We wrote this to be read, not buried. Here's exactly what NebulaVPN does with data — and, more importantly, what it doesn't.
If you read nothing else, read this: NebulaVPN is built to collect as little as possible. We don't log your browsing, we don't sell your data, and we don't operate the servers you connect through. We use standard crash and analytics tooling to keep the app stable, and lightweight ads to keep it free. That's the whole story.
"No logs" gets thrown around loosely in this industry, so here's precisely what we mean:
We can make this promise credibly because we are not your VPN server provider. NebulaVPN is a smart client that connects you to a validated pool of publicly operated servers. Your encrypted traffic passes through infrastructure we neither own nor instrument. If we wanted to spy on you, we technologically couldn't — and we wouldn't want to anyway.
To keep the app running and improving, we handle a small amount of non-identifying technical data:
This matters for your privacy, so it's worth understanding. The servers NebulaVPN connects you to are operated by independent volunteers and organizations as part of a public community network — not by us. Our role is to test, score, and rank those servers every hour so you get the best, most reliable ones, and to build the app that connects you securely.
Because we don't operate the exit servers, we have no access to their internal logs — and they are outside our control. If you have concerns about what an individual community server might log, the responsible assumption with any free VPN is that the server operator could see connection metadata. That's why we encrypt your traffic and verify exit locations — but for the highest-threat privacy needs, a paid, independently audited VPN provider remains the stronger choice.
NebulaVPN is free because of ads, not data sales. We use established mobile ad networks and mediation partners to serve advertising. These partners may collect device identifiers (such as an advertising ID) and usage data for their own purposes — like measuring ad performance and preventing fraud — under their own privacy policies and applicable laws.
Here's what that means in practice:
If you'd prefer no ads at all, you can adjust your device's ad-tracking settings or limit ad personalization in your Google/Android privacy controls.
We rely on a few trusted, standard services to operate:
Each of these is governed by its own privacy policy. We encourage you to review them. We do not hand them your browsing data, because we don't have it.
NebulaVPN is not directed at children under 13 (or the equivalent minimum age in your region), and we do not knowingly collect personal information from them. If you believe a child has provided us personal data, contact us and we'll delete it.
Depending on where you live, you may have the right to:
Because we collect so little, exercising these rights is usually simple. Email [email protected] with your request and we'll respond within the timeframe the law requires. You don't need a lawyer to ask — a plain email works.
Your VPN connections use real OpenVPN tunnels with AES-256-CBC encryption and SHA-512 authentication. The app verifies each server's real exit country before trusting it, so you're not silently routed somewhere unexpected. No method of transmission or storage is 100% secure, but we use industry-standard protections and design the system to hold as little sensitive data as possible.
We may update this policy as the app evolves. When we do, we'll revise the "Last updated" date above and, for significant changes, surface a notice in the app or on this site. Continued use after a change means you're cool with the updated terms.
Privacy questions, data requests, or concerns? We want to hear from you.
We're a small team, but we read everything and take privacy seriously — it's the whole point of the app.