In short
- There is no sign-up. We don't know your name, email or phone number. An account is created when you tap "Get started" and is tied to that iPhone. You only see it as an ID of 8 letters and digits.
- We don't store browsing history, traffic contents, DNS queries, or the time and duration of your connections.
- We store only what the service can't work without: a device identifier, the account and its ID, free trial records, the access term and payment history. The full list is in section 3.
- VPN servers are provided by our partner H1Cloud. From us it receives only a random client name, the connection key and the access term. As the server operator it technically sees the IP addresses of connections - details in section 6.
- You can delete your account and data in the app: Settings → Subscription → "Delete account".
- We do not sell data or share it for advertising.
1. Who we are
The Rubin VPN service - the Rubin VPN app, the VPN servers we provide together with a partner, our control server and the website rubinvpn.com - is provided by TOPMEDIA LLC, Republic of Armenia ("we"). We decide what data is processed and why, and we are responsible for protecting it.
Address: Apt. 23, Bldg. 41, 4th Microdistrict, Abovyan 2202, Kotayk Province, Republic of Armenia.
For any question about data, write to support@rubinvpn.com.
2. Scope
This policy describes how we handle data when you use the Rubin VPN app for iPhone, the VPN servers, our control server and this website.
3. What data we store
Our control server stores the following - and nothing else:
| Data | Why | How long |
|---|---|---|
| Device identifier | A random string the app creates on the phone and keeps in its secure storage (Keychain). Not linked to your name, email, phone number or advertising identifier. The server uses it to recognise the phone and issue its settings. It is the key to your access, so we never show it to anyone - it is not visible in the app either. | While the phone uses the service, see section 9 |
| Account and its ID | The server creates an account when you tap "Get started": one phone - one account. The account has an internal number (no one but the server sees it) and an ID of 8 letters and digits - in the app it is the "Device ID" row in Settings. The ID alone can't be used to do anything: you give it to support and enter it when transferring a subscription. We store which phone the account is linked to, until when access is paid and whether the account is blocked. | Until you delete the account, see section 9 |
| App Store app identifier | A number the App Store assigns to your Apple Account for our app (appTransactionId), and the environment (regular or test). We receive it only in a form signed by Apple and verify the signature. It contains no name, email or other Apple Account data. Needed so the free trial is given only once per Apple Account. | See section 9 |
| Free trial | The trial start date for that App Store identifier. Needed so the three free days cannot be taken again. | Indefinitely, see section 9 |
| Payments | For each payment in the app: our order number, the payment number at the payment service, the term paid for, the amount and currency, the status, the date and whether the days were credited. You can see these records yourself: Settings → Rubin VPN Plus → "Payment history". They contain no bank card or account details (section 4). | Paid ones - as long as accounting law requires; unpaid ones - 90 days |
| Subscription transfer request | When you transfer a subscription to a new phone: which account is being transferred, which phone is asking and how many wrong code attempts there were. The 6-digit code itself is not stored: the server recalculates it when checking. | 10 minutes, then deleted (within an hour at most) |
| Account log | When the subscription was transferred to or from another phone: the time of the transfer, the account ID of the other phone and the date until which access was paid. And when support changed the access term or the account block by hand: the time, the old and the new value. Needed to sort out questions about access and to show the old phone that the subscription was transferred. | While the account exists; after the account is deleted - within a day at most |
| Connection to H1Cloud servers | The client name at our partner - r_ and 10 random characters, with no account number or ID; the connection key (a random UUID); the access term we set at the partner; a service link to the server settings. Without them the partner's servers won't let your phone in (section 6). | While the account exists |
| First and last request date, app version | The last request time is rounded to the hour. Needed to know the phone is active, delete records of inactive phones and send compatible settings. | Together with the device identifier |
| IP address when contacting the control server | Only as an irreversible fingerprint (HMAC); the address itself never enters the database. Needed for rate limiting and protection against guessing IDs and codes. | No more than 25 hours |
Legal basis: this data is necessary to provide the service you chose to use, to accept payment and to protect the service from abuse.
On the phone the app keeps the device identifier, the internal account number and the most recent server settings (they include the connection key) in the Keychain secure storage, so it can connect even when our server is unavailable. The account ID, the selected country, the theme and routing settings are kept in the app's regular storage. Routing settings are never sent to our server.
Request logging at our hosting provider is turned off. Only error records are kept - without IP addresses and without device identifiers.
If you contact support, we see your email address or Telegram name and what you wrote. We keep the conversation only to answer and fulfil your request and use it for nothing else.
4. Payments
Rubin VPN Plus is paid for in the app: the payment window is opened by a third-party payment service (bank card or instant bank transfer). The app has no App Store in-app purchases.
- You enter your card or banking app details with the payment service. We neither receive nor store them.
- We give the payment service only our random order number, the amount and the payment description ("Rubin VPN, 30 days of access"). It receives no account number, ID or device data from us - our server links the payment to the account.
- From the payment service we receive the payment number, the amount and the status.
- We do not ask for an email or other contact details at payment. If the payment service asks for them on its side, for example for a receipt, only it receives them and handles them under its own rules.
- Each payment is one-time; there are no automatic charges.
- We keep payment records for as long as accounting law requires - including after the account is deleted.
5. What we don't store
- Websites, addresses and domains you visit.
- The contents of your traffic and DNS queries.
- The time and duration of connections.
- Your IP address (only a fingerprint for 25 hours, section 3).
- Routing settings - they stay only on your phone.
- Name, email, phone number, bank card details, advertising identifiers.
- Location, contacts, photos or any other data from the device.
What the partner that runs the VPN servers technically sees is described in section 6.
6. Your traffic and VPN servers
The VPN servers for Rubin VPN are provided by our partner, H1Cloud. It runs the servers and the software on them, and our control server tells it who has access and until when. The server countries are the ones you see in the list in the app.
When the VPN is on, traffic goes from your phone to the server over an encrypted connection (TLS 1.3, X25519 key exchange), and from the server to the internet. The server decrypts the connection only to pass the data on. Websites using HTTPS remain encrypted for the server as well.
What H1Cloud receives from us: the client name (r_ and random characters), the connection key and the access term. Nothing else: no device identifier, no account ID or number, no payments, no Apple data.
What H1Cloud sees itself as the server operator:
- the IP address your phone connects to the server from;
- the traffic volume for the connection key;
- service lines that the server software prints about connections: time, client IP address, destination address and client name. We keep connection log recording turned off in the server control panel, but the software's service output is visible to H1Cloud, and H1Cloud decides how long it is kept.
This information does not reach us: we don't receive, store or request it. And H1Cloud receives nothing from us that would link the connection key to your account: the client name and the key are random, and the link between them and the account exists only in our database.
The app has no ads, analytics or trackers.
7. This website
The website rubinvpn.com uses no cookies, counters, analytics or ads and loads no fonts, scripts or images from third-party servers. There are no forms on the site - we ask you for nothing.
The site is hosted on Google (Firebase Hosting) infrastructure. Like any host, the provider technically processes the IP address and request data to deliver the page and protect the site from attacks. We don't use this data to track visitors.
8. Third parties
We do not sell user data or share it for advertising. We don't use it for profiling or tracking and don't combine it with data from other sources.
Some of the work is done for us by other companies. Each receives only what it needs for its part:
- H1Cloud - VPN servers (section 6);
- a third-party payment service - accepting payments (section 4);
- Cloudflare - our control server and database; like any host, it technically processes the IP address of a request;
- Apple - the App Store and the signed app identifier (section 3);
- Google (Firebase Hosting) - this website; an email provider - support emails; Telegram - if you write to us there.
We have no browsing history, traffic contents or connection times, so we cannot hand them over to anyone under any request.
9. Retention
- IP fingerprint - no more than 25 hours, then deleted automatically.
- Subscription transfer request - 10 minutes, then deleted (within an hour at most).
- Account log (subscription transfers, manual changes of the term and the block) - while the account exists; after the account is deleted it is removed within a day at most.
- If a phone hasn't contacted the server for 180 days, its record is deleted automatically - except a phone whose account has active paid access.
- If a phone is silent for 30 days, its link to the App Store identifier is removed.
- An account that was never paid for is deleted automatically 180 days after creation if no phone is linked to it. An account that was paid for is kept until you delete it: you can return to your paid time from a new phone too - by transfer or through support.
- The client at H1Cloud exists while you have access: when the term ends, H1Cloud deletes it itself. After the account is deleted, we delete it right away, or within an hour if H1Cloud didn't respond at that moment.
- Payment records: paid ones - as long as accounting law requires, including after the account is deleted; unpaid and cancelled ones - 90 days.
- The trial start date for an App Store identifier is kept indefinitely. It is one date and one number, with no name or email. Without this record the three free days could be taken again endlessly.
- After a device record is deleted, an irreversible fingerprint of its identifier, the first request date and a block flag remain. The identifier cannot be restored from this fingerprint, and it is impossible to tell whose device it was.
Deleting the app does not by itself delete data on the server. The device identifier and internal account number stay in iOS secure storage, so after reinstalling and tapping "Get started" the phone returns to its account.
10. How to delete your data
- In the app: Settings → Subscription → "Delete account". The account and its ID, paid time and the phone's link are deleted immediately; the app erases the server settings from the phone; we delete the client at H1Cloud right away (within an hour at most); the phone's record is deleted after a day. Paid time is lost - the app warns about this before you confirm.
- Only payment records (required by accounting law), the trial start date and the deleted-device marker remain (section 9).
- There are no automatic charges, so nothing needs to be cancelled after deletion.
- If the app is already deleted, write to support@rubinvpn.com with your account ID - we will delete the data manually within 30 days, usually much sooner. If you didn't keep the ID, install the app again on the same iPhone and tap "Get started": the phone returns to its account, the ID is in Settings, and you can delete the account yourself.
11. Your rights
At any time you can ask what data we have about you, request correction or deletion, and withdraw consent to processing by stopping using the service and deleting the account. Write to support@rubinvpn.com and include your account ID.
If you believe we are violating your rights, you can contact the data protection authority of your country.
12. Security
The connection between the app and the control server is protected by TLS; the server's responses are signed and the app verifies the signature. The App Store identifier is accepted only with a verified Apple signature. The subscription transfer code is not stored in the database. Only the service's developers have access to the database and the control server. The main protection is minimal data: what we don't have cannot be stolen or disclosed.
13. Children
The service doesn't ask for age and doesn't collect data that could identify a person - neither from adults nor from children.
14. Changes to this policy
A new version of the policy is published on this page with a new date. If changes expand the list of stored data, we will tell you in the app in advance.
The policy is published in Russian and English. In case of discrepancy, the Russian version prevails.
15. Contact
TOPMEDIA LLC, Apt. 23, Bldg. 41, 4th Microdistrict, Abovyan 2202, Kotayk Province, Republic of Armenia
Data questions: support@rubinvpn.com
Support on Telegram: @rubin_vpn
General questions: info@rubinvpn.com