store the coordinate
  • Does not write it to application logs or shared storage
  • Does not send it to EVPN’s API or promotion system
  • Does not use it to choose a VPN exit or commercial placement

Location and map features use Apple system services and MapKit. Apple’s processing of data needed to provide those services is governed by Apple’s privacy policy.

6. Commercial placements

EVPN is funded in part by commercial placements on EVPN-owned surfaces. They are visibly labelled Sponsored, Affiliate, Partner offer or From FinDech.

6.1 Placement selection

A placement request may use only:

  • Placement slot
  • Platform
  • Application version
  • Application locale
  • The EVPN destination country selected in EVPN’s own interface
  • Campaign schedule and eligibility rules for that date

The selected EVPN destination country is used transiently for that response and is not written to the promotion event record. Placement requests do not contain the installation identifier, source IP as an application field, advertising identifier or a device fingerprint. Placements are not selected using browsing history, DNS queries, destination addresses, packet contents or tunnel activity.

6.2 First-party measurement

When a placement remains viewable for the required interval, EVPN may record an impression with the campaign, event type, slot, platform, date and a randomly generated de-duplication value. The raw event stores only a peppered digest of that de-duplication value and is deleted within 24 hours. Daily counts by campaign, slot and platform may be retained for business reporting because they do not contain an installation, account, tunnel or traffic identifier.

A click opens an EVPN first-party redirect URL containing a random token that normally expires after one hour. The external destination receives only static campaign-level affiliate parameters, not a per-user, per-device, per-installation, per-session or per-tunnel value. Aggregate partner reports, if received, are kept at campaign, offer and day level.

6.3 External sites

When you follow a commercial placement or another external link, you leave EVPN. The destination site’s operator may receive normal browser request data, including the shared EVPN egress address if the VPN is connected, and may use its own cookies or tracking under its own privacy policy. EVPN does not control that independent processing.

EVPN does not sell, rent or disclose VPN traffic data to commercial partners. Partners receive campaign-level performance information, not browsing data or an installation-level record.

7. Why we process information

Where the EU General Data Protection Regulation or similar law applies, our legal bases are:

  • Performance of a contract or steps at your request: registering an installation, authenticating requests, allocating and releasing tunnels, providing support connected with the Service and delivering requested features.
  • Legitimate interests: securing the Service, preventing replay and abuse, maintaining shared infrastructure, diagnosing faults, answering general enquiries and measuring aggregate commercial-placement performance so the free Service can operate. We limit these activities to reduce their privacy impact.
  • Legal obligation: keeping or disclosing information when applicable law validly requires it.
  • Consent: where we specifically ask for consent and the law requires it. iOS location permission is controlled through Apple’s system interface; EVPN does not receive the resulting coordinate.

EVPN does not use the information described in this policy to make a decision that produces legal or similarly significant effects about you.

8. Sharing and service providers

We disclose information only as needed to operate the Service, follow your direction, protect rights and infrastructure, or comply with law. Current provider categories include:

  • Website, edge and application hosting, including Vercel
  • Database and control-plane infrastructure, including Supabase
  • Short-lived website rate limiting, including Upstash
  • Contact-form email delivery, including Resend
  • Data-centre, hosting, transit and VPN infrastructure providers
  • Apple services used to distribute and operate the iOS application

These providers process data for the service they supply and are subject to contracts or their own applicable terms. Apple map and location services, public reachability providers, telecommunications providers, and sites you choose to visit may act as independent controllers for their own processing.

We may also disclose limited information:

  • To professional advisers under confidentiality duties
  • In connection with a merger, financing, reorganisation or transfer of the EVPN business, subject to applicable safeguards
  • When reasonably necessary to protect users, FinDech, infrastructure providers or third parties from serious harm, fraud or abuse
  • In response to valid legal process or an enforceable legal obligation

Because EVPN does not retain the VPN activity listed in section 3.3, we cannot disclose records we do not have.

9. International transfers

FinDech UAB is established in Lithuania. Some providers or their support personnel may process information outside Lithuania or the European Economic Area. Where required, we use an adequacy decision, standard contractual clauses or another lawful transfer safeguard. You may contact us for information about the safeguard relevant to your data.

10. Retention

We keep information only for the purpose and period described below, subject to a legal hold, unresolved security or infrastructure cleanup, or a longer period required by law:

  • Contact and support correspondence: while we handle the request and afterwards only as reasonably necessary for follow-up, security, dispute or legal records.
  • Contact-form rate-limit hash: approximately 10 minutes.
  • Installation record and active public credentials: while the installation remains active or until deletion or revocation is completed; limited credential history may be retained to prevent replay, investigate abuse or establish past security actions.
  • Tunnel allocation: current iOS allocations expire after one hour; finished records are normally removed within 48 hours of creation after cleanup completes.
  • Request-security records: nonce records for the short signature-validity window and idempotency records for approximately 24 hours.
  • Raw promotion event: no more than 24 hours.
  • Promotion redirect token: normally one hour.
  • Aggregate operational and campaign counts: may be retained for service planning, security and business records because they are not designed to identify an installation or its internet activity.

Hosting and infrastructure providers may maintain their own security, backup and diagnostic retention periods. We periodically review the provider settings and minimise them where practical.

11. Your choices and rights

You can:

  • Decline or withdraw iOS location permission in system settings without losing VPN access
  • Choose not to open a commercial placement
  • Remove the EVPN VPN configuration or stop using the application
  • Contact us to exercise applicable data-protection rights

Depending on where you live, you may have rights to access, correct, erase or receive a copy of personal data; restrict or object to processing; withdraw consent; and complain to a supervisory authority. These rights can be subject to legal exceptions.

Because EVPN does not require an account, we may be unable to connect an email address or civil identity to a pseudonymous installation. We may ask for the installation reference displayed in EVPN settings and other limited information needed to find the correct record. We will not collect extra identity documents where we cannot reasonably verify or fulfil the request with less data.

Send privacy requests to legal@findech.com. We may ask you to confirm the request through the relevant installation or contact channel to protect against deletion or disclosure to the wrong person.

If you are in the EEA, you may complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or the supervisory authority where you live or work.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect a child’s personal data for an account. If you believe a child has provided personal data through support or another feature, contact legal@findech.com so we can review and delete it where appropriate.

13. Security

We use measures intended to protect the limited information we process, including device-generated credentials, keychain storage, signed and replay-resistant control-plane requests, separation of promotion and tunnel records, redacted application logs and minimised gateway logging.

No system is perfectly secure. To report a suspected vulnerability or security incident, contact info@evpn.com and avoid including live exploit data or personal information beyond what is necessary.

14. Changes to this policy

We may update this policy when the Service, providers, law or data practices change. We will publish the new version and date here. If a change materially affects how we use personal data, we will provide additional notice in the application or on the website where reasonably possible or legally required.

15. Contact