VLESS.io

Privacy Policy

Introduction

VLESS.io is operated by Flexus Systems LLC ("we", "us"), which decides how the personal data described in this policy is used. At VLESS.io, we are committed to protecting your privacy. This Privacy Policy explains what information we collect when you use our VPN service, why we collect it, how long we keep it and when we share it. We collect only what we need to provide, bill for, secure and support the service, and we do not record the full addresses of the websites you visit, the content of your traffic or your DNS queries.

What We Collect and Why

We collect the information below to provide the service, and we use it only for the purposes described here. We do not use it for advertising, and we do not track you across other companies' apps or websites.

Your account

Your email address; your name, if you give it to us (for example the name shared through Sign in with Apple or entered in your profile); your username and account ID; and a profile picture if you add one. If you sign in with Apple, Google or Telegram, we also receive the ID that service assigns to you and the profile details it shares, such as your Telegram username. We store your password only in hashed form, and your passkeys if you use them. We keep your language and billing country, the notifications we have sent you, and, for each signed-in session, the browser or app it belongs to and the IP address it was last used from. If you use teams or referrals, we keep the related usernames and invite links.

Why: to create and protect your account, sign you in, contact you about your account and the service, and link your devices and purchases to you.

Your devices

For each device you connect, we keep a device ID, the device type (for example iPhone or Android), the name you give it, an identifier for the app installation, whether the device is online and when it last checked in, and its push notification token if you allow notifications. When you sign in on another device with a one-time code, we briefly keep that device's model and IP address.

Why: to give each device its own VPN configuration, apply your plan's device limits, send the notifications you allow, and let you see and manage your devices.

Usage and metering

For each device, we record how much data it sends and receives, with timestamps and the server used, a running total of that data, and how long the device is connected each day. While a device is connected, our servers keep its IP address. We also keep the country your device last connected from (the country only, not the IP address) and the server location you choose.

Why: to charge for the service from your balance or plan, show you your usage, detect and stop abuse of our network, and offer servers and routes that work from where you are.

Purchases

Your balance and its history, invoices, and records of your payments and in-app purchases, such as App Store transaction IDs. We do not store your full card number.

Why: to add funds and deliver what you bought, keep accounting records, handle refunds and disputes, and prevent fraud.

Support requests and logs you send

When you contact support, we keep your messages and attachments (such as screenshots), your email address, name and Telegram username if you give them, and technical details the app adds to help us: the app version, platform, operating system version, device ID and server. If you choose to send logs from the app's Support screen, they can contain IP addresses and the names of servers your device connected to.

Why: to answer your request, investigate problems and improve the service.

Server logs and error reports

Our servers and apps write technical logs, which can include an IP address, your email or username, your account or device ID and request details, and error reports. Our error monitoring runs on our own servers. On our web app, an error report can include a masked recording of the page at the time of the error (text and media are hidden). Our VPN servers keep short-lived technical logs (14 days) that may include a shortened, masked form of the address you connect to, such as its first letter and domain ending. These logs do not include your IP address or account, so they cannot be used to identify you.

Why: to keep the service running, fix errors and protect the service against attacks and abuse.

What We Do Not Collect

We do not record:

  • The full addresses of the websites, apps or services you use through the VPN
  • The content of your traffic
  • Your DNS queries

The exceptions are the masked addresses in our VPN servers' technical logs and a log you choose to send to support, both described above.

Why We Use Your Data

We rely on these legal grounds to use your personal data:

  • To perform our contract with you: your account, devices, usage metering, purchases and support
  • To meet legal obligations: keeping accounting records
  • For our legitimate interests: security logs, preventing abuse and choosing routes based on your country
  • With your consent: the optional diagnostics program, which you can withdraw at any time

Service Quality Improvement Program (Optional Diagnostics)

If you choose to join the Service Quality Improvement Program, the app shares diagnostics about how well your connection to our service performs. These diagnostics are not linked to your account. This is optional and turned off by default — we ask for your consent once, and you can turn it on or off at any time in the app's Settings. If you do not opt in, none of the data described below is collected.

With your consent, we collect:

  • Whether attempts to reach our own servers and API endpoints succeed or fail, at which stage a failure occurs (for example DNS, connection, or TLS), and how long successful attempts take (grouped into ranges)
  • Coarse network context, such as the connection type (Wi-Fi or cellular), whether the system reports it as metered or constrained, and which IP families it supports; our servers also derive the network operator (ASN) and country of the connection
  • Your platform, the app version, and a randomly generated, telemetry-only installation identifier that is not linked to your account and is used only to group and de-duplicate diagnostic reports

This program never collects:

  • The contents of your traffic, the sites or apps you use, your messages, or your browsing and DNS history
  • Your Wi-Fi network name (SSID/BSSID) or your precise location
  • Any information that links these diagnostics to your identity or account

We use this data solely to monitor and improve the reliability and performance of our service. We do not use it for advertising, and we do not share it with third parties. Reports are sent over an encrypted connection. We keep individual reports for 30 days and aggregated statistics for up to one year. You can withdraw your consent at any time in Settings, which stops all further collection; reports already received are deleted on this schedule, and the installation identifier itself is kept.

How Long We Keep Data

We keep data only as long as we need it:

  • Account data: while your account exists. When you delete your account, we deactivate it right away. We are switching on automatic deletion 30 days after your request; until it is running, write to help@vless.io and we will delete your account and its data.
  • Sign-in sessions, including their IP address: up to one year after you last used them.
  • One-time sign-in codes, including the device model and IP address: a few minutes.
  • Your device's IP address while connected: until about two minutes after the connection ends.
  • Detailed data-volume records: 35 days. Daily connection time: 30 days. The running data total for each device: while your account exists.
  • The country your device last connected from: currently up to 5 years; we are reducing this to 90 days.
  • Optional diagnostics: 30 days for individual reports, up to one year for aggregated statistics.
  • Server and app logs, including VPN server logs: 14 days. Error reports: 30 days.
  • Support requests: while your account exists, unless you ask us to delete them sooner. Copies held in our support ticketing tool are deleted when you ask us.
  • Payment and purchase records: as long as we need them for accounting, tax and legal obligations, including after your account is deleted.
  • Backups of our self-hosted database are encrypted and kept for 14 days. Our hosted database provider keeps its own backups under the retention we configure with it.

Payment Information

You can pay by card, with supported cryptocurrencies, with Telegram Stars, or through in-app purchases on the App Store (where available). For in-app purchases, Apple processes the payment, and we receive a record of the transaction, not your card or Apple account details. For other methods, the payment provider you choose processes the payment and receives what it needs to do so; depending on the method, this can include your username, email address and IP address. One of our payment providers, Freekassa, is based in Russia. We receive the payment status and transaction details. We do not store your full card number.

Data Security

Traffic between the app and our VPN servers travels in an encrypted tunnel. We also use encrypted connections between our apps and our other servers, encrypt our backups, and restrict access to our production systems. No online service can guarantee perfect security.

How We Share Data

We do not sell your personal data. We do not share or disclose it to third parties, except:

  • Service providers that run parts of the service on our behalf: hosting, database and data center providers; Cloudflare, through which our VPN servers send your traffic to the internet; and support tools, including AI service providers in the United States that our staff use to help read and answer support requests
  • Payment providers and the Apple App Store, to process your purchases
  • Apple, Google and Telegram, when you choose to sign in with them, receive notifications through them or use our Telegram bot
  • Authorities or others, where the law requires us to disclose it

We send email from our own mail server, and our error monitoring is self-hosted on our own servers in France.

Your Rights and Choices

Depending on where you live, you may have rights over your personal data. You can ask us to:

  • Give you a copy of your personal data
  • Give you the data you gave us in a machine-readable format
  • Correct your personal data (you can also edit your profile in the app)
  • Delete your personal data
  • Stop or limit how we use your personal data

To make a request, write to help@vless.io. We handle these requests manually and may need to confirm that the account is yours. We respond within one month (we may extend this by up to two more months for complex requests and will tell you if we do).

You can also lodge a complaint with your data protection authority.

You can delete your account in the app: Account → Profile → Request Account Deletion. Your account is deactivated right away. Automatic deletion 30 days after your request is being switched on; until then, write to help@vless.io and we will delete it. Data linked to your account is deleted with it or at the end of the periods above, except records we must keep for legal and accounting reasons, such as payment and purchase records. Deleting your account does not cancel an App Store subscription; cancel it in your App Store account settings.

Children

The service is not intended for children under 16 (under 13 in the United States). If you believe a child has given us personal data, write to help@vless.io and we will delete it.

Cookies and Tracking

Our website uses minimal cookies necessary for essential functionality. We do not use tracking cookies or analytics that compromise your privacy. You can disable cookies in your browser settings, though this may affect some website functionality.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

Flexus Systems LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. Email: help@vless.io. Phone: +1 575 205 6537. For questions about this Privacy Policy or requests about your personal data, write to help@vless.io. You can also reach us through our Telegram bot @vlessiobot.

International Users

VLESS.io serves customers worldwide, so your data may be processed outside your country. Our control servers and a copy of our databases are in France, and our main database is hosted by MongoDB Atlas. Backups and server logs are stored in the Netherlands. The VPN servers that carry your traffic are currently in Canada, Finland, the Netherlands, Poland, Russia and Singapore, with relay servers in Russia and a routing server in Germany; these locations can change. Some of our service providers, including Cloudflare, Apple, Google, Stripe and our AI service providers, are in the United States, and one payment provider, Freekassa, is in Russia.