Privacy Policy

1. Who we are

The VILAR service is operated by NOVERA LABS LLC (Republic of Armenia) — the “Operator”, “we”. Contact for questions about this Policy: support@vilarvpn.com.

2. The essentials

• VILAR does not require an account. We do not ask for your name, email, phone number or any other information that identifies you. If you choose to sign in with Apple, we receive from Apple the data listed in section 4.
• We keep no traffic logs. We do not record the sites you visit, the domains you connect to, your DNS queries or the contents of your connections.
• We never sell your data, and we never use it for advertising, for profiling or to track you across apps or websites.
• The app and this website contain no ads, analytics or trackers.
• To run the service we use a small number of service providers, listed in section 7. They act on our instructions and only to provide VILAR.

3. Device identification

Instead of an account, a device is identified by a random cryptographic key that the app generates on the device itself at first launch. The private half of that key never leaves your device.

The key identifies an installation, not a person. It is not linked to your name, email, phone number or any other personal data — unless you choose to sign in with Apple (section 4) — and it is not an advertising identifier or any identifier issued by Apple or Google.

4. What data is processed

• Device identifier — the random key described above, used to recognise this installation and to decide whether it currently has access.
• Device and app information — the device model (for example “Apple iPhone17,1”), the major version of its operating system and the app version. Used as a label so that you and our support can tell your devices apart, and so that an older app keeps working after a change on our side.
• Subscription state — the validity period, the trial status and how many devices are attached to the subscription.
• App Store transactions — if you get access in the iPhone app: the transaction details Apple sends (transaction identifier, the product and its term, date, amount and store country). Used to grant access and to never count one transaction twice.
• Sign in with Apple — only if you choose it: the identifier Apple issues for VILAR, the email address Apple passes on (this may be an Apple private relay address) and an Apple service token stored encrypted. Used so that your access follows your Apple ID.
• Notification token — if you allow notifications, the token issued by your device platform together with your interface language. Used only to tell you that your access period is ending.
• IP address — your device’s address is visible to our servers while a connection is being set up, as it is to any internet service. It is used to route the connection and to limit abuse, and it is not written into your subscription record. It can appear briefly in our servers’ operational and security logs, for example when a registration attempt is refused. Those logs are bounded in size and are overwritten as new entries arrive. They are never used to build a record of what you visit.
• Operational information — technical measurements of server health such as load, memory and the total network volume of a server. They contain nothing about individual users.

5. Your traffic, and what we do not collect

We do not collect, inspect, store or share:

• your browsing history;
• the websites and pages you visit;
• the domains you connect to;
• the contents of your connections, your messages or any application data.

Your traffic passes through our servers encrypted and is forwarded onward. It is not examined and it is not recorded.

DNS. Name lookups travel inside the encrypted tunnel. At certain moments of tunnel operation — for example while the app is moving your connection onto a different route — DNS packets pass through our software so that name resolution is not interrupted. Only the technical header is read, in order to recognise that a packet is a DNS packet. The names being looked up are not read, not retained, and never used to build a browsing history.

The app contains no advertising or analytics SDKs and no third-party crash-reporting tools.

6. Transactions

Transactions in the VILAR app for iOS go through the App Store: Apple processes them, and your card details are never passed to the Operator. Apple tells us only the transaction details listed in section 4.

Transactions that Apple does not process are handled by a third-party transaction processor, on its own side. Your card details are entered only there and are never seen by the Operator, which neither receives nor stores them. We receive only the confirmation of the transaction and its parameters — product, amount and term — which are what open access. The reference we hand to the transaction processor is a random code that does not identify your device.

7. Service providers and where data is stored

Subscription records are stored on servers the Operator rents in data centres in the European Union, outside the Russian Federation. Access to them is restricted and protected.

To operate the service we rely on:

• hosting and network providers, which supply the servers and the connectivity the service runs on;
• the notification service of your device platform — Apple Push Notification service on iOS, Google Firebase Cloud Messaging on Android. It receives the notification token and the text of the notification, which says only that your access period is ending;
• a transaction processor, for transactions Apple does not process (section 6);
• Apple, for App Store transactions and for Sign in with Apple if you choose it.

These are service providers acting on our instructions, for the sole purpose of providing VILAR. We do not sell data to them or to anyone else, none of them is an advertising or analytics partner, and none of them receives data about the sites you visit — we do not have it.

8. Retention and deletion

Subscription records are kept for as long as you use the service and for a reasonable period afterwards. Operational and security logs are bounded in size and are overwritten as new entries arrive; they are not kept indefinitely.

You can ask us to delete the data linked to your device by writing to support@vilarvpn.com. We action such requests within 30 days. Deleting a subscription record ends access for the devices attached to it. Encrypted backups are held for a limited period so that the service can be restored after a failure; they are overwritten on their own schedule, within 30 days of the deletion.

9. The vilarvpn.com website

The website uses no analytics and no trackers. On its access service pages it sets one technical cookie, by which this browser finds the access obtained in it again (kept for up to 90 days, not readable by page scripts). If you save that access to your Apple ID on such a page, the sign-in goes through Apple (section 4). Your choice of the light or dark theme is remembered by your browser and never leaves it. The web server keeps standard technical access logs required for security; they rotate automatically and are not used for profiling.

10. Changes to this Policy

When this Policy changes, the new version is published on this page with an updated date. Substantial changes are additionally announced in the official Telegram channel.