nuvyvpn Privacy Policy
Information we process
nuvyvpn provides VPN connectivity, device management, traffic statistics and customer support. We process the following information to deliver these features:
- Account information: the account identifier provided by Sign in with Apple, a name you provide, and internal account identifiers.
- Authentication information: short-lived sign-in sessions, token hashes and encrypted Apple refresh credentials, used to verify your account, refresh sessions and revoke authorization.
- Device information: registered device identifiers, device names and WireGuard public keys. Device private keys remain in the device Keychain and are not stored by the control plane.
- Connection information: assigned routes, connection attempt identifiers, tunnel addresses and connection authorization state, used to establish connections, handle cancellation and enforce revocation.
- Usage information: upload and download totals and approximate daily usage summaries. Counters are calculated in UTC and are not exact per-byte billing.
- Support information: ticket subjects, content, replies and any information contained in attachments that you choose to submit; current in-app tickets are primarily text.
- Security information: short-lived hashed rate-limit identifiers derived from request addresses, and operational security audit events, used to prevent abuse and protect the service.
We do not store visited web pages, DNS query history or communication content as a browsing history. VPN nodes necessarily process traffic in real time to forward it; this does not mean we cannot technically process that traffic, and it is not a guarantee of complete anonymity.
Purposes and external services
The information above is used for authentication, device management, VPN assignment, usage reporting, support handling, security protection and service maintenance. The free V1 has no purchase or renewal interface.
We do not sell personal information or build advertising profiles from browsing content. Sign in with Apple uses Apple's authentication service.
When you actively run an exit-IP check or the related diagnostic, the current version sends a request to ipify. That service can receive the public exit IP presented by the request and ordinary request metadata. The app does not include account tokens, device private keys or access records in that check request.
The service is hosted on Amazon Web Services. Node regions include Singapore, Switzerland and Australia, and account data may be processed across borders between these regions and the United States. The existence of node regions does not establish that all account data is stored in those regions.
Data retention
The retention policy currently in effect is: daily usage data is retained for 90 days, operational audit records for 180 days, closed support tickets are cleaned up 30 days after closure, and local encrypted backups are retained for 14 days. Account and device records are kept while the service is provided; short-lived sessions and security rate-limit records are removed through expiry and maintenance processes.
Deleting your account
You can choose "Delete account" on the Account tab in the app. The service revokes connection authorization for the account and its devices, removes primary identity associations, devices, public keys, traffic records, support tickets and sessions, and queues revocation of Apple sign-in credentials.
A small number of de-identified account-state records may be retained to maintain data integrity. Historical backups are not individually rewritten immediately upon deletion; they age out under their retention schedule. We do not describe account deletion as the immediate and complete erasure of all historical backups.
Security and your requests
We protect information with HTTPS, device-side Keychain storage, encrypted credentials and restricted administrative access. VPN encryption primarily protects communication between your device and the VPN node; it does not guarantee end-to-end encryption for all communication with destination websites.
To access, correct or request deletion of information relating to you, contact [email protected]. We handle requests in accordance with applicable law.
Contact us and policy updates
Operator: CRETE CRAFT INC.
Address: 185 Riverside Ave, Somerset, Massachusetts 02725-2842, United States
Privacy contact: [email protected]
Support email: [email protected]
When our data practices change, we will update this policy and its effective date, and provide notice or obtain consent where required.