Privacy policy
Last updated: 19 October 2026 · Draft for legal review
This policy covers the un/braid app for Android, the website unbraid.app, and what happens when you contact us or donate. We wrote it in plain language. If something is unclear, ask us.
A few words we use: an exit is the server your traffic leaves from. Direct means an app doesn’t use a VPN exit. Your tailnet is your private network of Tailscale devices.
The short version
- un/braid has no servers of its own and no account with us. We add no analytics or advertising. The app sends no data to a server we run. We have no direct access to your traffic, logins, app list or saved statistics. The Play version includes Google’s Billing code, explained below.
- The app keeps its data on your phone. It connects to the VPN providers, servers and services you choose, and to a few public services it needs to work. All of them are listed below.
- We run no analytics on the website.
- We handle personal data in a few places: website visits (through our host, Cloudflare), emails and issue reports, donations and tips, and crash reports that Google Play may share with us. Each is explained below.
- VPN providers and other independent services handle the data they receive under their own policies. Cloudflare handles website data for us, as explained below. Our terms explain the app’s risks and liability limits.
Who is responsible
The controller for the personal data described here is:
Quiet Crafts (sole proprietorship), Rotterdam, the Netherlands [TODO: postal address] Chamber of Commerce (KvK): [TODO: number] Email: info@unbraid.app
We have no data protection officer; the law doesn’t require one for us. Write to the address above about anything in this policy.
1. The app
What the app keeps on your phone
The app processes the following on your phone. It does not send it to any server we run, and we have no access to it.
| Data | Why | How it’s stored |
|---|---|---|
| Provider logins: tokens, account numbers, usernames and passwords, and the WireGuard, OpenVPN or Shadowsocks details you enter or import | To sign in and open tunnels | In files encrypted with a key held in the Android Keystore |
| Tunnel keys and recently working tunnels | To connect quickly and reliably | Encrypted the same way |
| Your routes, which app uses which exit, favourites and settings | So the app does what you set up | App storage |
| Public server lists from providers | To show locations and pick servers | App storage, refreshed about once a day |
| A table of domain names that apps on your phone looked up, matched to temporary internal addresses | To match each app’s connections to the domain names it asked for, so they leave through that app’s exit | App storage, not encrypted by the app, even with Stats off. It survives disconnects, pauses and VPN restarts. Deleting statistics does not clear it. The app deletes it when you sign out of everything and return to the first-run screen: all providers, imported routes, your own servers and Tailscale must be removed. Clearing app storage or uninstalling also removes it |
| Tailscale state, if you use Tailscale | To stay part of your tailnet | Encrypted with the Android Keystore key, including your Tailscale login key and this device’s Tailscale keys. It’s deleted when you sign out of Tailscale |
| Statistics, only if you turn them on | To show you your usage and speed tests | App storage, not encrypted. See “Statistics” below |
Android keeps app storage private to the app. The app’s data is excluded from Android backups and from device-to-device transfer. Signing out does not erase all local data. Deleting statistics leaves the domain table and saved speed-test permission in place. Clearing app storage in Android’s settings, or uninstalling, removes the app’s local data. It does not remove data held elsewhere, such as M-Lab’s published results.
App logs hide secrets such as logins and keys. Neither the app nor its network engine is set up to save log files.
Your installed apps
Per-app routing needs to know which apps are installed, so the app asks Android for the full list (the QUERY_ALL_PACKAGES permission). It reads that list only after you agree, uses it on the phone to show the Apps screen and to match each connection to the app that made it, and never sends it anywhere.
Other permissions
- Local network (Android 17 and later): lets the app reach devices on your Wi-Fi, such as your home server or Tailscale devices, directly. The app doesn’t scan for or list nearby devices.
- Notifications: to show that the VPN is running, with your route codes and app counts.
- Foreground service, network state, internet: to run the VPN.
- Clipboard: after you paste a password or key at sign-in, the app clears it from the clipboard. It doesn’t read the clipboard otherwise.
Where the app connects
The app has no server of ours to talk to. It connects only to the destinations below. Each one sees the IP address the connection comes from, and the time, as any website would, and handles what it receives under its own privacy policy. “Through the tunnel” means the connection leaves from your VPN exit, not from your own internet connection.
| Destination | When | What it receives |
|---|---|---|
| NordVPN (api.nordvpn.com, downloads.nordcdn.com) | When you sign in, on connect, and about once a day for server lists | Your access token; requests for server lists and OpenVPN profiles |
| Mullvad (api.mullvad.net) | Sign-in, connect, sign-out | Your account number and the public half of a key made on your phone, registered as a device. The device is removed when you sign out |
| IVPN (api.ivpn.net) | Sign-in, connect, sign-out | Your account ID and the public half of a key made on your phone |
| Private Internet Access (www.privateinternetaccess.com, serverlist.piaservers.net, and the PIA server you connect to) | Sign-in and every connect | Your username and password to get a token; then the token and a public key at each connect |
| Surfshark, Windscribe, AirVPN (their public server-list addresses) | When you add them and on connect | Requests for public server lists. No login is sent |
| GitHub (raw.githubusercontent.com, the community list gluetun-servers) | When you use Proton VPN or ExpressVPN, and as a backup list for Surfshark and AirVPN | A request for that provider’s public server list, so GitHub can see which provider you use. No login is sent. Your ExpressVPN login stays on the phone |
| The VPN servers you connect to | While the VPN is on | The traffic of the apps you route there, encrypted with WireGuard, OpenVPN or Shadowsocks. The server’s operator can see what any VPN operator can see |
| Connection checks: Google (stun.l.google.com, www.google.com) and Cloudflare (stun.cloudflare.com) | About once a minute while connected, through each provider tunnel, even with Stats off | A short network test to see whether the tunnel still works. Google or Cloudflare sees the exit’s IP address and the time |
| DNS servers | When apps look up addresses, through the tunnel | The domain names your routed apps look up. They go to your provider’s DNS server (for NordVPN, Threat Protection Lite is on by default), the DNS server in your config, or Quad9 (9.9.9.9) for Shadowsocks servers, Tailscale exit nodes and WireGuard configs that don’t name a DNS server. Apps set to Direct use your phone’s normal DNS |
| Tailscale, or your own Headscale server, and Tailscale’s relays | Only if you turn Tailscale on | What any Tailscale client sends, including a device name for your tailnet. Tailscale’s built-in code may also run its own connection checks (for example with Google) and use encrypted DNS services. See Tailscale’s privacy policy |
| M-Lab (locate.measurementlab.net and its test servers) | Only when you start a speed test, after you agree once | See “Speed test” below |
| Google Play | Google Play version only | See “Google Play version” below |
We add no analytics, crash reporting or advertising, and the app makes no update checks of its own. The Google Play version includes Google’s code, explained below.
Statistics (off by default)
If you turn on Stats, the app keeps on your phone: data used per exit per hour (kept 8 days); data used per app, per exit and per VPN server per day (kept about 13 months); peak speeds; when the VPN was on or paused; and your speed tests (the last 100, kept up to about 13 months). These statistics do not contain your messages or page contents. Saved usage statistics are not uploaded. Turn Stats off to stop new statistics; Settings → Statistics → Delete saved history erases saved statistics. The separate domain table can still record looked-up domains with Stats off and is not cleared by that button. M-Lab separately receives and publishes speed-test results.
Speed test
A speed test runs only when you start it and normally uses your chosen exit. The app asks for permission before your first test and remembers your choice. Read M-Lab’s privacy policy before testing. To stop sending test data, do not start further tests. Clearing app storage resets the saved permission but cannot remove results already published by M-Lab. The app asks M-Lab’s locate service for a test server in that exit’s country, sending the app’s name and version and the exit’s country code. It then measures ping, download and upload with real data.
M-Lab is an open research platform. It publishes every test’s results, including the IP address it sees, as open data that is kept indefinitely. Normally that’s the address of the exit you tested: the VPN server’s address, or your home address if you test a Tailscale exit node at home. If routing goes wrong during a test, it could be your own address. Testing a Tailscale exit node temporarily changes the exit node this phone uses. The app allows 40 tests a day.
Google Play version
The Google Play version includes Google’s Play Billing library for optional one-off tips. It starts a connection to Google Play when the app launches, even if you never tip. It also checks tip prices and unfinished purchases when you open or return to Settings. There is no Play subscription. Google’s library may send technical information under Google’s privacy policy.
If you leave a tip, Google handles the payment. The app receives the tip’s product, price, a purchase token and whether it went through. It keeps only a note that you tipped, so it can say thank you. We don’t receive your card or bank details.
If you allowed your phone to share usage and diagnostics data with Google, Google may show us crash and performance reports for the app in Google Play Console. These are technical reports, such as device model, Android version and where the app crashed. They may still count as personal data. We use them only to find and fix problems.
The version from GitHub and F-Droid contains no Google code.
2. The website
unbraid.app is a static website hosted on Cloudflare Pages.
- We run no analytics, tracking or advertising, and set no cookies ourselves. Fonts and images come from the site itself.
- To deliver the site and protect it from abuse, Cloudflare processes the technical data your browser sends, such as your IP address, browser type and the page you asked for. If Cloudflare’s security systems suspect abuse, Cloudflare may show a short check that uses a security cookie. Cloudflare does this for us as our processor, under its data processing terms. We don’t receive logs of individual visitors.
- Affiliate links. We may use affiliate links to VPN providers and mark each one next to the link. If you follow one, the provider and its affiliate network ([TODO: e.g. Awin]) may identify us as the referrer and use cookies on their own sites under their own policies. We may receive sign-up and commission reports. [TODO: confirm with the network exactly which fields we receive and how long they’re kept.]
3. When you contact us
- Email. If you email us, we receive your email address, your message and anything you attach. Mail to unbraid.app addresses is forwarded by Cloudflare Email Routing, which doesn’t store the messages, to our mailbox at Google Workspace, which Google runs for us as our processor. We use it only to answer you.
- GitHub issues are public. Whatever you post there can be seen by anyone, under GitHub’s privacy statement. Never post keys, tokens or full configs.
4. When you donate
- GitHub Sponsors. GitHub handles the payment. GitHub shows us who sponsors us, the tier and the amount, and whether it’s monthly or once. Which contact details GitHub shares with us depends on GitHub’s settings. GitHub’s privacy statement applies.
- Tips in the Google Play version. Google handles the payment. Google Play shows us order details such as order number, product, price, date and country, and lets us look up an order if you give us the email address you used. We don’t receive your card or bank details.
5. Why we use your data, and on what legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Website request data, through Cloudflare | To deliver the website and keep it secure | Our legitimate interest in running a safe website (Art. 6(1)(f)) |
| Emails and issue reports | To answer you and fix problems | Our legitimate interest in supporting our users (Art. 6(1)(f)) |
| Crash and performance reports in Play Console | To find and fix crashes | Our legitimate interest in a working app (Art. 6(1)(f)). You control sharing in your phone’s settings |
| Donation, tip and commission records | To receive and manage the money | Our legitimate interest in receiving support for the app (Art. 6(1)(f)) |
| The same records, as accounting records | To keep the accounts the law requires | Legal obligation (Art. 6(1)(c)) |
The table covers our website, support, diagnostic and payment records. Where we rely on legitimate interest, you can object at any time (see “Your rights”). The app separately asks before reading your installed-app list, recording statistics or starting your first speed test.
6. How long we keep it
| Data | How long |
|---|---|
| Emails | Up to 2 years after our last message, unless we need them longer for a legal claim |
| Crash and performance reports | As long as Google Play Console keeps them [TODO: check period]; we don’t copy them |
| Issue reports on GitHub | Public until you or we delete them |
| Affiliate reports | [TODO: period from the network]; commission statements as accounting records, below |
| Website request data | We keep none. Cloudflare keeps its own security logs for a limited time under its policy |
| Accounting records of donations, tips and commissions | 7 years, as Dutch tax law requires |
| Data on your phone | Until you delete it in the app, clear the app’s storage, or uninstall (see above) |
7. Who else is involved
We don’t sell or rent personal data and don’t share it for advertising. Apart from the services you choose to use through the app, the only parties involved are: Cloudflare (website hosting and email forwarding, as our processor), Google Workspace (our mailbox, as our processor), GitHub and Google (donations, tips, crash reports and issue reports, under their own policies), the affiliate network, and our accountant and the tax authorities for bookkeeping.
Cloudflare, GitHub and Google are based in the United States. Cloudflare says its transfers rely on its EU-US Data Privacy Framework certification, with the European Commission’s standard contractual clauses as a fallback; GitHub and Google describe their own safeguards in their privacy statements. [TODO: check the live Data Privacy Framework list before launch.] Email info@unbraid.app if you’d like more detail on these safeguards.
8. Your rights
Under the GDPR you can ask us to see, correct, delete or export the personal data we hold about you, to restrict its use, or object to it. Write to info@unbraid.app. We answer within one month. We may ask you to confirm it’s really you.
We cannot look up the app’s local data on a server of ours. We may process website data through Cloudflare, messages, public issues, payment and commission records, and Google reports. Use the app or Android settings to manage local data as explained above. Contact an outside service about its own use of your data. Send requests about processing under our control to info@unbraid.app.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.
We make no automated decisions about you and do no profiling.
Visiting the website needs the connection data your browser sends. Everything else is up to you: emailing us and donating are optional. Without an email address we can’t answer you.
9. Children
un/braid is a general networking tool and is not aimed at children. Children may contact us with help from a parent or guardian. We handle those messages under this policy.
10. Security
Saved account and setup files (your logins, keys and recent tunnels) and your Tailscale state are encrypted on your phone with a key that stays in the Android Keystore. Statistics and the domain table are not encrypted by the app; Android keeps them private to the app. Connections to providers use HTTPS, and tunnels use WireGuard, OpenVPN or Shadowsocks encryption. The code is public, so anyone can check how it works. No system is perfectly secure. If you find a weakness, tell us privately at info@unbraid.app.
11. Risks and outside services
This policy explains data handling. It is not a guarantee that data can never leak or be exposed. Software faults, compromised devices, networks and outside services can cause failures.
Independent providers have their own privacy policies. Read them before use. Services that process data for us are identified above.
Our terms, including sections 11 to 13, explain warranty and liability limits. Nothing in this policy or those terms takes away your GDPR rights.
12. Changes
When the app or this website changes how data is handled, we update this policy and the date at the top. Earlier versions stay in the website’s public history. We’ll also mention important changes in the app’s release notes.
13. Contact
info@unbraid.app · Quiet Crafts, Rotterdam, the Netherlands