Exir VPN Privacy Policy

01 · Scope

Who we are and what this notice covers

Exir VPN is an Android VPN application with package name com.exir.vpn. Ebadi GmbH is responsible for the processing described in this notice. This policy covers the Exir VPN app, its supporting APIs and this privacy-policy website.

This page does not intentionally load advertising, analytics, cookies or third-party fonts. Our hosting infrastructure still processes basic request information, such as IP address, user agent, requested URL and timestamp, to deliver and secure the page.

02 · Core service

How Exir VPN uses Android VPNService

Android’s VpnService is essential to Exir VPN’s core purpose. When you connect, the app creates a system-managed VPN interface and sends selected device traffic through the VPN route you choose or the app selects.

The on-device VPN engine may inspect protocol and destination metadata locally to apply DNS, routing, per-app, fragmentation or connection rules selected in the app. Based on the current app design, locally selected application package names are stored on the device and are not uploaded as a list of installed apps.

Exir VPN does not redirect or manipulate traffic from other apps for advertising monetization, and it does not use the content of your VPN traffic to select personalized advertisements. VPN traffic must be processed in transit by the selected endpoint in order to provide the connection. Limited infrastructure metadata may also be processed to maintain reliability, investigate abuse and protect the service.

03 · Data

Data we process

The categories below describe data processed by Exir VPN and the service providers integrated into the app. What applies can vary by app version, region, device settings, consent choices and the feature you use.

04 · Accounts and local data

Optional Exir ID accounts and device usage totals

The core VPN service can be used without creating an account. If you choose the optional Exir ID feature in a supported app version, the service generates an account ID and a recovery code. Account registration does not ask for your name, email address, telephone number or a Google sign-in. This describes the account registration fields, not all data processed by the app, support services or advertising SDKs.

The account service stores the Exir ID, a one-way hash of the recovery credential and account creation and update timestamps. It also stores hashed session credentials to authenticate signed-in requests. Server sessions have a 30-day expiry and the account service allows up to five active sessions. The app stores its local access token encrypted using Android Keystore-backed storage. The recovery code is shown when the account is created; keep it privately if you want to sign in again. We do not use Firebase Authentication for this account feature.

Clearing the app’s data or uninstalling it removes locally stored account credentials and usage totals, but does not itself delete a server-side account, support ticket, service record or data held by Google services. Signing out removes the local sign-in state and requests revocation of the current session; it does not delete the account.

To request deletion of an account and associated data, use our account and data deletion page. You can make a request without reinstalling the app. Do not send us your recovery code, access token or VPN configuration secrets.

05 · Purpose

Why we process data and our legal bases

We use data only for defined purposes connected to operating, securing and improving Exir VPN, supporting users, complying with law and funding the free service through advertising.

For users in the EEA, United Kingdom and similar jurisdictions, the applicable basis can be performance of a contract, legitimate interests, consent or compliance with legal obligations. You may object to processing based on legitimate interests; we will assess the request against any compelling or legally required reasons to continue.

06 · Advertising

Advertising, consent and your choices

Exir VPN is supported by advertising and uses Google Mobile Ads (AdMob). Google and its advertising partners may process advertising identifiers, IP address, approximate location, device information, consent signals and ad interactions to deliver, limit, secure and measure ads.

Depending on your region and choices, ads may be personalized or non-personalized. Where required, Exir VPN uses Google’s User Messaging Platform to present consent choices. When available, you can review or change these choices from Settings → Privacy choices in the app. You can also manage advertising settings at Google My Ad Center and reset or delete the advertising ID through Android settings.

We do not sell VPN traffic content for money. Under some US state laws, personalized advertising may be considered “sharing” or “targeted advertising.” Where applicable, the in-app privacy controls are provided to opt out.

07 · Recipients

Service providers and data recipients

We disclose data only as needed for the purposes described above, under contractual, technical or legal safeguards where applicable.

Libraries that perform functions locally in the app are not automatically data recipients. The presence of a software library does not by itself mean that it receives personal data.

08 · Lifecycle

Retention and deletion

Retention varies by record type, deployed settings and operational needs. The expiry and deletion controls below apply; some records have no automatic expiry and are handled through manual deletion requests.

The optional Exir ID account and core VPN installation are distinct. To request account deletion, or deletion of identifiable support or diagnostic information, follow our account and data deletion instructions or email contact@exirvpn.com. Provide only the minimum identifiers needed to locate the records. We may need to verify ownership, and we may be unable to locate records that are no longer identifiable. Limited data may be retained where a legal or security exception applies; we will explain relevant exceptions when handling the request. A request can also cover identifiable associated data processed on our behalf by service providers, where applicable. Separately processed or no-longer-linkable records may require additional identifiers or provider privacy controls. An Exir ID deletion request does not automatically erase data processed independently by Google advertising or Firebase services.

09 · Control

Your privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection or portability; withdraw consent; and complain to a data-protection authority. Exercising a right does not affect processing that was lawful before the request.

For privacy requests, contact us using the address below. We generally respond within the period required by applicable law. We will not discriminate against you for exercising a privacy right.

10 · Global service

International data transfers

Exir VPN operates internationally. Data may be processed in countries other than the one where you live, including where our infrastructure and service providers operate. Where required, we use recognized safeguards such as adequacy decisions, contractual protections and access controls.

11 · Protection

How we protect information

We use measures designed to reduce unauthorized access, alteration, disclosure and loss. These include HTTPS for first-party APIs, encryption between the device and VPN endpoint, access controls, restricted production access, encrypted Android storage for selected local secrets and monitoring for abuse.

No system, transmission method or VPN can be guaranteed completely secure. Please keep Android and Exir VPN updated, protect access to your device and avoid sending sensitive information in free-text support messages unless necessary.

12 · Age

Children’s privacy

Exir VPN is a general-audience utility and is not designed or marketed as a child-directed service. We do not knowingly request personal information from children under 13 or a higher minimum age required by local law. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

13 · Updates

Changes to this policy

We may update this notice when the app, providers, legal requirements or data practices change. The “Last updated” date and policy version at the top show when substantive text was revised. Where required, we will provide an additional notice or request consent before a materially different use begins.

The policy version index lists the current notice and previous notices. Historical pages are marked “Archived · older version” and link back to this current policy. We recommend reviewing this page after major app updates. Continued use alone is not treated as consent where the law requires a separate affirmative choice.