Privacy policy

Who processes your data

• Operator: Sparrow Tech, Inc.
• Address: 1111B S Governors Ave, Dover, DE 19904-6903
• Country: United States

Privacy questions: privacy@kapavpn.com.

Data processed by the Kapa service

• Installation identifier. The app creates a random identifier at installation; it is not an IMEI or advertising ID. The server stores its hash to enforce the device limit and the one-time free allowance.
• Device name, if the app sends one, for your account's device list.
• Account and sessions. A random account identifier, plan, access expiry, device limit and sign-in times. Session tokens are stored only as hashes.
• Email, only if you link one: for sign-in, recovery and account deletion. Verification codes are stored as HMACs and are valid for 10 minutes.
• IP address of requests to the Kapa API is used for rate limiting. A keyed hash of the address (for IPv6, of its /64 network) is kept for the rate-limit window, about an hour. The app may show you this address; the Kapa service does not write IP addresses to its request log.
• Traffic volume. The service receives only your account's total traffic from the VPN infrastructure to apply the free allowance. Visited site addresses are not sent to the Kapa database.
• Purchases. Plan, amount, currency, payment method (SBP or card), status, Platega transaction identifier and time. You enter card or SBP details on the Platega page; Kapa does not receive them. Google Play purchases are processed by Google and RevenueCat; Kapa receives from RevenueCat only the account identifier, product, status and subscription expiry, not payment details.

VPN connection

Traffic of apps you route through the VPN passes through a VPN server. The connection between your device and the server is encrypted; it does not replace encryption between the server and a website. To route traffic, the server technically processes your connection IP address, destination addresses and ports, and connection times.

VPN servers may keep technical connection metadata (for example connection IP address, time, volume and hashes of destination addresses) to prevent abuse. You can request details of these fields and retention periods at privacy@kapavpn.com.

Connection checks

To confirm the tunnel works, the app sends service requests to connectivity check addresses (for example Google, Cloudflare and the Kapa check server). These requests contain no account identifiers; recipients see the IP address the request comes from.

What stays on your device

Personal VLESS profiles (encrypted), subscriptions and the list of apps excluded from the VPN are stored on your device and not sent to the Kapa API. Connections through a personal profile are provided by the operator of its server. The app shows no ads. To learn which ads lead to installs it contains the Tenjin attribution SDK (see Recipients).

Recipients

• Resend — delivery of code emails (email address and message).
• Platega — payment processing (account, order and plan identifiers, amount; your email if linked).
• The VPN infrastructure that runs Kapa servers — a technical account identifier, plan, expiry and limits, and your traffic while connected.
• Google Play and RevenueCat — Google Play purchases (Kapa account identifier, product, status and subscription expiry).
• Tenjin — attribution of installs to ad campaigns, sent by the app itself: Google advertising ID or App Set ID, install details from Google Play (Install Referrer), device model, Android version, language and IP address. No Kapa account identifier or email is sent. You can reset or delete the advertising ID in Android settings.
• The API hosting provider and request delivery network — technically process IP addresses to deliver requests.

Retention

• Sign-in sessions last up to 90 days; revoked and expired records are deleted automatically.
• One-time codes are valid for 10 minutes and deleted after use or expiry.
• Rate-limit keys are deleted after about an hour (about a day for the installation identifier).
• Records of a granted free allowance (keyed hashes of the installation id and email) are kept indefinitely so the allowance is not granted again.
• Your account is kept until you delete it. Deletion removes your email immediately, revokes sessions and closes VPN access; a technical account identifier without email is kept so that deleted access cannot be restored.
• Payment records are kept after account deletion for payment reconciliation and financial obligations.
• Database backups are kept for up to 7 days and then deleted.

Account deletion and your rights

You can delete your account in the app (account section) or on the account deletion page if an email is linked. If no email is linked and the app is already uninstalled, contact support: support@kapavpn.com. For access to or correction of your data, write to privacy@kapavpn.com.

We never ask you to send tokens, verification codes, VLESS keys or card details.