Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") describes how Kuipers Libertas BV processes personal data in connection with the SecureFox virtual private network service (the "Service"), including the SecureFox mobile and desktop applications, the website at securefox.xyz, the user dashboard, the SecureFox VPN exit network, and any related APIs, content, or features (collectively, "SecureFox").

We are the data controller for the personal data described in this Policy, except where we expressly act as a processor on behalf of a third party.

Identity of the controller

Kuipers Libertas BV — a private limited liability company (besloten vennootschap) incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 12055775, with its registered address at PO Box 2162, 1200 CD Hilversum, the Netherlands. In this document, "SecureFox", "we", "us", or "our" refers to Kuipers Libertas BV, the operator of the SecureFox VPN service.

Contact for privacy matters. For any question about this Policy, to exercise a right described in Section 11, or to reach our privacy team, write to privacy@securefox.xyz. Postal mail may be sent to the registered office above marked for the attention of the Privacy Officer.

Scope. This Policy applies to data we collect through SecureFox. It does not apply to third-party websites, services, or applications you access through the Service — those are governed by their own privacy notices and are outside our control, which is precisely the point of using a VPN.

2. Plain-language summary

If you only read one section, read this one. The full Policy below adds detail and the disclosures regulators require, but the substance is here.

• We do not log the websites you visit, the IP addresses you connect to, or the DNS queries you make. The Xray-core software running on every exit node is shipped with traffic logging disabled.
• We do not record the source IP address of your authenticated VPN sessions, and we do not link any session to your account once you are connected.
• We do keep what is strictly necessary to run an account: your email address, an Argon2id password hash (we never see the plaintext), your subscription state, your device count against the plan limit, and the country derived from your sign-up IP for regional pricing and tax.
• Payments are processed by Apple, Google, Stripe, Coingate, or Xendit depending on how you bought your subscription. We see the resulting receipt; we do not see your card number.
• We sell nothing. We use no advertising trackers on the marketing site. We do not feed any third-party analytics or behavioural-advertising network.

3. Personal data we collect

We collect the categories of personal data set out below. We collect only what we need to deliver, secure, bill, and improve the Service, and we minimise each category to the smallest data set that still works.

3.1 Account and authentication data

• Email address — used to identify your account, deliver magic-link sign-in tokens, send transactional notifications (renewal, billing failure, security alerts), and respond to support requests.
• Password hash — if you choose a password, only an Argon2id-derived hash is stored. We never receive, see, or store your plaintext password.
• OAuth identifiers — if you sign in with Apple or Google, the provider's stable user ID and the email released to us. We do not receive your social-graph data, contacts, or third-party tokens beyond what is required to verify your sign-in.
• Passkey (WebAuthn) credentials — the public key, credential ID, signature counter, and the friendly device name you choose, if you enrol a passkey.
• Two-factor authentication secret — a TOTP seed if you enable 2FA, plus single-use recovery codes you generate.
• Sign-in session tokens — short-lived access tokens and rotating refresh tokens issued per device, with a device fingerprint to enforce your plan's device limit.

3.2 Subscription and billing data

• Subscription state — the plan you are on, its start and renewal dates, the store of record (Apple App Store, Google Play, Stripe web checkout, Coingate, or Xendit), and any applied promo or referral credits.
• Receipt and transaction identifiers — opaque references returned by the store after a successful purchase. These let us verify, reconcile, and respond to refunds or chargebacks. We never see your full payment card number, CVV, or bank account number; those are handled entirely by the payment processor.
• Last four digits and brand — if you save a card through Stripe, we display the last four digits and card brand returned by Stripe so you can recognise which card is on file. The card itself stays with Stripe.
• Billing country and tax status — derived from your sign-up IP or your store account, used to apply the correct currency and any tax we are required to collect.

3.3 Network and connection metadata

This is the category most VPN providers handle poorly. Our position is explicit:

• Aggregate node metrics — each exit node reports CPU load, bandwidth utilisation, and concurrent connection counts to our control plane every 30 seconds. These metrics are per node, not per user, and are used for capacity planning, automatic failover, and detecting outages.
• Quota counters — for paid plans with a data cap, your server-side counter records bytes consumed in the current billing period. The counter is incremented from aggregate node-side statistics keyed on an opaque per-user identifier; it does not include destinations, source IPs, or per-session detail.
• Last-connection heartbeat — a single timestamp updated when your client most recently checked in with the control plane. This lets the dashboard show "Last seen 3 minutes ago" and lets us identify inactive devices for the device-limit cap. We do not retain prior heartbeats.

3.4 Device and technical data

• Platform and app version — for compatibility, mandatory-update gating, and crash investigation (iOS, Android, macOS, Windows; build number).
• Device fingerprint — a non-identifiable composite (model class, OS version, locale, time zone) used to enforce per-plan device limits and detect implausible session takeovers. We do not collect IDFA, AAID, IMEI, or other globally-unique advertising identifiers.
• Push notification token — if you enable push notifications, the APNs or FCM token for your installation.

3.5 Country of sign-up

We derive an approximate country and (where supported) region from the IP address you used to create your account. We use this to apply regional pricing, to determine which payment methods to offer, and to comply with tax obligations. The full IP address is discarded after derivation; only the country code and broad region are retained, and only against the account record.

3.6 Support communications

If you contact support, we keep a copy of the ticket and our replies for two years, so you can reference prior context and we can learn from common issues. If you opt in, the Service may use an AI assistant to draft a reply for our review; the assistant runs on a model provider listed in Section 8, and only the message content of the ticket is shared with it.

3.7 Optional diagnostics

Crash and error reports are off by default. If you opt in to a public beta channel, we may transmit anonymised crash traces to a diagnostics service. Email addresses, authentication tokens, and IP addresses are stripped from the trace before it leaves the device. You can revoke this consent at any time from the app's privacy settings.

4. What we do not collect

The whole point of a VPN is to limit what third parties — including us — can see about your browsing. To make that promise meaningful we have engineered the Service so that the data does not exist to be requested, leaked, or subpoenaed.

• No traffic logs. Xray-core, the proxy software running on every exit node, is configured to emit no per-connection access logs to durable storage. There is no per-user record of destinations, hostnames, ports, or request payloads.
• No DNS query logs. DNS resolution on the node is in-process and writes nothing to disk. We do not run a logging recursive resolver.
• No source-IP retention for VPN sessions. Once you are authenticated and connected, your originating IP address is not stored in any session record, audit log, or account row. The TLS termination at the node sees it; it is never copied off the node.
• No bandwidth-by-destination accounting. Quota counters tally total bytes only. We do not retain per-flow or per-destination byte counts at any layer.
• No device-graph cross-linking. We do not collect IDFA, AAID, IMEI, MAC addresses, or any identifier that could let a third party correlate your SecureFox use with your activity on unrelated apps or services.
• No advertising trackers on the marketing site. securefox.xyz loads no third-party analytics scripts, pixels, or behavioural-advertising tags.
• No sale or sharing for cross-context advertising. We never sell personal data, and we do not share personal data for the purpose of targeted advertising as those terms are defined under the laws cited in Section 20.

5. How we use your personal data

We process the personal data described above for the following purposes:

• Provide the Service. Authenticate sign-in, provision exit-node credentials, route your encrypted traffic, enforce your plan's device and data limits, and let you manage your account from the apps and dashboard.
• Process payments and prevent fraud. Verify purchases through the payment processor, reconcile renewals, handle refunds and chargebacks, and detect implausible patterns (such as the same payment method being used to create dozens of accounts in minutes).
• Communicate with you. Send transactional notifications you cannot reasonably opt out of (security alerts, billing failures, material policy changes), respond to support requests, and — only if you opt in — send product updates.
• Secure the Service. Detect and respond to abuse, brute-force attempts, account takeover, credential stuffing, denial-of-service, and other security incidents.
• Operate the network. Plan capacity, replace failing nodes, mitigate censorship of specific destinations, and decide where to deploy additional infrastructure.
• Comply with law. Meet our tax, accounting, anti-money-laundering, and statutory record-keeping obligations, and respond to validly-served legal process as described in Section 15.
• Improve the Service. Use aggregate, non-attributable usage patterns (number of connections per region, average session length per country) to inform product decisions. We do not use the content of your traffic for any improvement purpose because we do not have it.

6. Legal bases for processing

If you are in a jurisdiction whose data-protection law requires a legal basis for processing (notably the EU/EEA, the UK, Switzerland, Brazil, and Indonesia under UU PDP), we rely on the following bases:

• Performance of a contract (GDPR Art. 6(1)(b); UU PDP Art. 20(2)(b)). Necessary to deliver the Service you have asked us to deliver — sign-in, routing, billing, customer support.
• Compliance with a legal obligation (GDPR Art. 6(1)(c); UU PDP Art. 20(2)(c)). Tax records, statutory accounting retention, and responses to lawful orders.
• Legitimate interests (GDPR Art. 6(1)(f)). Securing the Service against abuse, planning network capacity, preventing fraud, and protecting our rights in legal claims. We have balanced these interests against your rights and freedoms and concluded that the processing is proportionate and would be reasonably expected.
• Consent (GDPR Art. 6(1)(a); UU PDP Art. 20(2)(a)). Used for opt-in diagnostics and any marketing emails. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Disclosure of personal data

We disclose personal data only in the limited circumstances below. We do not sell personal data. We do not share personal data with advertising networks or data brokers.

• Service providers (subprocessors). Vendors who process personal data on our behalf to operate the Service, listed in Section 8. Each is bound by a written contract with the protections that applicable law requires (including the GDPR Art. 28 obligations and equivalent provisions under UU PDP).
• Payment processors. Apple, Google, Stripe, Coingate, and Xendit receive the personal data they need to execute and reconcile a transaction. They are independent controllers for that processing.
• Legal and regulatory requests. Where we are compelled by a validly-served legal order or required by law, as described in Section 15. We narrow disclosures to what the order requires and challenge requests that are overbroad or improperly served.
• Vital interests and safety. Where strictly necessary to protect a person's life or physical safety, or to prevent serious imminent harm.
• Corporate transactions. If we are involved in a merger, acquisition, asset sale, financing, or insolvency, personal data may be transferred as part of that transaction. The recipient will be bound by terms no less protective than this Policy, and we will notify you in advance where required by law.

8. Subprocessors

The following service providers process personal data on our behalf. We post material additions to this list at least 14 days before they take effect on the SecureFox transparency page so customers can object before the change is made.

Each subprocessor is contractually bound to process personal data only on our instructions, to apply appropriate technical and organisational security measures, to assist with data-subject requests, and to delete or return personal data at the end of the engagement.

9. International data transfers

We operate exit nodes in multiple countries. Account data is hosted on a primary control-plane region with encrypted backups in a secondary region, and metadata necessary to authenticate sign-in is replicated to edge locations operated by Cloudflare. As a result, your personal data may be transferred to and processed in countries other than where you live, including the United States, the European Union, Singapore, and Indonesia.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or, for transfers from the UK, the UK Information Commissioner's International Data Transfer Addendum. For transfers from Indonesia, we comply with UU PDP Art. 56 by either transferring to a jurisdiction with an adequate level of protection, by binding the recipient to standard contractual safeguards, or by relying on your explicit consent.

You may request a copy of the transfer safeguards in place for a specific transfer by writing to privacy@securefox.xyz.

10. Data retention

We keep personal data only for as long as we need it. The following retention periods apply:

When the retention period ends, we delete the data or irreversibly anonymise it. If we cannot delete data immediately (for example because it is held in immutable encrypted backups), we isolate it from active processing and delete it at the next backup-rotation window.

11. Your rights

Subject to your local law, you have the following rights over the personal data we hold about you. Region-specific elaborations appear in Section 20.

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data, subject to limited exceptions for legal compliance.
• Restriction — ask us to stop processing your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Portability — receive your account data in a structured, machine-readable format and transmit it to another controller.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Lodge a complaint — with your local supervisory authority (see Section 20 for jurisdiction-specific authorities).

How to exercise your rights. Write to privacy@securefox.xyz from the email address registered to your account, or use the "Download my data" and "Delete my account" controls in the app under Account → Privacy. We respond within 30 days for GDPR/UK requests, 45 days for CCPA requests (extendable once by 45 days if reasonably necessary), and 30 days for Indonesian UU PDP requests.

Verification. To protect your data we may need to verify your identity before fulfilling a request. We rely on signal from the registered email address; for sensitive requests we may require an additional factor such as confirmation from an authenticated session.

No fee, no retaliation. We do not charge a fee to exercise your rights unless a request is manifestly unfounded or excessive, in which case we will tell you in advance. We will not deny service, charge different prices, or provide a lower quality of service because you exercised a privacy right.

12. Security

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and access:

• Encryption in transit. All client-to-control-plane traffic uses TLS 1.3 with modern cipher suites. All node-to-control-plane traffic uses mutually-authenticated TLS (mTLS) over gRPC with per-node certificates rotated automatically.
• Encryption at rest. Database storage is encrypted at the volume level. Sensitive fields (REALITY private keys, node-agent CA private key, payment-provider webhook secrets) are wrapped with an envelope-encryption key managed by a key-management service.
• Modern password hashing. User passwords are hashed with Argon2id at parameters tuned to current OWASP guidance. We do not use deprecated algorithms (MD5, SHA-1, plain SHA-256) for password storage.
• Strong authentication. Magic-link sign-in is the default. Optional second factors include TOTP, passkey (WebAuthn) authenticators, and recovery codes. Admin accounts require hardware-backed FIDO2 second factors.
• Least privilege. Access to production systems and customer data is limited to engineers with a current operational need. All admin actions are recorded in an audit log retained for three years.
• Post-quantum transport. SecureFox's exit nodes negotiate ML-KEM-768 for key exchange and ML-DSA-65 for transport signatures where supported, in addition to classical algorithms, to provide harvest-now-decrypt-later protection against future quantum-cryptanalytic attacks.
• Network isolation. Exit nodes and control-plane services run in segmented networks with default-deny firewall rules. Exit nodes have no inbound access to control-plane databases.

No security control is perfect. If you believe you have discovered a vulnerability, please write to security@securefox.xyz. We honour good-faith security research conducted under coordinated disclosure.

13. Cookies and similar technologies

The marketing site at securefox.xyz sets only strictly necessary cookies (sign-in session, CSRF protection, language preference). It loads no third-party analytics scripts, advertising tags, or behavioural-tracking pixels. There is no consent banner because nothing on the site requires consent under the ePrivacy Directive.

The web dashboard at securefox.xyz/dashboard stores your authentication tokens in your browser's local storage so that you stay signed in across page loads. This is technically necessary to deliver the dashboard and is not used for tracking.

Our mobile and desktop applications do not embed any third-party SDK that performs tracking. The opt-in diagnostics described in Section 3.7 are the only situation in which any third-party telemetry is produced, and only after explicit consent.

14. Children's privacy

SecureFox is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction, including age 16 under Article 8 GDPR where a Member State has implemented that threshold). We do not knowingly collect personal data from children below that threshold.

If you are a parent or guardian and believe a child has provided personal data to us without your consent, please write to privacy@securefox.xyz and we will delete the data and terminate any associated account.

15. Government and law-enforcement requests

We respond only to valid, jurisdictionally appropriate legal process. Requests from authorities outside the Netherlands must be served through Mutual Legal Assistance Treaty channels or the applicable EU cooperation mechanisms, or otherwise meet the requirements of Dutch law, before we will consider production.

What we can and cannot produce is constrained by what we hold:

• Traffic data. We have no per-user traffic logs, DNS query records, or source-IP history of authenticated sessions. We cannot produce data that does not exist.
• Account data. On valid legal process, we may produce the limited account data described in Section 3.1 and 3.2: email address, account creation date, subscription state, and the country derived at sign-up.
• Real-time interception. We do not operate any lawful-interception capability against customer traffic. Building one would require re-architecting the Service in ways inconsistent with this Policy, and would be disclosed as a material change.

We narrow over-broad requests, push back on requests that lack legal foundation, and where the law permits us to do so we notify the affected account holder before producing data, so that they may seek to challenge the request.

16. Warrant canary

As of the Last updated date at the top of this Policy, SecureFox has not received:

• any secret-court order;
• any national-security letter, gag order, or equivalent compelled-disclosure instrument that prohibits us from disclosing its existence;
• any government demand to insert a backdoor, key-disclosure obligation, or weakened cryptographic primitive into the Service.

We will update this section monthly. The absence of an update for more than 45 days after the most recent stated date should be treated as a signal that the canary may have lapsed and read accordingly.

17. Breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected users without undue delay, as required by Article 33–34 GDPR, UU PDP Art. 46–47, and equivalent obligations in other jurisdictions.

Notifications will describe, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information.

18. Changes to this Policy

We may update this Policy from time to time. The current version, with a Last updated date, is always available at securefox.xyz/privacy. Prior versions are retained on request.

Material changes — changes that broaden the categories of data we collect, the purposes for which we use it, the parties with whom we share it, or that materially restrict your rights — are announced at least 30 days before they take effect via the in-app notifications inbox and the email address registered to your account. Where consent is required for a new processing activity, we will not begin that activity until you have consented.

19. How to contact us

Kuipers Libertas BV — a private limited liability company (besloten vennootschap) incorporated under the laws of the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 12055775, with its registered address at PO Box 2162, 1200 CD Hilversum, the Netherlands. In this document, "SecureFox", "we", "us", or "our" refers to Kuipers Libertas BV, the operator of the SecureFox VPN service.

General inquiries: hello@securefox.xyz · Support: support@securefox.xyz · Privacy & data rights: privacy@securefox.xyz · Legal notices: legal@securefox.xyz

We respond to verified privacy requests within the statutory windows for the jurisdiction you assert. If we have not satisfactorily resolved your request, you have the right to lodge a complaint with your local supervisory authority — Section 20 lists the authorities applicable in the major jurisdictions our customers reach us from.

20. Region-specific disclosures

The following disclosures supplement, and where inconsistent override, the corresponding provisions above for users resident in the jurisdictions listed.

20.1 European Economic Area, United Kingdom, and Switzerland

We are the controller of personal data described in this Policy within the meaning of Regulation (EU) 2016/679 (the GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (revFADP).

Legal bases are listed in Section 6. International transfer safeguards are described in Section 9. You may exercise the rights in Section 11 and lodge a complaint with your national supervisory authority. A non-exhaustive list:

• Germany — your competent state data-protection authority, or the BfDI for federal-level matters.
• France — the Commission nationale de l'informatique et des libertés (CNIL).
• Spain — the Agencia Española de Protección de Datos (AEPD).
• Italy — the Garante per la protezione dei dati personali.
• United Kingdom — the Information Commissioner's Office (ICO).
• Netherlands — the Autoriteit Persoonsgegevens (AP), which is our lead supervisory authority, as we are established in the Netherlands.
• Other Member States — see the European Data Protection Board members list.

20.2 California — CCPA and CPRA

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA/CPRA") gives you additional rights, summarised below. Categories below use the CCPA terminology in Cal. Civ. Code § 1798.140.

• Categories of personal information collected (in the 12 months preceding the Last updated date): identifiers (email, account ID), commercial information (subscription history), internet or other electronic network activity information (aggregate node metrics; no browsing or search history), geolocation (country only, derived once), and inferences drawn from the foregoing to estimate plan suitability.
• Sources. Directly from you; from your device when you use the Service; from payment processors when you complete a purchase.
• Business purposes. Service delivery, fraud prevention, security, compliance, billing, support — as described in Section 5.
• Sale or sharing. We do not sell personal information and we do not share personal information for cross-context behavioural advertising, as those terms are defined in Cal. Civ. Code § 1798.140(ad) and (ah).
• Sensitive personal information. We do not collect SPI for the purpose of inferring characteristics about you. The categories we do collect (sign-in credentials) are used solely to provide the Service and are not disclosed for any other purpose.
• Rights. You have the right to know, the right to delete, the right to correct, and the right to opt out of sale/sharing (which we honour by default because we do not sell or share). Submit requests via privacy@securefox.xyz.
• Non-discrimination. We will not discriminate against you for exercising these rights.
• Authorised agents. You may use an authorised agent. We will require written authorisation and identity verification.

20.3 Brazil — LGPD

If you are in Brazil, Lei Geral de Proteção de Dados (Lei nº 13.709/2018, the "LGPD") applies. We act as the controlador of your personal data within the meaning of Art. 5(VI) LGPD. Legal bases (hipóteses legais) align with Section 6 and are drawn from Art. 7 LGPD. You may exercise the rights set out in Art. 18 LGPD by writing to privacy@securefox.xyz. Complaints may be filed with the Autoridade Nacional de Proteção de Dados (ANPD).

20.4 Canada — PIPEDA

If you are a resident of a Canadian province whose privacy regime is governed by the Personal Information Protection and Electronic Documents Act ("PIPEDA"), or by a substantially similar provincial statute (Quebec Law 25, BC PIPA, Alberta PIPA), you may direct privacy inquiries to privacy@securefox.xyz. Complaints may be filed with the Office of the Privacy Commissioner of Canada.

20.5 Indonesia — UU PDP

Untuk pengguna di Indonesia, Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) berlaku. Kuipers Libertas BV bertindak sebagai Pengendali Data Pribadi sebagaimana dimaksud Pasal 1 angka 4 UU PDP. Dasar pemrosesan kami mengikuti Pasal 20 UU PDP dan dijelaskan pada Bagian 6. Hak Anda sebagai Subjek Data Pribadi diatur dalam Pasal 5–14 UU PDP dan dapat dilaksanakan dengan menghubungi privacy@securefox.xyz. Pengaduan dapat disampaikan kepada lembaga pengawas Pelindungan Data Pribadi sebagaimana diatur dalam UU PDP setelah pembentukannya secara resmi.