Legal
Last updated: 8 October 2026
This policy explains what Onions VPN does and does not do with your information. It is written to be read, not to be skimmed past.
Onions VPN is built so that we cannot see what you do with it. We do not operate accounts, we do not run advertising or analytics SDKs, and we never receive your browsing activity, DNS queries, or the sites you visit. There is no user database to hand over because there is no user database.
Everything the app needs to remember is written to your own user profile and never transmitted:
You can erase all of it at any time by uninstalling the app or deleting its folder under %APPDATA%\Onions VPN. Uninstalling removes the settings; it cannot remove what was never collected.
These requests are signed so they cannot be forged or replayed by a third party. If you never purchase a plan, none of them are sent.
Payments are processed by PayFast, a third-party payment gateway, not by us. PayFast handles your card or bank details under their own privacy policy and PCI-DSS compliance. We never see or store your full card number, CVV, or bank credentials. We receive only the transaction result, the amount, the currency, and the reference used to confirm the order.
Onions VPN routes traffic through the Tor network, which is designed to remove identifying information from the network layer. Your ISP or network operator can see that you are connecting to a Tor relay but cannot read the contents of the connection or your destination. Because Tor circuits deliberately involve multiple independent relays, no single relay — including ones run by us — can see both your address and your destination.
The app requests run full trust because a VPN must be able to configure the Windows system proxy and firewall rules in order to route traffic. It only writes those settings while a connection is active and restores your previous settings when you disconnect. It does not read your files or install background services beyond its own process.
Diagnostic logs are kept for a short period only for troubleshooting and are not linked to an identity. License records are retained for as long as a purchase may still need support or a refund, and are deleted on request. We do not maintain any behavioural profile to retain in the first place.
Onions VPN is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.
Because we hold almost nothing about you, there is very little to export or delete. You can request a copy of any license record associated with an email address used for a purchase, correct it, or have it erased, by contacting us. Depending on where you live, privacy laws such as the GDPR or POPIA may give you additional rights over any data we do hold, and we will honour them.
Activation traffic is signed with a keyed HMAC to prevent tampering. We do not claim to be infallible: if a breach ever affects data we hold, we will notify affected users and describe what was taken.
If this policy changes materially we will update the date at the top and, for the Microsoft Store listing, ship an updated version of the app. Continuing to use the app after a change means the revised policy applies.
Questions, requests, or corrections: privacy@onionvpn.vercel.app — or reach us through the support link on the Microsoft Store listing for Onions VPN by Stuxeno.