Privacy Policy

The data controller for personal information processed in connection with Tuno VPN is Dong Yang. Contact: support@tunovpn.com.

Postal address and further operator details are set out in our Impressum.

We collect personal information that you provide and that is generated when you use the service:

• Account information: email address, password (stored hashed), and profile details from Google if you sign in with OAuth.
• Billing and entitlement: purchase email, plan, and access period. Payment instruments are processed by Stripe; we do not store full card numbers.
• Service metadata: device identifiers needed for device limits, subscription status, and technical logs required to operate and secure the VPN. We do not log your browsing history or the content of your VPN traffic.
• Website logs: IP address, user-agent, and similar technical data for security and reliability of the marketing site.
• Website analytics (optional): if you consent via the cookie banner, Google Analytics may collect page views, approximate location, device/browser type, and similar usage metrics on the marketing site.

We use personal information to provide and operate Tuno VPN, authenticate users, manage billing and entitlements, provide support, improve reliability and security, prevent abuse, and comply with legal obligations. We do not sell your personal information.

Where the EU General Data Protection Regulation (GDPR) applies, we process personal information on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create your account, provide VPN access, and process prepaid purchases.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, and service integrity, balanced against your rights.
• Consent (Art. 6(1)(a)) — where you choose OAuth sign-in, analytics cookies (Google Analytics), or other optional processing; you may withdraw consent at any time via Cookie settings on the website.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with law.

We use essential cookies required for the website to function (for example authentication, security, and checkout referral attribution). These cannot be disabled through the cookie banner.

If you opt in, we also load Google Analytics 4 (GA4) analytics cookies to measure how visitors use the marketing site. Analytics scripts are not loaded until you accept analytics cookies (or save preferences that include analytics). You can change or withdraw this consent at any time using “Cookie settings” in the website footer.

We share personal information with processors and providers only as needed to run the service:

• Stripe — payment processing (see Stripe’s privacy notice).
• Google — if you use Google sign-in.
• Google Analytics — if you consent to analytics cookies on the marketing website (see Google’s privacy notice).
• Hosting and infrastructure providers — including capacity in Frankfurt and Singapore regions as advertised.

Service infrastructure may process data in the EU (e.g. Frankfurt) and outside the EU (e.g. Singapore). Where personal data is transferred outside the European Economic Area, we use appropriate safeguards such as Standard Contractual Clauses where required. Analytics data processed by Google may also be processed outside the EEA subject to Google’s safeguards.

We retain account and service data for as long as your account is active and as needed to provide the service. Billing and tax records may be kept longer where required by law. When we no longer need personal information, we delete or anonymize it where feasible. Cookie consent preferences are stored for up to one year or until you change them.

Under GDPR (where applicable), you may have the right to access, rectify, erase, restrict, or port your personal data, to object to certain processing, and to withdraw consent. You also have the right to lodge a complaint with a supervisory authority in Germany (for example, the data protection authority of the federal state where you live or where we are established).

To exercise these rights, contact us at support@tunovpn.com.

We implement technical and organizational measures designed to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Tuno VPN is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe we have collected such information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may be communicated via the website or email where appropriate.

Privacy questions: support@tunovpn.com.