Privacy Policy — Blackwall VPN

Last updated: July 16, 2026

Product: Blackwall VPN (mobile apps for iOS and Android, and API at https://vpn.artevus.com)

Operator: Artevus Technologies (Private) Limited ("Artevus", "we", "us", "our")

1. Introduction

Artevus Technologies is committed to protecting your privacy. This Privacy Policy explains how we handle information in connection with Blackwall VPN — our consumer VPN service delivered through mobile applications and the backend API at https://vpn.artevus.com (collectively, the "Service").

Blackwall VPN is a no-log VPN service. We provide encrypted VPN connectivity through Artevus-operated servers. Today, exit nodes are located in the United States and India. When you connect, your device traffic is routed through the server region you select.

We have designed the Service with a privacy-first, no-logs philosophy: we do not log your browsing activity, DNS queries, or traffic content; we do not sell your data; we do not use it for advertising; and we collect only what is necessary to operate the VPN, manage your account, and enforce plan limits.

This Policy applies to all users of Blackwall VPN globally. Use of the Service is also governed by our Terms of Service. General privacy practices for other Artevus websites or products are described separately at artevus.com/privacy.

2. Our Core Privacy Commitment — No-Log Policy

Artevus Technologies operates Blackwall VPN as a no-log VPN. Under our no-logs policy, we do not monitor, record, or store connection logs that would reveal what you do online while connected. We do not sell, rent, or monetize your personal data. Personal identifiers such as your email address exist solely to authenticate and operate your account and are handled according to the retention and deletion rules in this Policy.

Specifically, our no-log commitment means:

• We do NOT log your browsing history, websites visited, apps used, DNS queries, IP addresses of destinations you connect to, timestamps of when you visited specific destinations, or the content of traffic through the VPN tunnel.
• We do NOT keep a VPN connection history that would show when you connected, how long you stayed connected, or which destinations you reached.
• We do NOT sell, use, or disclose to third parties any data obtained through the VPN for any purpose other than providing and operating the VPN Service itself (Apple App Store Review Guideline 5.4).
• We do NOT sell your personal data to any third party under any circumstances.
• We do NOT use your personal data for advertising or marketing purposes without your explicit consent.
• We do NOT share your personal information except as expressly described in this Policy (limited service providers needed to operate the Service, under confidentiality obligations).
• We collect only the minimum data necessary ("data minimization") to provide and improve the Service — account credentials, VPN device metadata, and aggregate bandwidth totals for free-tier quotas — never activity or content logs.

2.1 VPN Traffic and No-Logs Policy

Blackwall VPN is a no-log VPN. This section describes what that means for your network traffic — the most important part of our privacy practices.

What we do

What we do not do

DNS resolution

WireGuard client configurations issued by Blackwall VPN set DNS = 1.1.1.1 (Cloudflare public DNS). DNS queries from your device while connected may be handled by that third-party resolver. Blackwall VPN does not log your DNS queries. Cloudflare's handling of DNS traffic is governed by Cloudflare's privacy policy.

Exit IP address

While connected, websites and services you access see the public IP address of the VPN server you selected (for example, our US or India node), not your device's local IP address.

3. Information We Collect

3.1 Information You Provide Directly

When you create an account or use certain features, you may voluntarily provide:

• Account registration data: email address, password (stored as a one-way hash — we never store plaintext passwords), full name, and country (ISO 3166-1 alpha-2 code).
• Optional profile data: timezone.
• Device and session data: device identifier (device_id), platform (ios or android), and device name — required at registration and login to enforce our single-device session policy.
• OAuth sign-in: if you use Sign in with Google or Sign in with Apple, we receive the minimum identity data needed to authenticate your account (such as email and name from the identity provider).
• Support and feedback: email address, subject, description, category, or message when you submit a support request or feedback through the app.
• Invite activations: when you or another user activates a share link, we record the inviter and invitee user identifiers to apply referral rewards.

3.2 Information Collected Automatically

When you use the Service, we may automatically collect:

• VPN bandwidth usage: aggregate bytes transferred per UTC calendar month and per UTC calendar day (free tier: 10 GiB/month and 500 MiB/day by default). Stored in our usage metering system; paid subscribers are not subject to these limits.
• Subscription status: plan tier, product identifier, expiry date, renewal status, store (App Store or Play Store), and billing-issue flags — synced from RevenueCat when you purchase or manage a subscription.
• App version and platform: submitted on app launch for our force-update gate (POST /app-version).
• Active session metadata: which device is currently logged into your account (device ID, platform, device name, session timestamp).
• VPN device records: server region selected, device name, WireGuard public key, and encrypted private key.
• Server and API logs: IP address, request timestamps, error reports, and security-related events for operations and abuse prevention.

3.3 Information We Do NOT Collect

We explicitly do not collect:

• Browsing history, DNS query logs, or the content of traffic passing through the VPN tunnel.
• Precise real-time GPS location (country is provided by you at registration; server region is selected by you).
• Contact lists, photos, microphone audio, camera images, or biometric data.
• Full payment card numbers or bank account details (subscriptions are processed by Apple App Store or Google Play Store via RevenueCat).
• Background activity unrelated to VPN operation or account management.

4. How We Use Your Information

We use the information we collect strictly for the following purposes:

• Account management: To create, authenticate, and manage your account, including email verification and password reset.
• VPN service delivery: To provision and manage WireGuard VPN tunnels, issue client configurations, and route your traffic through selected server regions.
• Plan and quota enforcement: To apply free-tier monthly and daily data limits, paid-tier entitlements, and invite-referral quota bonuses (up to 3 successful invites per account, +1 GiB per invite for the current UTC month).
• Single-device policies: To enforce one active app login and one active VPN device per account, including disconnecting prior sessions or devices when a new one connects.
• Communications: To send transactional emails (verification, password reset, account recovery, session-replaced notices) and service-related push notifications. We do not send unsolicited marketing emails unless you opt in.
• Customer support: To respond to support requests and feedback you submit.
• Product improvement: To analyze aggregate usage patterns, identify bugs, and improve features and performance — without profiling individual browsing behavior.
• Security: To detect, prevent, and respond to fraud, abuse, security threats, and violations of our Terms of Service.
• Legal compliance: To comply with applicable laws, regulations, and legal processes.

We will not use your data for any purpose not listed above without obtaining your prior consent.

5. Data Retention Policy

Artevus follows a minimal-retention approach:

• Active accounts: Data is retained only as long as necessary to provide the Service or as required by law.
• Soft-deleted accounts: When you delete your account through the app, we perform a soft delete (see Section 9). Your email is tombstoned and VPN access is revoked immediately, but your user record is preserved so you can recover your account indefinitely via email verification. This is not immediate permanent erasure.
• Usage records: Monthly and daily bandwidth totals (UsagePeriod records) are retained for the active account period and associated with soft-deleted accounts until permanent erasure is completed.
• Subscription records: RevenueCat webhook event ledger and subscription metadata are retained for billing reconciliation and audit purposes.
• Support and feedback: Submissions may be retained after account deletion with the user link removed, for quality and operational purposes.
• Anonymized or aggregated data: Non-identifiable, aggregated statistics (for example, total connected peers per server) may be retained indefinitely for analytical purposes.
• Legal hold: Data may be retained beyond normal periods if required by applicable legal obligations, court orders, or regulatory requirements.

Users in the EU, UK, California, and other jurisdictions may request permanent erasure of all personal data by contacting privacy@artevus.com (see Section 9.4).

6. Data Sharing and Disclosure

6.1 We Do Not Sell Your Data

Artevus will never sell, rent, trade, or otherwise transfer your personal data to third parties for commercial or advertising purposes. This is an absolute commitment with no exceptions.

Apple App Store Guideline 5.4 (VPN apps): We do not sell, use, or disclose to third parties any data obtained through the VPN for any purpose other than providing and operating Blackwall VPN. Limited disclosures to service providers listed in Section 6.2 exist solely to operate the Service (for example, hosting, email delivery, push notifications, and subscription processing) and are not for advertising, analytics profiling, or resale.

6.2 Limited Service Provider Sharing

We may share data with trusted third-party service providers who assist in operating Blackwall VPN, strictly under confidentiality and data processing agreements. These providers may include:

We also use internal operational notifications (Discord webhooks) to alert our team of account signups and deletions. These notifications contain limited profile information (such as email and device summary) for operational purposes only and are not shared for advertising.

All service providers are contractually prohibited from using your data for any purpose other than providing services to Artevus.

6.3 Legal Disclosures

We may disclose your information if required by law or in good faith belief that such action is necessary to:

• Comply with a legal obligation, court order, or valid government request.
• Protect the rights, property, or safety of Artevus, our users, or the public.
• Enforce our Terms of Service or other applicable agreements.

6.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or reorganization, your data may be transferred to the successor entity. You will be notified of any such transfer and any material changes to this Privacy Policy.

7. Apple App Store and Google Play Store Compliance

7.1 Apple App Store Compliance

Our iOS application complies with Apple's App Store Review Guidelines and Apple's privacy requirements, including:

• App Privacy Nutrition Labels: Our App Store listing accurately discloses data types collected (including email, name, user ID, device ID, purchase history, and product interaction), their purposes, and whether data is linked to user identity.
• VPN network extension: The app uses Apple's Network Extension framework to establish a WireGuard VPN tunnel. This permission is used solely to provide the VPN service you request.
• App Tracking Transparency (ATT): We do not use advertising trackers. If tracking is ever introduced, we will request explicit permission via the ATT prompt before any tracking occurs.
• Sign in with Apple: Where offered, we comply fully with Apple's authentication requirements and do not store Apple-provided credentials beyond what is necessary for authentication.
• In-App Purchases: Premium subscriptions are processed through Apple's In-App Purchase system via RevenueCat, in compliance with Apple's IAP guidelines.
• Data minimization: We collect only data necessary for VPN operation and account management, consistent with Apple guidelines.

7.2 Google Play Store Compliance

Our Android application complies with Google Play Developer Program Policies and Google's Data Safety requirements, including:

• Data Safety Section: Our Play Store listing includes an accurate Data Safety disclosure covering data collected (including email, name, user ID, device ID, app interactions, and purchase history), how it is used, whether it is shared, and applicable security practices.
• VPN permission: The app requests VPN permission to establish a WireGuard tunnel. This is required for core VPN functionality and is not used for any other purpose.
• Sensitive permissions: We request only the minimum permissions necessary for app functionality. Permissions are requested with clear explanations where required by Google.
• Background location: We do not access background location data.
• Play Billing: Premium subscriptions are processed through Google Play Billing via RevenueCat, in compliance with Google Play Billing policies.
• Malware Policy: Our app does not engage in deceptive, malicious, or harmful behavior.

7.3 Cross-Platform Privacy Consistency

All privacy commitments in this Policy apply equally across iOS and Android. Users have the same data rights and controls regardless of which platform they use.

8. Your Data Rights

Depending on your location, you may have the following rights regarding your personal data:

8.1 Right to Access

You may request a copy of the personal data we hold about you at any time by contacting privacy@artevus.com.

8.2 Right to Correction

You may update certain profile fields (such as full name) directly in the app via PATCH /me, or by contacting our support team.

8.3 Right to Erasure (Right to Be Forgotten)

You have the right to request permanent deletion of your personal data. In-app account deletion performs a soft delete with recovery options (see Section 9). For complete and irreversible erasure, contact privacy@artevus.com.

8.4 Right to Data Portability

Upon request, we will provide your personal data in a structured, machine-readable format to allow transfer to another service, where technically feasible.

8.5 Right to Restrict Processing

You may request that we restrict the processing of your data in certain circumstances, such as when you contest the accuracy of the data or have objected to processing.

8.6 Right to Object

You may object to processing of your personal data for direct marketing or where processing is based on legitimate interests.

8.7 Rights Under Specific Laws

• GDPR (EU/EEA users): All rights listed above apply. Our legal basis for processing is contract performance, legitimate interests, or consent as applicable.
• CCPA (California users): You have the right to know, delete, and opt out of sale of personal information. We do not sell personal information.
• PIPEDA (Canadian users): You have rights of access and correction under Canadian privacy law.
• Other jurisdictions: We comply with applicable local data protection laws in jurisdictions where we operate.

To exercise any of these rights, contact us at privacy@artevus.com. We will respond within the timeframe required by applicable law (generally 30 days).

9. Account Deletion and Data Erasure

9.1 In-App Account Deletion (Soft Delete)

When you delete your Blackwall VPN account through the app (Settings → Delete Account), we perform a soft delete. This is not immediate permanent erasure, but it immediately ends your access to the Service.

Upon soft delete, the following happens immediately:

• Your account is deactivated and you lose access to the Service.
• All active VPN tunnels are disconnected and WireGuard peers are revoked.
• All refresh tokens and app sessions are revoked.
• Push notification subscriptions are removed from OneSignal.
• OAuth tokens with Apple and Google are revoked where applicable.
• Your email address is replaced with an internal tombstone value. A one-way HMAC of your original email is stored to allow recovery lookup without retaining the plaintext email on the active record.

The following data is preserved while your account is in soft-deleted status:

• Your user identifier (user.id), profile fields (name, country, device info), usage history, subscription metadata, and linked support or feedback records.
• Inactive VPN device records (peers already revoked).

This preservation enables account recovery (Section 9.3).

9.2 Account Recovery

Soft-deleted accounts can be recovered indefinitely using the account recovery flow:

1. Attempt to register or log in with your original email — you will receive a prompt that the account is recoverable.
2. Request a recovery code via POST /auth/request-account-recovery.
3. Submit the code via POST /auth/recover-account to restore your account, email, and access.

Recovery restores your account to active status with your original email address.

9.3 Permanent Erasure (Hard Delete)

If you want all personal data permanently and irreversibly removed, contact privacy@artevus.com from your registered email address with the subject "Permanent Account Erasure Request."

Upon verification of your identity, we will permanently delete:

• Your email address and all contact information.
• Your profile information and settings.
• Your password hash and authentication credentials.
• All VPN device records and encrypted WireGuard private keys.
• Your usage history and invite activation records.
• OAuth identity links and refresh tokens.
• Support and feedback records linked to your account (or anonymized where retention is required).

Permanent erasure timeline:

• Within 30 days: All personal data is purged from our primary databases and active systems.
• Within 90 days: Data is purged from backup systems and disaster recovery archives.
• After 90 days: No personal data linked to your account exists anywhere in Artevus systems, except anonymized aggregates or records required by law.

9.4 How to Delete or Erase Your Account

We recommend exporting any information you wish to keep before initiating deletion.

10. Data Security

Artevus implements industry-standard security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction:

• Encryption in transit: All data transmitted between your device and our API is encrypted using TLS (Transport Layer Security) 1.2 or higher. VPN tunnel traffic is encrypted using WireGuard's modern cryptography.
• Encryption at rest: WireGuard device private keys are encrypted at rest in our database using AES-256-GCM (DEVICE_SECRET_ENCRYPTION_KEY). Sensitive data in our databases is hosted on secured infrastructure.
• Password security: User passwords are stored as one-way hashed values using Argon2; we never store plaintext passwords.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis.
• Internal API protection: Cross-server administrative routes are protected by shared internal tokens and network firewall rules.
• Incident response: We maintain a documented data breach response plan and will notify affected users and regulatory authorities as required by law in the event of a breach.

While we implement strong security measures, no method of electronic transmission or storage is 100% secure. We encourage users to use strong, unique passwords and keep their devices updated.

11. Cookies and Tracking Technologies

11.1 Cookies

Blackwall VPN is primarily a mobile application. Our API at https://vpn.artevus.com does not use marketing cookies or third-party advertising trackers.

Legal and informational pages on artevus.com may use cookies as described in the Artevus website privacy policy. Those cookies are separate from the Blackwall VPN mobile app.

11.2 Mobile App Tracking

Our mobile apps do not use advertising trackers or analytics SDKs for ad targeting. On iOS, we do not engage in cross-app tracking. Usage data collected through the app is limited to what is described in Section 3 and is used only to operate the Service.

12. Children's Privacy

Blackwall VPN is not directed to children under the age of 13 (or 16 in the EU). We do not knowingly collect personal data from children under these ages. If we become aware that we have inadvertently collected personal data from a child below the applicable age threshold, we will take immediate steps to delete such data.

If you are a parent or guardian and believe your child has provided personal information to Artevus, please contact us immediately at privacy@artevus.com.

13. International Data Transfers

Artevus operates globally. Your information may be transferred to and processed in countries outside your country of residence, including the United States and India where our VPN servers are located, and countries where our service providers operate.

When transferring data from the EU/EEA to third countries, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or other mechanisms recognized under GDPR. By using the Service, you consent to such transfers subject to the protections described in this Policy.

14. Third-Party Integrations and SDKs

Our mobile applications and backend integrate the following third-party services:

Each third-party service has its own privacy policy governing how it handles data. We carefully vet all integrations and require them to meet our privacy standards. We share only the minimum data necessary for each integration to function.

15. Push Notifications

We send push notifications through OneSignal for service-related events only. You can manage notification preferences:

• iOS: Settings → Notifications → Blackwall VPN
• Android: Settings → Apps → Blackwall VPN → Notifications

Notification types we send

We do not send promotional push notifications without your opt-in consent. Disabling notifications in your device settings may prevent you from receiving important service alerts (such as quota warnings).

To link push delivery to your account, the mobile app calls OneSignal.login(user.id) after authentication. On logout, OneSignal.logout() is called to unlink the device.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Policy in the app or at a published URL with a new "Last Updated" date.
• Sending an in-app notification or email for significant changes.
• Requesting your renewed consent where required by law.

Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you should discontinue use and may request account deletion.

17. Contact Us — Privacy Matters

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Artevus Technologies (Private) Limited
Data Privacy Team

• Privacy inquiries: privacy@artevus.com
• General support: info@artevus.com
• Website: artevus.com
• Service API: https://vpn.artevus.com

We are committed to resolving your privacy concerns promptly and transparently. We will respond to all privacy-related inquiries within 30 days.

Summary of Key Commitments

• NO-LOG VPN: Blackwall VPN is a no-log VPN service. We do not monitor, log, or store browsing history, DNS queries, destination IPs, traffic content, or a VPN connection history (when you connected, session duration, or destinations reached).
• APPLE GUIDELINE 5.4: We do not sell, use, or disclose to third parties any data obtained through the VPN except as needed to operate the Service.
• NO DATA SELLING: We never sell your personal data to third parties.
• NO ADVERTISING TRACKING: We do not use your data for advertising or ad targeting.
• MINIMAL COLLECTION: We collect only what is necessary to operate the VPN, manage your account, and enforce plan limits — not activity logs.
• AGGREGATE BANDWIDTH ONLY: Free-tier usage limits are enforced using total bytes transferred — not traffic content.
• SOFT DELETE WITH RECOVERY: In-app deletion deactivates your account immediately but allows recovery via email. Permanent erasure is available on request.
• SECURE STORAGE: Passwords are hashed with Argon2; WireGuard private keys are encrypted at rest; API traffic uses TLS.
• APP STORE COMPLIANT: Our mobile apps comply with Apple App Store and Google Play Store privacy requirements.
• YOUR RIGHTS: You have the right to access, correct, delete, and port your data at any time.
• TRANSPARENT UPDATES: We notify you of any material changes to this Policy.