VPN-first use
Zaylo uses account, device, subscription, and VPN credential data to provide the VPN service and support users.
Privacy Policy
How Zaylo VPN handles user data.
This policy explains what Zaylo VPN collects, how it is used for the VPN service, what is shared with providers, and how users can request deletion.
Traffic commitment
Zaylo does not sell user data, use it for advertising, or disclose browsing history, DNS queries, or traffic content to third parties.
Payments stay with processors
Card and wallet details are handled by Stripe, Apple App Store, Google Play, or the payment provider shown at checkout.
Contact and deletion
Privacy requests, account deletion, and data questions can be sent to [email protected].
Scope
This policy applies to the Zaylo VPN website, app, APIs, and VPN service.
Android is the current available app. iOS, macOS, and Windows are planned and will be covered by this policy when released unless a platform-specific notice says otherwise.
1. Data Zaylo collects
Zaylo VPN collects the data needed to create accounts, validate subscriptions, register devices, provision VPN access, support users, and protect the service.
Account and sign-inEmail address, account ID, email sign-in challenge records, session token hash, account status, and timestamps.
Device registrationDevice name, platform, optional app version when provided by the app, registered device count, device ID, a one-way hash of a device identifier the app derives from a platform value that persists across app reinstalls (used to recognize the same device after reinstall and enforce your plan's device limit), active or revoked status, and related timestamps.
Subscription and billingPlan, entitlement status, billing interval, trial and renewal dates, cancellation state, Stripe customer and subscription identifiers, Apple or Google product and transaction identifiers when those app stores are used, and payment event status.
VPN provisioningVPN credential IDs, route IDs, provisioning status, provider IDs required to create or revoke VPN access, VLESS or subscription URLs assigned to a device, and related provisioning attempts.
Support and emailMessages you send to support, sign-in and service email delivery records, provider message IDs, and the email address used to reply to you.
Website tools and request metadataThe public IP tool returns the IP address exposed by your current request and does not store that result in the tool. Standard hosting, security, and application logs may process request metadata needed to operate and protect the site.
2. VPN traffic and service data
A VPN connection must process network packets in real time to route traffic from your device to the selected VPN endpoint. Zaylo VPN does not store, log, or monitor your VPN browsing history, destination IP addresses, DNS query history, or traffic content. All packet routing is processed in-memory in real time and is not written to persistent storage.
In compliance with Apple App Store Review Guideline 5.4, Zaylo commits that VPN service data is not sold, used for unrelated purposes, or disclosed to third parties for independent use. We do not share VPN service data with ad networks, data brokers, or any other third parties.
Zaylo does not claim that a VPN makes you anonymous. Websites, apps, payment providers, operating systems, and networks may still collect information according to their own policies.
3. How Zaylo uses data
- Authenticate accounts and issue app sessions.
- Confirm active subscriptions, trials, cancellations, and device limits.
- Register devices and provide the correct VPN profile for the selected entitlement.
- Provision, suspend, revoke, or troubleshoot VPN credentials.
- Send sign-in, support, billing, and service messages.
- Operate checkout, billing portal, webhook fulfillment, and account administration.
- Protect the service from fraud, abuse, security incidents, and policy violations.
- Comply with applicable law, app store requirements, payment obligations, and valid legal process.
4. Service providers and sharing
Zaylo does not sell personal data. Zaylo does not use ad networks or data brokers. Zaylo shares limited data with service providers only when needed to operate the service, process payments, send account messages, maintain infrastructure, or comply with legal obligations. These service providers act strictly as data processors under our instructions and are prohibited from using or sharing user data for any other purpose. We do not disclose any user data to third parties for independent use.
Payment providersStripe for website checkout and billing portal. Apple App Store or Google Play may process purchases when Zaylo distributes paid subscriptions through those stores.
Email providerPlunk or a replacement email processor may process sign-in and support email metadata to deliver account messages.
Hosting, database, and security providersInfrastructure providers may process data needed to host the website, APIs, database, server logs, backups, and security controls.
VPN infrastructure and provisioningVPN server and provisioning systems process only the operational data needed to create, route, suspend, or revoke VPN access for your account and device.
Legal and safetyZaylo may disclose limited information when required by law, to protect users or the service, to investigate abuse, or as part of a business transfer with legally adequate notice.
5. App store privacy disclosures
Zaylo will keep Google Play Data Safety answers, App Store privacy labels, and in-app privacy disclosures consistent with this policy. Store labels may summarize data categories differently because Apple and Google use their own disclosure taxonomies.
Android VPN builds that use VpnService must include a separate in-app VPN disclosure and affirmative consent flow before the VPN permission is used. Any future iOS VPN app must include the required pre-use VPN data declaration before purchase or service use.
6. Security
Zaylo uses HTTPS for website and API transport, hashes email sign-in challenges and session tokens before storing them, keeps server-only secrets out of client components, and limits operational access to systems that need it. No internet service can guarantee perfect security, so users should protect their devices, email accounts, and account sessions.
7. Retention and deletion
Account, subscription, device, VPN credential, provider event, and audit records are kept while needed to provide the service, support billing, resolve disputes, prevent abuse, and meet legal or tax obligations. App sessions currently expire after about 30 days.
You can request account deletion at any time. You can request deletion directly within the Settings tab of your web dashboard at zaylovpn.com/account, by submitting a support request, or by emailing [email protected]. When a dashboard or app request is received, Zaylo stops new app sessions, device registration, and VPN profile access while keeping limited web access available for billing, support, and deletion status.
Zaylo will permanently delete or de-identify account records, registered devices, and VPN access credentials within 30 days after the request becomes eligible, unless retention is required for security, fraud prevention, billing, tax, or legal compliance (such as Stripe payment records and invoices as explained in Section 4). Active subscriptions must be canceled through the payment provider or app store before account deletion can complete.
8. User choices
You can stop using the VPN by disconnecting in the app, revoke a device by contacting support, cancel billing through the billing provider, or request account deletion. If the app asks for a platform permission, you can deny or revoke that permission in your operating system settings, but some VPN features may stop working.
9. Children
Zaylo VPN is not directed to children. If you believe a child has provided personal data to Zaylo without appropriate consent, contact [email protected].
10. Changes
Zaylo may update this policy as the service, apps, providers, or legal requirements change. Material changes will be reflected on this page and, when appropriate, in the app or by email.
Need privacy help?
Email [email protected] or use the support center for account, deletion, billing, or app privacy questions.