Privacy Policy
Effective August 13, 2026 · LockMyIP for Android
LockMyIP is a VPN. The whole point is to keep your traffic out of other people's hands, so collecting a lot about you would defeat it. This page says exactly what we hold, what we do not, and who else is involved — in plain terms, not by omission.
We do not log your activity. Not the sites you visit, not your DNS queries, not the contents of your traffic, and not how much of it there is per person. Those records are not kept because they are never created.
1. No account, ever
There is no sign-up. No email address, no phone number, no name, no password. When you first open the app it registers itself anonymously and receives credentials.
Your device generates a random identifier for itself. It is not your Android ID, not your advertising ID, and not derived from any hardware serial — it is a fresh random value, stored encrypted on the device, and it is discarded when you uninstall.
2. What is stored on our servers
| Data | Why it exists |
|---|---|
| Anonymous account id | A random identifier for the account. It is not linked to any personal detail because we hold none. |
| VPN credentials | A WireGuard key pair, a tunnel address and a protocol id. Without these the tunnel cannot authenticate you. |
| Your device identifier | The random value above, so a server can be reserved for this device and plan limits applied. |
| Which server, and when | The node last assigned to your device and the time of that assignment, so capacity is shared fairly. This records that you connected, never what you did. |
| Plan and expiry | Free or VIP, and the Google Play purchase token if you subscribe. |
Our VPN nodes report only aggregate health to us — processor load, total bandwidth, and how many tunnels are currently active. Those numbers are not attributed to individual users, and the node keeps no record of the traffic passing through it.
Your IP address
To hand you a server, our API necessarily sees the address you are connecting from. It is not stored in our database — there is no column for it. Like any web service, the server that receives the request writes short-lived operational logs that can include it, kept for diagnosing faults and abuse and not used to build a profile of you.
3. What stays on your device and never reaches us
- Your list of installed apps. The "Apps that skip the VPN" screen reads it to draw the list, and your choices are saved locally. Neither the list nor your selection is ever transmitted.
- Your settings — protocol, kill switch, auto-connect, chosen location.
- Crash files. The app writes a local crash log so a problem can be diagnosed on a device with no network. Those files stay on the device unless you send them.
4. Other companies involved
The app uses services from Google. Each one receives only what it needs, and each is governed by Google's own privacy policy in addition to this one.
| Service | What it is for |
|---|---|
| Firebase Crashlytics | Crash reports: the fault, your device model and Android version. Essential for fixing a VPN client that fails on hardware we do not own. |
| Firebase Analytics | Aggregate usage. Advertising-ID and device-ID collection are switched off in this app, deliberately. |
| Firebase Cloud Messaging | Service and account notifications. It issues a push token for the installation. |
| Firebase Remote Config | Lets us adjust free-plan limits without shipping an update. It sends settings to the app, not data about you to us. |
| Google AdMob | Ads, shown to free users only. VIP users see none. AdMob collects data under its own policy. |
| Google Play Billing | VIP subscriptions. We never see your card details; Play handles payment and tells us only that a purchase is valid. |
One thing you should know about ads. Traffic from the advertising and analytics services above leaves your device over your ordinary internet connection rather than through the VPN tunnel. Ad networks require it — an advertising request arriving from a datacentre in another country gets the account terminated. It means those specific requests are not covered by the tunnel. Everything else on your device is.
VIP removes the ads, and with them that traffic.
5. How long we keep things
Your account and its credentials exist for as long as the account does. Server assignment records are short-lived operational state, replaced each time you connect. Operational server logs are retained briefly and then discarded.
Uninstalling removes everything held on the device, including your credentials. To have the server-side record deleted as well, write to [email protected] from any address — since the account is anonymous, please include the identifier shown in the app so we can find the right one. We will confirm when it is gone.
6. Children
LockMyIP is not directed at children and we do not knowingly collect anything from a child under 13.
7. Changes to this policy
If this policy changes in a way that affects what we collect, we will update the date at the top and announce it in the app before the change takes effect. Material changes will not be applied retroactively to data already collected.
8. Contact
Questions, deletion requests, or anything about this policy: [email protected].