Privacy Policy

Last updated 31 October 2026

Teal VPN is operated by Fxolio LLC, a Wyoming limited liability company (“we”, “us”). This policy explains exactly what we collect, what we deliberately do not collect, and why. It is written to be read, not to be survived.

1. What we collect

Account information

• Your sign-in identifier and email address. You sign in with Google, with Apple, or with an email address and a one-time code. From Google or Apple we receive the identifier they issue for you and the email address on that account — for Sign in with Apple this may be the private relay address Apple creates for you, which we treat like any other address. We do not receive your name, photo, contacts or password. If you sign in with Apple, we also keep, encrypted, a token Apple issues, so that when you delete your account we can tell Apple to disconnect Teal VPN from your Apple Account. For email sign-in we keep the address you typed; the one-time code is scrambled at rest and expires in ten minutes.
• An account number. A reference we generate so support can find your account. It is not a password and cannot be used to sign in.
• Your plan and account status (Free or Pro, active or closed).

Device information

• Your device’s public key. The matching private key is generated on your device and never transmitted to us. We could not produce it if asked.
• A device label, platform and app version (for example “Android” or “iPhone”), so you can recognise and remove your own devices, and so we can retire versions with known problems. The label is the device model, never a name you gave the device.
• A scrambled device code. The Free plan is one per person and per phone. To enforce that, and so that a phone that reinstalls the app or signs in again keeps its own device slot instead of using up a second one (on any plan), the app sends a one-way scrambled code derived from an identifier the phone gives to this app alone (on Android) or from a random value the app creates once and keeps to itself (on iPhone and iPad). We scramble it again with a secret key before storing it. We cannot turn it back into a device identifier, it is not an advertising identifier, and it is never used for tracking. It is kept only with the device’s record and removed with it.
• On iPhone, iPad, and Mac: Apple DeviceCheck — Free plan only. When a Free plan starts on an iPhone, iPad, or Mac, we ask Apple to set one “Free plan already used” mark for that device, using Apple’s DeviceCheck service. Apple keeps this mark for our app only; it survives reinstalling the app and erasing the device. We receive only yes or no — no device identifier, and nothing that identifies you. We do not store the one-time token the device uses to ask Apple.

Usage figures

• Total bytes transferred per account and per device, to enforce plan limits. This is a number, not a record of what was transferred or where it went.
• When a device’s registration expires, so devices that are no longer used are removed automatically.
• A flag if an account appears to be shared beyond its device allowance.
• Which connection port worked on which kind of network. Some mobile networks block certain ports. When a connection succeeds, the app reports the port and the network type (Wi-Fi, or the code of the mobile operator) so other people on that network connect faster. This is kept as a counter only. It is not linked to your account or device.
• Anonymous connection-quality statistics: which kind of connection worked or failed and for which of our server locations, roughly how long it took, the network type (Wi-Fi or mobile operator code), country and app version — sent every few hours without your account, device or IP address, rounded to the hour, deleted after 30 days.
• The country of the network you connect from: worked out from your IP address (or, on Android, from your SIM’s network), together with its provider number (for example ‘AS12389’), is remembered with your account for one day, so the app is placed on a server your network can reach. The IP address itself is not kept.
• Anonymous app-step counts: how many times each step in the Android app was reached (the welcome page, signing in, the first connection, the daily limit page, the Pro page, Google Play’s payment sheet and whether it ended in a purchase or a cancel) — counted per hour and app version, sent with the statistics above, without your account, device, IP address or country, deleted after 30 days.
• The ad an install came from (Android app from Google Play): when you installed Teal after tapping one of our Google ads, Google Play gives the app a click code for that ad. The app sends only that code and the install time to our server, once, after you sign in. We use it to tell Google Ads which of our ads led to a paid subscription, so we can measure our advertising. It is kept for 90 days.
• Google Analytics for Firebase (the Android app from Google Play and the iPhone app from the App Store): counts how the app is used — app opens, the steps listed above, purchases, app version, device model and the country — with a random app-instance ID, processed by Google for us. It never sees what you do through the VPN, and the data is not used to personalise ads. On Android the advertising ID is sent to Google so that Google Ads can match these steps to our own ads; the iPhone app never reads Apple’s advertising ID and never asks to track you. The website versions of the apps, the Mac apps and the PC apps do not contain it.
• Google Play and App Store versions: to see which of our ads work, these app steps (for example ‘first connection’), with the random app-instance ID above, may be shared with Google Ads outside the EU, the UK and Switzerland. On Android the advertising ID is used only for this matching. On iPhone, Google’s on-device measurement may compare a scrambled form of your sign-in email on the phone itself; the email is not sent for it. No personalised ads, and nothing about what you do through the VPN.

Used for a moment, never stored

• Your IP address and the country it resolves to are used while a request is being handled — to limit abusive request rates and to apply the country restrictions in our Terms of Service. The address is held in memory for at most about a minute for rate limiting and is not written to our database or our logs. Daily counters of new sign-ups and of sign-in code requests per network use a scrambled value that cannot be turned back into an address, and are discarded after a day.

Checking that the app is genuine

• The Android app may ask Google Play to confirm that it is the unmodified app, installed from Google Play, on a genuine device (the Play Integrity service). Google processes that request under its own privacy policy. We receive only the result, and we keep daily totals of results — nothing tied to your account.
• The iPhone and iPad app may ask Apple for the same confirmation (the App Attest service). We keep the public half of a key Apple certifies for that install and a counter; neither identifies you or your device to anyone else.

Cookies

The website tealvpn.com uses Google Analytics and the Google Ads tag to count visits, downloads and sign-ups and to measure our own advertising. In the EU, the EEA, the United Kingdom and Switzerland these tags run without cookies and without identifiers unless you agree; elsewhere they may set cookies for up to two years and, when you arrived from one of our ads, a first-party cookie with that ad's click code (90 days) so a later purchase can be credited to the ad. Cloudflare, which protects the site, may store a small security value when it checks that a visitor is human (Cloudflare Turnstile, before sign-in and support forms). The account page (account.tealvpn.com) uses only strictly necessary cookies: one that keeps you signed in, and two that last 10 minutes and protect a Google or Apple sign-in while it is in progress. None of them is used for tracking, so there is no cookie banner. You can delete them at any time in your browser.

2. What we do not collect

• We do not log the websites, services or IP addresses you connect to through the tunnel.
• We do not store the IP address you connect from.
• We do not log DNS queries. Name lookups are answered by the VPN server itself and are not written to disk.
• We do not inspect, record or store the contents of your traffic. It is encrypted between your device and the exit server.
• The Google Play version of the Android app uses the Android advertising ID only to measure our own ads (above); no advertising SDKs, no fingerprinting. The only analytics is Google Analytics for Firebase in the Google Play version, described above.
• We do not sell, rent or share personal information with data brokers or advertisers. Ever.

3. Payments

Teal Pro is bought through Google Play in the Android app and through the App Store in the iPhone and iPad app. Google and Apple handle your payment details under their own privacy policies; we receive a record that a purchase is valid (the product, its dates and a random tag we gave your account), so we can switch your plan on and off. We never receive or store your card number.

4. Why we are allowed to hold this

Where the GDPR or similar laws apply, we rely on: performance of a contract (running the account you created), and legitimate interests (preventing abuse and fraud, and keeping the service available to everyone). Where we rely on consent, you may withdraw it at any time.

5. How long we keep things

• Account and device records: for as long as the account exists. A device you stop using is removed automatically when its registration expires.
• When you delete your account (in the app, under Account → Delete account, or as described on our account deletion page): your account, devices and sign-in sessions are deleted immediately.
• One thing outlives deletion, briefly: if the account was on the Free plan, the scrambled device code keeps the amount of data used that day until the next daily reset, so that deleting and re-creating an account is not a way to refill the allowance. It carries no link to you, and it is deleted after that reset.
• On iPhone and iPad, Apple’s “Free plan already used” mark (see section 1) is kept by Apple, not by us, and is not removed when you delete your account: a device that has had a Free plan does not get a second one. It carries no link to you or your account.
• Purchase records we are legally required to retain, such as transaction records kept for tax purposes, are kept for the period the law requires. Deleting your account does not cancel a subscription: cancel it in Google Play or in your App Store settings first.

6. Who we share with

We use: hosting providers for our VPN servers (who necessarily carry the encrypted traffic, and cannot read it); Cloudflare, which carries requests to our website and account service; Google, for sign-in, for checking that the Android app is genuine, and for Google Play payments; Apple, for Sign in with Apple, for checking that the iPhone app is genuine, for the one-per-device Free plan mark (DeviceCheck), and for App Store payments; and Amazon Web Services, whose email service delivers the one-time code when you sign in by email, the single note when Teal Pro starts and our replies from support, and sees your address for that purpose only; Resend, a second email service, steps in only if Amazon cannot deliver. We do not give any of them your browsing activity, because we do not have it.

In the Google Play version, Google also processes the app statistics described in section 1 (Google Analytics for Firebase) and, outside the EU, the UK and Switzerland, uses them to measure which of our own ads work (Google Ads).

Our commitment. We do not sell, use or disclose any data we hold about you to third parties for any purpose other than running the service as described on this page. Each provider named above receives only what its part of the service needs and may use it only for that, under terms at least as protective as this policy.

We will disclose information if compelled by a valid legal order binding on Fxolio LLC. We can only ever produce what we actually hold, which is described above. We cannot produce browsing history, traffic contents or connection IP addresses, because we do not have them.

7. Your rights

You may request a copy of your data, ask us to correct it, or delete your account and its data. Deleting is immediate from the app (Account → Delete account); if you cannot use the app, see our account deletion page. You can also withdraw the permission you gave Google or Apple for sign-in in your Google or Apple account settings; when Apple tells us you have, every session and device on the account is signed out at once. For anything else write to support@tealvpn.com from the email address on the account. Depending on where you live you may also have the right to complain to a data protection authority.

8. Children

Teal VPN is for adults. It is not directed at anyone under 18, and we do not knowingly collect their personal information. If you believe a minor has created an account, contact us and we will delete it.

9. International transfers

We are a United States company and our servers are located in several countries. Using the service necessarily involves your data being processed in the country whose server you select, and in the United States.

10. Changes

If we change this policy in a way that materially affects you, we will post the new version here with a new date and, where appropriate, tell you in the app before it takes effect.

11. Contact

Fxolio LLC
Privacy enquiries: support@tealvpn.com
Abuse and legal notices: abuse@tealvpn.com