BAG app privacy policy

This document describes what data the BAG app for Android and Linux and the website bagvps.ru process, as far as the website works with the app. The operator is the BAGVPS service; company details. Questions and requests: support@bagvps.ru.

In short

• We do not record which websites and apps you open and do not inspect the content of your traffic.
• We do not sell data or share it with advertising networks. The app has no ads.
• We collect the minimum needed to sign you in, count the devices in your subscription and prevent access sharing.

1. Signing in

You sign in with an email address (a code is sent by email) or with a 12-word access key. The email is stored on the website in your account; the key is stored only as a hash. The app stores only a sign-in token. Emails with codes are sent by the Unisender email service. If there is no account with this email yet, it is created when you enter the code.

On every sign-in the website records the IP address, the browser or app string (User-Agent), the sign-in method and its result, to detect password guessing and foreign sign-ins. This log is kept for 90 days.

When you sign in on a TV or another device with an on-screen code, we keep the device name and type and the country the sign-in started from (by IP address; the address itself is not stored), so that your phone can show which device asks for access before you confirm. This is deleted within a day.

2. Device

The app sends the website a device identifier (hwid — a derived hash, not the Android ID itself), the device name and type, and the OS and app versions. This is used to count the devices in your subscription and show them in your account. You can unlink a device in your account.

3. Subscription

The app receives the server list and the subscription end date from the website. On each such request the website records the IP address, time, the app string (User-Agent), the device hash and the country derived from the IP address. We determine the country ourselves, using our own copy of an IP-to-country database (DB-IP.com, CC BY 4.0); the IP address is not sent anywhere for this. Purpose: device accounting and protection against sharing access with others. Kept for 90 days.

If a device suddenly “moves” to another country, the old and new country and IP addresses are recorded (kept for 180 days); device events — connected, unlinked, blocked — are kept for 1 year. On suspicious activity a device may be blocked automatically and temporarily; you can unblock it in your account or via support.

4. VPN traffic

All device traffic, except apps and networks you have excluded yourself, goes through BAG servers encrypted. The website and the app do not record which websites and apps you open and do not inspect traffic content. The servers only keep an internal count of traffic volume per subscription, for limits and for display in your account.

5. Connection quality statistics

You can turn them off in the app settings. When on, the app sends the outcome of a connection attempt: the server from the list, transport, latency and loss, network type, carrier (network number) and country, platform and app version. No website addresses are included; you are recorded by an anonymized hash, not by your account. Kept for 30 days.

Network report. Once a day per network, the app reports what that network does to test queries: whether it tampers with DNS answers, whether encrypted DNS (DoT and DoH) is reachable, whether the Russian Ministry of Digital Development root certificate is installed on the device, and whether the network substitutes certificates on test foreign domains. Along with it: network type, carrier (network number) and country, platform and app version. The report contains no addresses of websites you open and no device IP address; you and the device are recorded by anonymized hashes. We use the reports to see where and how networks are filtered and to hint the app how to get around it. Kept for 180 days.

Server replacement on the free plan. If the assigned server does not connect, the app tells the site its name and your carrier (network number), and the site assigns another one. To do this, the site stores which server you have this week and which ones you have rejected, and the times of replacements, to keep the limit of three per day. The complaint itself is kept for server statistics without your account or IP address: server name, carrier, country by the request IP address and an anonymized hash. Replacements and complaints are kept for 90 days.

iPhone test version. If you are invited to test BAG on iPhone, through the invitation link you share your iPhone number (UDID), model, iOS version and device name. This is required to add the phone to Apple's list of test devices — otherwise the app will not install on it. Only the BAG administrator sees the number; logs keep its last 6 characters. The number is kept while you are a tester and erased 30 days after removal from the list.

To detect the network and carrier, the app queries Cloudflare, which sees the device IP address in doing so. The app keeps that address no longer than the session; it is not part of the statistics.

6. Diagnostics and notifications

The app’s event log is stored only on the device and is sent only manually by you — for example, to support. Notifications are about the VPN state on this device and BAG announcements (new servers, maintenance, subscription ending), with no ads. The app fetches announcements from the website itself. If the device has Google services and you allowed notifications, the app sends the website a push token (Firebase Cloud Messaging); it is kept while the app is installed and deleted when Google reports that the token is no longer valid.

“Report a problem”. A report is sent only when you tap “Send”. It contains your text and contact if you gave one, the app version, the device system and model, the connection state, self-check results and the connection log. Keys, passwords, tokens, connection links and website addresses are removed from the log on the device, and the website checks this again. The report is linked to your account and device so that support can reply. The IP address is not recorded. Kept for 90 days.

7. Payments

Payments are made on the website; you enter card details on the payment provider’s side and we do not receive them. For auto-renewal we store the saved payment method identifier issued by the provider and its label (for example, “card *1234”). Payment records are kept as long as the law requires.

8. What we do not collect

Browsing history, traffic content, contacts, photos and files, precise (GPS) location, advertising identifiers.

9. Who receives data

• VPN server hosting — data centers in the EU. Traffic to some services (for example, Russian websites and video) may exit to the internet through our servers in Russia.
• Subscription management panel (Remnawave) — on our own server; it holds the subscription account and devices.
• Website database — Supabase, data center in Switzerland (Zurich).
• Cloudflare — network detection when connection statistics are on.
• Unisender — sending sign-in codes and notification emails.
• Google (Firebase Cloud Messaging) — delivering push notifications if the device has Google services. Receives the device token and the announcement text.
• Payment provider — when you pay on the website.

Data is not sold and not shared with advertising networks.

10. Retention and deletion

• The account and devices are kept while the account exists. You can delete it yourself: in the app (Settings → Delete account) or at bagvps.ru/account/delete. Access is closed at once, data is deleted after 30 days; what is kept and for how long is listed on that page. You can also write to support@bagvps.ru from the email linked to the account. Logs are deleted after the periods stated above.
• You can unlink a device in your account.
• On the device: “Sign out” erases the sign-in token; uninstalling erases all app data.

11. Security

All exchange between the app, the website and the servers is encrypted (TLS). Only service staff who need it for their work have access to the data.

12. Children

The app is not intended for persons under 18.

13. Your rights and changes

You can ask what data about you we hold, have it corrected or deleted — write to support@bagvps.ru. A new version of this document is published on this page with a new date.