Effective date: April 30, 2026 · Last updated: April 30, 2026

Privacy Policy

VPN Luck is built around one promise: your data stays on your phone. This policy explains, in plain terms, how the app handles information and what rights you have under U.S., EU, and UK law.

1. Who is responsible for your data

VPN Luck is published by LEX ROAD DESIGN, SRL ("we", "us", "our"). This policy applies to the iOS application "VPN Luck" available on the Apple App Store and to this website (vpnluck.com).

If you have a privacy question or want to exercise a privacy right, write to support@lexroad.store.

2. What information we collect

From the app: nothing. The VPN Luck iOS app does not collect, store on our servers, or transmit to us any personal data, usage data, advertising identifiers, or device identifiers. There is no account creation, no email collection, and no telemetry SDK in the binary.

From this website: standard server logs. When you visit vpnluck.com, the hosting provider may temporarily record an IP address and a User-Agent string for security and uptime monitoring. We do not use cookies for tracking, do not run analytics scripts, and do not run advertising pixels on this site.

From email correspondence with us: only what you write. If you email support@lexroad.store, we receive your message, your email address, and any attachments you include. That is the entirety of the data we hold from a support exchange.

3. How that information is used

Because the app collects nothing, there is no app-side use to describe. Information from email correspondence is used only to reply to your message and resolve your request. We do not aggregate, profile, sell, or analyse it for marketing.

4. Sharing with third parties

We do not share, rent, sell, or trade information with third parties. We do not have advertising partners. We do not have analytics partners.

The app uses Apple's NetworkExtension framework to operate the VPN tunnel. Apple's framework runs entirely on your device. We do not transmit anything to Apple ourselves; Apple's relationship with you is governed by Apple's own privacy policy.

Email correspondence is handled by mail providers we use to receive messages at support@lexroad.store. These providers can read message contents only to deliver them; they are not authorised to use them for any other purpose.

5. How the VPN tunnel works

VPN Luck establishes an encrypted IKEv2 tunnel using AES-256-GCM for confidentiality, SHA-256 for integrity, and at least MODP-2048 for key exchange. The handshake and tunnel are managed by iOS, in a process separate from the app. While the tunnel is active, your traffic exits the internet at the IP address of the VPN server you selected, not your local IP.

We do not log traffic. Servers are configured to not record source IP, destination IP, DNS queries, or session contents. Aggregate connection counts and bandwidth totals are recorded for capacity planning only and cannot be linked to a specific user, because we have no user identifiers.

6. Data stored on your device

The app keeps the following on your device only — never on our servers:

• Selected country and favourites — iOS app preferences (UserDefaults)
• Local handshake history — last 24 hours of session timestamps for in-app troubleshooting
• Mine Rush game progress and Splits ledger entries — local SwiftData store
• Your kill switch, auto-connect, biometric lock, and other preferences

Deleting the app removes all of the above. There is no cloud copy.

7. Security of your information

The encryption used for the VPN tunnel is industry-standard (AES-256-GCM / SHA-256 / MODP-2048+). The iOS app is sandboxed by Apple and complies with Apple's App Transport Security requirements. Because the app does not transmit personal data to us, the surface for a data breach affecting users is effectively zero.

The app declares ITSAppUsesNonExemptEncryption = NO in line with Apple's encryption export policy, since we use only standard cryptography exempt under EAR §740.17 and §742.15(b)(4).

8. How long we keep data

App data: indefinitely on your device, until you delete it or uninstall the app. Nothing is sent to us.

Email correspondence: kept for up to 24 months for support history, then deleted, unless a longer period is required to resolve a complaint or to comply with law.

Server logs from this website: discarded within 30 days.

9. Children's privacy

VPN Luck is not directed at children under the age of 13 (or 16 in the European Union, where Member States have set that higher age under GDPR Article 8). We do not knowingly collect personal data from children. If you are a parent or guardian and believe a child has somehow shared personal data with us, write to support@lexroad.store and we will delete it promptly. The app itself does not collect personal data, so the surface area for children's privacy is minimal.

10. California residents (CCPA / CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have specific rights:

• Right to know — what personal information we have collected about you
• Right to delete — request deletion of personal information we hold
• Right to correct — request correction of inaccurate personal information
• Right to opt out of sale — we do not sell personal information; this right is automatic
• Right to non-discrimination — we will not penalise you for exercising any right

Because the app collects nothing, a "right to know" request will return an empty record. Email exchanges remain the only personal data we hold for a given user. To exercise any right, write to support@lexroad.store and we will respond within 45 days.

11. EU and UK residents (GDPR / UK GDPR)

Under the General Data Protection Regulation (and UK GDPR), EU and UK residents have the rights listed below for any personal data we hold:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to lodge a complaint with a supervisory authority (Article 77)

The legal basis we rely on for processing email correspondence is consent (Article 6(1)(a)) — by writing to us, you consent to our reading the message to reply.

Because the app collects no personal data, almost every GDPR right resolves to a confirmation that we hold nothing. To exercise a right, write to support@lexroad.store.

12. International data transfers

The VPN tunnel itself routes your internet traffic through the country you select in the app. This is not a "data transfer" in the GDPR sense — your traffic is encrypted end-to-end between the app and the chosen VPN server, and the choice of routing is yours. The traffic exits the tunnel at the chosen country and is then subject to the routing of the open internet from that point onward.

Email correspondence may be processed by mail-relay infrastructure located in the European Union or the United States. Where transfers occur, they rely on Standard Contractual Clauses or equivalent safeguards required by the GDPR.

13. Your rights and choices

You can:

• Delete the app at any time — that erases all on-device data
• Disconnect or remove the VPN configuration in iOS Settings → General → VPN & Device Management
• Email support@lexroad.store to ask what we hold (only your prior emails to us, if any)
• Email support@lexroad.store to request deletion of email correspondence

14. Changes to this policy

If we materially change this policy, we will update the "Last updated" date at the top and post the new version at vpnluck.com/privacy/. The version bundled in-app under Settings → Privacy paper is updated with each app release.

15. How to reach us

This policy is written in English and is the controlling version for any dispute over interpretation.