Your roleنقش شما

Engineeringتیم فنی

Confirm how the app, the servers and the website work today.تأیید کنید اپ، سرورها و سایت امروز چطور کار می‌کنند.

For the team: urgent tasks firstبرای تیم: اول کارهای فوری

For now it is best that we all do a few urgent tasks together first. After that, go on to answering the questions.فعلاً بهتر است همه با هم اول چند کار فوری را انجام دهیم. بعد از آن سراغ جواب دادن به سؤال‌ها برویم.

See the urgent tasksدیدن کارهای فوری

0/10 questions answeredسؤال جواب داده شده
  • Never guess — “I don’t know” is a good answer.حدس نزنید؛ «نمی‌دانم» جواب خوبی است.
  • Describe how things are today.وضعیت امروز را بنویسید.
  • Persian or English — both are fine.فارسی یا انگلیسی، هر دو خوب است.
  • Answers save by themselves.جواب‌ها خودشان ذخیره می‌شوند.

Questionسؤال 1۱Needed firstاول لازم است

Is this true today on every server? “We do not record which websites users visit, what they send or receive, or their DNS lookups, and we never use VPN traffic for ads or analytics.”آیا این جمله امروز روی همه‌ی سرورها درست است؟ «ثبت نمی‌کنیم کاربر به چه سایت‌هایی می‌رود، چه چیزی می‌فرستد یا می‌گیرد، یا چه دامنه‌هایی را جست‌وجو می‌کند (DNS)، و هیچ‌وقت از ترافیک VPN برای تبلیغات یا آمار استفاده نمی‌کنیم.»

What this is aboutموضوع چیست

This is our most important public promise. If it is not fully true, it can be treated as misleading customers. If anything is different anywhere (a server, a hosting company, a log file), say so. Later the CTO signs a written confirmation.این مهم‌ترین قول عمومی ماست. اگر کاملاً درست نباشد، ممکن است فریب مشتری حساب شود. اگر هر جا چیزی فرق دارد (یک سرور، یک شرکت میزبان، یک فایل لاگ)، بنویسید. بعداً مدیر فنی یک تأیید کتبی امضا می‌کند.

Who answers DNS lookups: our own server or another company? Which?جست‌وجوی دامنه (DNS) را چه کسی جواب می‌دهد: سرور خودمان یا یک شرکت دیگر؟ کدام؟
Do the companies that host our servers keep any connection logs?شرکت‌هایی که سرورهای ما را نگه می‌دارند، لاگ اتصال نگه می‌دارند؟
If police give us a server IP address and a time, can we find which user it was? Why or why not?اگر پلیس یک IP سرور و یک زمان به ما بدهد، می‌توانیم پیدا کنیم کدام کاربر بوده؟ چرا بله یا چرا نه؟
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 11 yellow items in the documentsاین جواب کجا می‌رود: ۱۱ نوشته‌ی زرد در اسناد
  • POL-PRIV-002 — Summary

    We do not record the websites you visit, the content of your traffic or your DNS queries [ENGINEERING: logging attestation, EV-201–EV-205; claims register entry required].

  • POL-PRIV-002 — 3.3 VPN connection information

    We do not use VPN traffic for advertising, analytics or profiling. [ENGINEERING: attestation required for both sentences; claims register entry required]

  • POL-PRIV-002 — 7. Sale, sharing and targeted advertising

    We do not sell your VPN traffic, browsing destinations or DNS queries, and we do not keep records of them that could be disclosed [ENGINEERING: attestation]. [OPEN — depends on Section 2:] Under some U.S. state laws, giving advertising providers identifiers or app activity for targeted advertising may count as "selling", "sharing" or "targeted advertising" even if no money is paid.

  • POL-AUP-001 — 3. How we become aware of abuse

    We do not monitor the content of your traffic or the websites you visit [ENGINEERING: attestation required; must match Privacy Policy §3.3].

  • POL-AUP-001 — 3. How we become aware of abuse

    We do not record the websites you visit, the content of your traffic or your DNS queries [ENGINEERING: attestation EV-201, EV-202; claims register entry required — CLM-034].

  • POL-AUP-001 — 3. How we become aware of abuse

    We keep connection information only as described in Sections 3.3 and 11 of our Privacy Policy. [ENGINEERING: complete — "We therefore cannot link a VPN server IP address and time to a particular user" / "We can link a VPN server IP address and time to a user only within X minutes of the connection" — must match the Law Enforcement Guidelines §3; register as a claim in the Claims Register]

  • POL-SUB-001 — Our Service Providers

    DigitalOcean — VERIFY entity] · Hosting of servers and systems [VERIFY] · Network traffic passing through servers they host, including IP addresses [ENGINEERING: whether any connection records are stored on provider systems] · [COUNSEL: country only, or city — law-enforcement exposure (RSK-030)] · [EU (no transfer) / Data Privacy Framework / Standard Contractual Clauses / UK Addendum / Swiss FADP]`

  • POL-SUB-001 — Our Service Providers

    [DNS resolution — ENGINEERING: own resolver or third party (EV-202)] · Resolving domain names · [ENGINEERING: DNS queries — must be consistent with Privacy Policy §3.3] · [ ] · [ ]

  • POL-LE-001 — 3. Records we keep in the ordinary course of business

    The table below describes the records we keep in the ordinary course of business as of [OPEN: date], and how long we keep them (see Section 11 of our Privacy Policy). [ENGINEERING and COUNSEL: every row must match the logging attestation (EV-201–205) and the Privacy Policy exactly] [COUNSEL: wording on orders that require future collection]

  • POL-LE-001 — 3. Records we keep in the ordinary course of business

    Content of a user's internet traffic · [ENGINEERING: No — attestation EV-201; claims register approval] · —

  • POL-LE-001 — 3. Records we keep in the ordinary course of business

    Websites or destinations visited, and DNS queries, through the VPN · [ENGINEERING: No — EV-201, EV-202] · —

Questionسؤال 2۲Needed firstاول لازم است

How long do we keep each kind of data today?امروز هر نوع داده را چه مدت نگه می‌داریم؟

What this is aboutموضوع چیست

The draft proposes a period for each row. Check how the system really works now, not how it should work. If we keep something longer than proposed, or keep something we should not, say so.پیش‌نویس برای هر ردیف یک مدت پیشنهاد داده. ببینید سیستم الان واقعاً چطور کار می‌کند، نه این‌که باید چطور باشد. اگر چیزی را بیشتر از پیشنهاد نگه می‌داریم یا چیزی را نگه می‌داریم که نباید، بنویسید.

One-time login codes (and are they stored encrypted or hashed?)کدهای یک‌بارمصرف ورود (و رمزشده یا هش‌شده ذخیره می‌شوند؟)
Draft says:پیش‌نویس می‌گوید: 10 minutes
Login sessions (how long a user stays logged in)نشست ورود (کاربر چه مدت وارد می‌ماند)
Draft says:پیش‌نویس می‌گوید: 30 days
Account email, login method, Apple/Google ID, linked devicesایمیل حساب، روش ورود، شناسه‌ی اپل یا گوگل، دستگاه‌های وصل
Draft says:پیش‌نویس می‌گوید: as long as the account exists
All the above after the user asks to delete the accountهمه‌ی موارد بالا بعد از این‌که کاربر حذف حساب را بخواهد
Draft says:پیش‌نویس می‌گوید: deleted within 30 days
Installation ID, phone model and operating systemشناسه‌ی نصب، مدل گوشی و سیستم‌عامل
Free-version limits (which install used how much time, waiting periods)محدودیت‌های نسخه‌ی رایگان (کدام نصب چقدر استفاده کرده، زمان انتظار)
Live VPN session info (server, time, amount of data) after the user disconnectsاطلاعات اتصال زنده (سرور، زمان، حجم داده) بعد از قطع اتصال
Draft says:پیش‌نویس می‌گوید: up to 15 minutes
Usage statistics linked to an account or phoneآمار استفاده که به حساب یا گوشی وصل است
Draft says:پیش‌نویس می‌گوید: 24 hours
IP addresses in server logs of our app, website and account systemIPها در لاگ سرورهای اپ، سایت و سیستم حساب
Draft says:پیش‌نویس می‌گوید: 30 days
Blocked phones and payment cards (fraud and abuse)گوشی‌ها و کارت‌های پرداخت مسدودشده (کلاهبرداری و سوءاستفاده)
Draft says:پیش‌نویس می‌گوید: 24 months
Subscription and payment recordsسوابق اشتراک و پرداخت
Crash reportsگزارش‌های کرش
Draft says:پیش‌نویس می‌گوید: 90 days
Analytics and ad-measurement dataداده‌ی آمار و سنجش تبلیغات
Draft says:پیش‌نویس می‌گوید: 13 months
Whether the user agreed to marketing emailsاین‌که کاربر با ایمیل تبلیغاتی موافقت کرده یا نه
Push-notification tokenتوکن اعلان (push)
Support messagesپیام‌های پشتیبانی
Records of privacy requests from usersسوابق درخواست‌های حریم خصوصی کاربران
Deleted data disappears from backups within …داده‌ی حذف‌شده ظرف … از نسخه‌های پشتیبان هم پاک می‌شود
Draft says:پیش‌نویس می‌گوید: 90 days
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 48 yellow items in the documentsاین جواب کجا می‌رود: ۴۸ نوشته‌ی زرد در اسناد

Questionسؤال 3۳Needed firstاول لازم است

What information do the app and our servers collect?اپ و سرورهای ما چه اطلاعاتی جمع می‌کنند؟

What this is aboutموضوع چیست

The Privacy Policy must list everything we collect. Check the real database and the app code, not memory.سیاست حریم خصوصی باید همه‌ی چیزهایی را که جمع می‌کنیم فهرست کند. دیتابیس واقعی و کد اپ را چک کنید، نه حافظه‌تان را.

Everything stored for a user accountهمه‌ی چیزهایی که برای حساب کاربر ذخیره می‌شود
Ways to log inروش‌های ورود
Draft says:پیش‌نویس می‌گوید: email with a one-time code, Sign in with Apple, Google Sign-In
Everything the app sends about the phone (model, system, app version, language, time zone, IP…)هر چیزی که اپ درباره‌ی گوشی می‌فرستد (مدل، سیستم‌عامل، نسخه‌ی اپ، زبان، منطقه‌ی زمانی، IP…)
What the installation ID is used forشناسه‌ی نصب برای چه استفاده می‌شود
Draft says:پیش‌نویس می‌گوید: free-version limits, waiting periods, stopping abuse
Connection data kept on VPN servers: each field and where it is storedداده‌ی اتصال روی سرورهای VPN: هر مورد و جایی که ذخیره می‌شود
What the payment company sends us about a paymentشرکت پرداخت درباره‌ی هر پرداخت چه چیزی به ما می‌فرستد
Draft says:پیش‌نویس می‌گوید: a payment token, card type, last four digits, billing country, payment status
Do our security and error logs contain IP addresses?لاگ‌های امنیتی و خطای ما IP دارند؟
Can the app connect without sending phone and connection information?اپ بدون فرستادن اطلاعات گوشی و اتصال وصل می‌شود؟
Draft says:پیش‌نویس می‌گوید: no
Automatic checks we run (login checks, plan and device limits, suspicious logins or payments, abuse)بررسی‌های خودکار (بررسی ورود، محدودیت پلن و دستگاه، ورود یا پرداخت مشکوک، سوءاستفاده)
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 11 yellow items in the documentsاین جواب کجا می‌رود: ۱۱ نوشته‌ی زرد در اسناد
  • POL-PRIV-002 — 3.1 Account information

    If you create an account: your email address, an internal account identifier, your plan and subscription status, the devices linked to your account and your sign-in method [ENGINEERING: fields].

  • POL-PRIV-002 — 3.1 Account information

    If you sign in with Apple or Google, we receive an identifier and the email address the provider shares (Apple may share a private relay address) [ENGINEERING: sign-in methods offered].

  • POL-PRIV-002 — 3.2 Device and app information

    When you use the app, with or without an account: an installation or device identifier, device model, operating system and app version, language, time zone and the IP address used to contact our servers [ENGINEERING: fields].

  • POL-PRIV-002 — 3.2 Device and app information

    In the Free Service, the installation identifier is used to apply session limits and waiting periods and to prevent abuse [ENGINEERING: EV-205].

  • POL-PRIV-002 — 3.3 VPN connection information

    To connect you, our systems process: your IP address at the time of connection, a session identifier, your account or installation identifier, the server and protocol selected, the internal tunnel address, connection status and errors, the number of simultaneous connections, connection start and end times and the amount of data transferred [ENGINEERING: confirm each field, where it is stored and for how long — EV-201, EV-205].

  • POL-PRIV-002 — 3.4 Purchase information

    For website purchases, our payment processor [OPEN: Stripe entity] collects your payment details; we receive [ENGINEERING: e.g. a payment token, card type and last four digits, billing country and payment status]. [OPEN — BRF-2026-001 D7: cryptocurrency purchases — wallet address, transaction hash, asset and amount]

  • POL-PRIV-002 — 3.6 Diagnostics and security information

    Crash reports, app performance data, API request records, sign-in attempts, rate-limit events and abuse reports, used to keep the Services working and secure [ENGINEERING: whether these records contain IP addresses — CLM-024].

  • POL-PRIV-002 — 3.10 What you must provide

    Using the Free Service without an account does not require them, but the app cannot connect without the device and connection information in Sections 3.2 and 3.3 [ENGINEERING: confirm].

  • POL-PRIV-002 — 16. Additional information for U.S. residents

    Identifiers · Email, account ID, installation ID, IP address [ENGINEERING] · You; your device;

  • POL-PRIV-002 — 18. Automated decisions

    We use automated rules to authenticate sessions, apply plan and device limits, and detect suspicious sign-ins, payments and abuse [ENGINEERING: confirm].

  • POL-TOS-002 — 4. Accounts, guest access and security

    Sign-in methods are those shown in the app [ENGINEERING: e.g. email with a one-time code, Sign in with Apple, Google Sign-In].

Questionسؤال 4۴Needed firstاول لازم است

App features that use things on the phone: does the data stay on the phone?امکاناتی از اپ که از چیزهای روی گوشی استفاده می‌کنند: داده روی گوشی می‌ماند؟

What this is aboutموضوع چیست

For each feature, say on which phones it exists (iPhone, Android) and whether the data stays on the phone or goes to our servers.برای هر امکان بگویید روی کدام گوشی‌ها هست (آیفون، اندروید) و داده روی گوشی می‌ماند یا به سرور ما می‌رود.

Choosing which apps use the VPN (reads the list of installed apps)انتخاب این‌که کدام اپ‌ها از VPN استفاده کنند (فهرست اپ‌های نصب‌شده را می‌خواند)
Draft says:پیش‌نویس می‌گوید: stays on the phone
Auto-connect on untrusted Wi-Fi (reads Wi-Fi names)اتصال خودکار در وای‌فای ناامن (اسم وای‌فای را می‌خواند)
Draft says:پیش‌نویس می‌گوید: stays on the phone
Do we ask for location or local-network permission? Why?اجازه‌ی موقعیت مکانی یا شبکه‌ی محلی می‌گیریم؟ چرا؟
Scanning a QR code with the camera: is the picture saved or uploaded?اسکن کد QR با دوربین: عکس ذخیره یا آپلود می‌شود؟
Draft says:پیش‌نویس می‌گوید: not saved, not uploaded
Paste or import (reads the clipboard only when the user taps)چسباندن یا وارد کردن (کلیپ‌بورد را فقط وقتی کاربر بزند می‌خواند)
Draft says:پیش‌نویس می‌گوید: stays on the phone
User's own VPN settings and keysتنظیمات و کلیدهای VPN خودِ کاربر
Draft says:پیش‌نویس می‌گوید: stays on the phone, encrypted
Is the push-notification token stored on our servers?توکن اعلان (push) روی سرورهای ما ذخیره می‌شود؟
Weekly usage statistics: on the phone or on our servers?آمار هفتگی استفاده: روی گوشی یا روی سرور ما؟
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 12 yellow items in the documentsاین جواب کجا می‌رود: ۱۲ نوشته‌ی زرد در اسناد

Questionسؤال 5۵Needed firstاول لازم است

Which code from other companies is inside our apps and website?کد کدام شرکت‌های دیگر داخل اپ‌ها و سایت ماست؟

What this is aboutموضوع چیست

Apps often include code from other companies (called SDKs) for ads, analytics, crash reports or login, for example Firebase, AppsFlyer, AdMob or Google Tag Manager. Each one can receive data, so the Privacy Policy must name them.اپ‌ها معمولاً کدِ شرکت‌های دیگر را داخل خودشان دارند (به آن SDK می‌گویند) برای تبلیغات، آمار، گزارش کرش یا ورود؛ مثلاً Firebase، AppsFlyer، AdMob یا Google Tag Manager. هر کدام ممکن است داده بگیرد، پس سیاست حریم خصوصی باید اسمشان را بیاورد.

💡 List each one with what it receives. Include ones that are switched off.هر کدام را با داده‌ای که می‌گیرد بنویسید. آن‌هایی را هم که خاموش‌اند بنویسید.

iPhone appاپ آیفون
Android app (Google Play version and website version)اپ اندروید (نسخه‌ی گوگل‌پلی و نسخه‌ی سایت)
Websiteسایت
Anything else the app saves on or reads from the phone that the VPN does not needهر چیز دیگری که اپ روی گوشی ذخیره می‌کند یا از آن می‌خواند و VPN لازمش ندارد
Do the app and website ask users for permission before tracking? How?اپ و سایت قبل از ردیابی از کاربر اجازه می‌گیرند؟ چطور؟
When a user deletes the account, which of these companies do we ask to delete the data too?وقتی کاربر حسابش را حذف می‌کند، از کدام‌یک از این شرکت‌ها می‌خواهیم داده را پاک کنند؟
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 6 yellow items in the documentsاین جواب کجا می‌رود: ۶ نوشته‌ی زرد در اسناد
  • POL-PRIV-002 — 3.5 Advertising and measurement information

    [OPEN — depends on Section 2 and the SDK inventory (EV-206)] Where advertising is shown, the advertising provider may receive [ENGINEERING: list].

  • POL-PRIV-002 — 3.5 Advertising and measurement information

    Measurement and analytics tools may receive app events such as installation, account creation, trial start and purchase [ENGINEERING: named tools and events].

  • POL-PRIV-002 — 3.5 Advertising and measurement information

    We do not send VPN traffic, DNS queries, destinations, sign-in codes or payment details to these providers [ENGINEERING: EV-206].

  • POL-PRIV-002 — 7. Sale, sharing and targeted advertising

    If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account [ENGINEERING: confirm] [COUNSEL: which state laws apply — EV-233].

  • POL-PRIV-002 — 8. Cookies and similar technologies

    In our apps, [ENGINEERING: describe the storage of or access to information on your device that is not strictly necessary, the consent tool used (for example Google UMP or App Tracking Transparency), and how to change your choice].

  • POL-PRIV-002 — 13. Your choices

    You can: update your account information; unsubscribe from marketing emails; change advertising and tracking choices in the app and in your device settings, including Apple's App Tracking Transparency [OPEN — D4]; change cookie choices on our website [ENGINEERING: consent management — BRF-2026-001 P2-2]; change device permissions in your device settings; and delete your account.

Questionسؤال 6۶Needed firstاول لازم است

What do the free version and Premium include today?نسخه‌ی رایگان و پریمیوم امروز چه چیزهایی دارند؟

Limits of the free version (session length, waiting time, automatic server choice)محدودیت‌های نسخه‌ی رایگان (طول هر اتصال، زمان انتظار، انتخاب خودکار سرور)
What Premium addsپریمیوم چه چیزهایی اضافه می‌کند
Draft says:پیش‌نویس می‌گوید: choose server and protocol, no ads, no time limit, kill switch
How many devices and connections at the same time per Premium accountهر حساب پریمیوم چند دستگاه و چند اتصال هم‌زمان
Draft says:پیش‌نویس می‌گوید: 5 devices, 5 connections
Systems with an official appسیستم‌عامل‌هایی که اپ رسمی دارند
Draft says:پیش‌نویس می‌گوید: iPhone and Android
VPN protocols and encryption usedپروتکل‌ها و رمزنگاری VPN
Does the app show any server location that is not physically in that country?اپ موقعیت سروری نشان می‌دهد که واقعاً در آن کشور نیست؟
Does the app show the list of open-source licenses?اپ فهرست مجوزهای متن‌باز را نشان می‌دهد؟
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 8 yellow items in the documentsاین جواب کجا می‌رود: ۸ نوشته‌ی زرد در اسناد
  • POL-TOS-002 — 4. Accounts, guest access and security

    Guest access may use automatic server selection, limit session length and apply waiting periods between sessions [ENGINEERING: current values]. [OPEN — BRF-2026-001 D4: on the platforms where advertising is shown, guest access may show advertising and offer optional rewarded advertising to shorten a waiting period; this sentence must match the Privacy Policy §2 alternative chosen]

  • POL-TOS-002 — 4. Accounts, guest access and security

    4.4 Devices and sharing. Unless your plan says otherwise, a Premium account may be used on up to five supported devices that you own or control, with up to five simultaneous connections [ENGINEERING: confirm backend limits — CLM-019].

  • POL-TOS-002 — 5. Free Service and Premium

    5.1 Free Service. The Free Service includes VPN connectivity with the limits shown in the app [ENGINEERING: current values].

  • POL-TOS-002 — 5. Free Service and Premium

    5.2 Premium. Premium features are those described in the offer, store listing or checkout screen when you buy [ENGINEERING: e.g. manual server and protocol selection, no in-app advertising, no session time limit, kill switch].

  • POL-TOS-002 — 5. Free Service and Premium

    5.3 Platforms. The Services are available only on the platforms for which we offer an official download [ENGINEERING: current list, e.g. iOS and Android].

  • POL-TOS-002 — 6. License to use our software

    6.3 Open-source components are licensed under their own licenses, which prevail for those components. [ENGINEERING: publish the list of open-source licenses in the app — roadmap #29]

  • POL-TOS-002 — 7. What a VPN does and does not do

    7.1 When the connection is active and working, the VPN encrypts traffic between your device and the VPN server you connect to [ENGINEERING: protocol and cipher matrix — CLM-008].

  • POL-TOS-002 — 7. What a VPN does and does not do

    A server location shown in the app may be a virtual location that differs from the physical location of the server [ENGINEERING: confirm whether virtual locations are used].

Questionسؤال 7۷Needed firstاول لازم است

Sign-up, free trial, renewal and cancelling: what exists in the app and website today?ثبت‌نام، دوره‌ی رایگان، تمدید و لغو: امروز در اپ و سایت چه چیزهایی وجود دارد؟

What this is aboutموضوع چیست

U.S. and European law have strict rules for subscriptions that renew automatically: clear agreement before paying, reminders, and easy online cancelling. The documents describe these steps; each must really exist.قانون آمریکا و اروپا برای اشتراکی که خودکار تمدید می‌شود قانون‌های سختی دارد: موافقت واضح قبل از پرداخت، یادآوری، و لغوِ آسانِ آنلاین. اسناد این مراحل را توضیح می‌دهند؛ هر کدام باید واقعاً وجود داشته باشد.

💡 Write: yes / no / planned for (date). Add the path or web address when asked.بنویسید: بله / نه / برنامه‌ریزی‌شده برای (تاریخ). هر جا مسیر یا نشانی خواسته شده، بنویسید.

Before an account, trial or purchase, the user must tap “I agree” to the Terms. Also for guest users at first launch?قبل از ساخت حساب، دوره‌ی رایگان یا خرید، کاربر باید «موافقم» را برای شرایط استفاده بزند. برای کاربر مهمان هم در اولین اجرا؟
Website trial: we email the end date, the price after it and a cancel linkدوره‌ی رایگانِ سایت: تاریخ پایان، قیمت بعد از آن و لینک لغو را ایمیل می‌کنیم
If a user cancels a trial, Premium stays until the trial endsاگر کاربر دوره‌ی رایگان را لغو کند، پریمیوم تا آخر دوره می‌ماند
Automatic renewal is set up the same way in Stripe, Apple and Googleتمدید خودکار در Stripe، اپل و گوگل یکسان تنظیم شده
How do we send a renewal reminder to users who have no email address?یادآوری تمدید را برای کاربری که ایمیل ندارد چطور می‌فرستیم؟
Android app downloaded from our website: who charges the user, Stripe or Google?اپ اندرویدی که از سایت ما دانلود شده: پول را چه کسی می‌گیرد، Stripe یا گوگل؟
Where users cancel a website subscription themselves (path in the account and web address)کاربر اشتراک سایت را خودش کجا لغو می‌کند (مسیر در حساب و نشانی وب)
Draft says:پیش‌نویس می‌گوید: Account → Subscription → Cancel subscription
After cancelling, Premium stays until the end of the paid periodبعد از لغو، پریمیوم تا آخر دوره‌ی پرداخت‌شده می‌ماند
If we show a “please stay” offer during cancelling, is a clear “cancel” button next to it?اگر وسط لغو پیشنهاد «بمان» نشان بدهیم، دکمه‌ی واضح «لغو» کنارش هست؟
Germany and France require a special cancel button: web address of eachآلمان و فرانسه یک دکمه‌ی لغوِ مخصوص می‌خواهند: نشانی وب هر کدام
Europe/UK: a “withdraw from contract” button in the account, and we ask about it during cancellingاروپا و بریتانیا: دکمه‌ی «انصراف از قرارداد» در حساب، و پرسیدن آن وسط لغو
Deleting the account also stops a website subscription automaticallyحذف حساب، اشتراک سایت را هم خودکار قطع می‌کند
Time zone used for website purchase timesمنطقه‌ی زمانی که برای زمان خریدهای سایت استفاده می‌شود
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 23 yellow items in the documentsاین جواب کجا می‌رود: ۲۳ نوشته‌ی زرد در اسناد
  • POL-PRIV-002 — 12. Deleting your account

    You can delete your account in the app or as described in our Account and Data Deletion Policy [OPEN: link — POL-DEL-001] [ENGINEERING: in-app and web deletion]. Deleting your account cancels the renewal of a subscription bought on our website, but not of a subscription billed by Apple or Google [ENGINEERING: automatic cancellation of the Stripe subscription].

  • POL-TOS-002 — Terms of Service

    You accept these Terms when you tick the box or tap the button that says you agree to them, which we show before you create an account, start a trial or make a purchase [ENGINEERING: clickwrap at each of these points, and at first launch for guest use].

  • POL-TOS-002 — 10. Free trials and introductory offers

    For trials on our website, the deadline is shown at sign-up and in your confirmation [ENGINEERING: confirmation email].

  • POL-TOS-002 — 11. Automatic renewal and price changes

    EV-232]` [ENGINEERING: reminder channel for users without an email address].

  • POL-TOS-002 — 12. How to cancel

    You keep Premium until the end of the period you have paid for, unless you receive a refund [ENGINEERING: QN-08-020].

  • POL-TOS-002 — 12. How to cancel

    12.2 Apple: cancel in your Apple Account subscription settings. Google Play: cancel in Google Play subscriptions. Website purchases: cancel online in your HidzoVPN account at [ENGINEERING: self-service cancellation page]; you can also email [email protected] with the subject "Cancel Subscription" from your account email, or include that address in your message.

  • POL-TOS-002 — 12. How to cancel

    Online cancellation is available without any further step that delays or obstructs it [ENGINEERING: if a retention offer is shown, a clearly labeled "click to cancel" option must be shown with it — Cal. Bus. & Prof. Code §17602(d), (e)(2); EV-226].

  • POL-TOS-002 — 12. How to cancel

    Deleting your account cancels the renewal of a subscription bought on our website [ENGINEERING: automatic cancellation of the Stripe subscription — POL-DEL-001 §1], but not of a subscription billed by Apple or Google; cancel those with the store first.

  • POL-TOS-002 — 13. Refunds

    To withdraw, use the "Withdraw from contract here" function in your account [ENGINEERING: withdrawal function live — RSK-051] or contact us.

  • POL-TOS-002 — 14. Deleting your account

    Deleting your account cancels the renewal of a subscription bought on our website [ENGINEERING: POL-DEL-001 §1], but does not cancel a subscription billed by Apple or Google.

  • POL-AUP-001 — Acceptable Use Policy

    It applies to everyone who uses HidzoVPN, with or without an account [ENGINEERING: first-launch acceptance screen that covers guest users].

  • POL-REF-001 — 1. Cancel at any time

    Except for cryptocurrency prepayments (Section 6) and Activation Codes (Section 5A), your subscription renews automatically until you cancel [ENGINEERING: confirm the renewal configuration in Stripe, Apple and Google — CLM-025].

  • POL-REF-001 — 1. Cancel at any time

    You keep Premium until the end of the period you have already paid for, unless you receive a refund [ENGINEERING: QN-08-020].

  • POL-REF-001 — 1. Cancel at any time

    Our website (including purchases made in the Android app downloaded from our website [ENGINEERING: confirm billing path]) · Online in your account: [ENGINEERING: Account → Subscription → Cancel subscription].

  • POL-REF-001 — 1. Cancel at any time

    Our website (including purchases made in the Android app downloaded from our website [ENGINEERING: confirm billing path]) · Online in your account: [ENGINEERING: Account → Subscription → Cancel subscription].

  • POL-REF-001 — 1. Cancel at any time

    Germany · Use the "Verträge hier kündigen" button at [ENGINEERING: URL] [COUNSEL: §312k BGB; whether it may sit behind sign-in]

  • POL-REF-001 — 1. Cancel at any time

    France · Use the cancellation function at [ENGINEERING: URL] [COUNSEL: Code de la consommation L.215-1-1]

  • POL-REF-001 — 1. Cancel at any time

    Deleting your account cancels the renewal of a website subscription [ENGINEERING: POL-DEL-001 §1], but not of an Apple or Google subscription.

  • POL-REF-001 — 1. Cancel at any time

    Times for website purchases are shown in [ENGINEERING: time zone].

  • POL-REF-001 — 2. Free trials

    When you start a trial on our website, we send you a confirmation that states the date the trial ends, the price that will be charged after it and a link to cancel online [ENGINEERING].

  • POL-REF-001 — 2. Free trials

    If you cancel a website trial, you keep Premium until the trial ends [ENGINEERING]. [OPEN: an additional reminder before the trial ends — timing; card-network rules require the reminder content for trials of 7 days or less to be in the sign-up confirmation — EV-406]

  • POL-REF-001 — 4. Right of withdrawal in the European Union and the United Kingdom

    4.2 To withdraw, use the "Withdraw from contract here" function in your account, then confirm with "Confirm withdrawal"; we send you an acknowledgement by email straight away [ENGINEERING: withdrawal function, available throughout the withdrawal period — RSK-051].

  • POL-REF-001 — 4. Right of withdrawal in the European Union and the United Kingdom

    If you cancel within the 14-day period, we will ask whether you also want to withdraw and receive a refund under this Section [ENGINEERING: prompt in the cancellation flow].

Questionسؤال 8۸Needed firstاول لازم است

How does a user delete their account and data?کاربر چطور حساب و داده‌هایش را حذف می‌کند؟

What this is aboutموضوع چیست

Apple and Google require an easy way to delete an account, inside the app and on the web. The documents describe it step by step.اپل و گوگل یک راه آسان برای حذف حساب می‌خواهند، هم داخل اپ و هم در وب. اسناد آن را قدم به قدم توضیح می‌دهند.

Path inside the appمسیر داخل اپ
Draft says:پیش‌نویس می‌گوید: Settings → Account → Delete account
Web page for deleting without the appصفحه‌ی وب برای حذف بدون اپ
Draft says:پیش‌نویس می‌گوید: https://hidzovpn.com/delete-account
Does the app warn that Apple/Google subscriptions must be cancelled separately, with a link?اپ هشدار می‌دهد که اشتراک اپل یا گوگل را باید جدا لغو کرد، همراه لینک؟
When deleting, do we also disconnect “Sign in with Apple” and Google login?هنگام حذف، اتصال «ورود با اپل» و ورود با گوگل را هم قطع می‌کنیم؟
Do we email the user when deletion is finished?وقتی حذف تمام شد به کاربر ایمیل می‌زنیم؟
Which data can a user delete without deleting the whole account?کاربر کدام داده را می‌تواند بدون حذف کل حساب پاک کند؟
Users without an account: when is the data of their install removed?کاربر بدون حساب: داده‌ی نصبش کی پاک می‌شود؟
Where the app shows the installation IDاپ شناسه‌ی نصب را کجا نشان می‌دهد
Draft says:پیش‌نویس می‌گوید: Settings → About
Can we ask a user without an account to confirm deletion from inside the app?می‌توانیم از کاربر بدون حساب بخواهیم حذف را از داخل اپ تأیید کند؟
After deleting, can an Apple/Google subscription be moved to a new account?بعد از حذف، اشتراک اپل یا گوگل به حساب جدید منتقل می‌شود؟
App name and developer name exactly as shown on Google Playاسم اپ و اسم توسعه‌دهنده دقیقاً همان‌طور که در گوگل‌پلی آمده
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 13 yellow items in the documentsاین جواب کجا می‌رود: ۱۳ نوشته‌ی زرد در اسناد

Questionسؤال 9۹Can come laterمی‌تواند بعداً باشد

Security, stopping misuse, and handling reports of security holesامنیت، جلوگیری از سوءاستفاده، و رسیدگی به گزارش حفره‌های امنیتی

Security measures we really have (encryption, access control, monitoring…)اقدام‌های امنیتی که واقعاً داریم (رمزنگاری، کنترل دسترسی، پایش…)
Do we limit file sharing (torrents)? How?اشتراک فایل (تورنت) را محدود می‌کنیم؟ چطور؟
Anti-misuse measures we really have (blocked ports, connection limits…)اقدام‌های ضدسوءاستفاده که واقعاً داریم (پورت‌های بسته، محدودیت اتصال…)
Is the file hidzovpn.com/.well-known/security.txt online?فایل hidzovpn.com/.well-known/security.txt روی سایت هست؟
Do we publish an encryption key (PGP) for security reports? Web addressکلید رمزنگاری (PGP) برای گزارش امنیتی منتشر می‌کنیم؟ نشانی
Who handles security reports, and who replaces them when awayچه کسی گزارش‌های امنیتی را پیگیری می‌کند و در غیابش چه کسی
We confirm we got a report within … working daysدریافت گزارش را ظرف … روز کاری تأیید می‌کنیم
Draft says:پیش‌نویس می‌گوید: 3
We update the reporter every … days, and tell them when it is fixedهر … روز به گزارش‌دهنده خبر می‌دهیم و رفع شدن را هم می‌گوییم
The reporter keeps it secret until … days after the fix, or at most … days after reportingگزارش‌دهنده تا … روز بعد از رفع، یا حداکثر … روز بعد از گزارش، آن را فاش نمی‌کند
Draft says:پیش‌نویس می‌گوید: 30 / 90
Our websites and domains that reports may coverسایت‌ها و دامنه‌های ما که گزارش می‌تواند درباره‌شان باشد
Web address for downloading the Android app, and page with its security fingerprintنشانی دانلود اپ اندروید، و صفحه‌ی اثر انگشت امنیتی آن
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 16 yellow items in the documentsاین جواب کجا می‌رود: ۱۶ نوشته‌ی زرد در اسناد
  • POL-PRIV-002 — 17. Security

    We use administrative, technical and physical measures to protect personal information [ENGINEERING: list only measures in place, e.g. encryption in transit, access controls, monitoring of our systems].

  • POL-AUP-001 — 2. File sharing (P2P)

    [ENGINEERING: state the method. If P2P is limited by blocking ports: "We may block ports commonly used for peer-to-peer file sharing on some servers. We do not inspect the content of your traffic to do so." If limiting P2P requires classifying or inspecting traffic, this section and Section 3 must be rewritten to describe it — RSK-028.] Where peer-to-peer file sharing is available, you may use it only for content you have the right to share.

  • POL-AUP-001 — 3. How we become aware of abuse

    automated protections that do not inspect the content of your traffic, such as limits on connection rates, blocked outbound ports (for example, ports commonly used to send spam) and limits on simultaneous connections [ENGINEERING: list the controls actually in place]; and

  • POL-ID-001 — How to contact us

    See our Vulnerability Disclosure Policy and https://hidzovpn.com/.well-known/security.txt [ENGINEERING]

  • POL-ID-001 — Our apps

    We also offer an Android app for download from our website at [ENGINEERING: official download URL]; we publish the SHA-256 checksum of the current release and the fingerprint of our signing certificate at [ENGINEERING: URL].

  • POL-ID-001 — Our apps

    We also offer an Android app for download from our website at [ENGINEERING: official download URL]; we publish the SHA-256 checksum of the current release and the fingerprint of our signing certificate at [ENGINEERING: URL].

  • POL-VDP-001 — 1. How to report

    Email [OPEN: [email protected]] [OPEN: with our PGP key at https://hidzovpn.com/.well-known/pgp-key.txt].

  • POL-VDP-001 — 1. How to report

    Our contact details are also published in https://hidzovpn.com/.well-known/security.txt [ENGINEERING: file live — RFC 9116].

  • POL-VDP-001 — 2. What we will do

    We will acknowledge your report within [OPEN: 3] business days [ENGINEERING: owner named; rota in place].

  • POL-VDP-001 — 2. What we will do

    We will acknowledge your report within [OPEN: 3] business days [ENGINEERING: owner named; rota in place].

  • POL-VDP-001 — 2. What we will do

    We will tell you at least every [OPEN] days whether the issue is still open [ENGINEERING].

  • POL-VDP-001 — 2. What we will do

    We will tell you at least every [OPEN] days whether the issue is still open [ENGINEERING].

  • POL-VDP-001 — 2. What we will do

    We will tell you when the vulnerability has been fixed [ENGINEERING].

  • POL-VDP-001 — 3. Scope

    In scope: the HidzoVPN iOS app from the App Store; the HidzoVPN Android app from Google Play or our website; the domains listed here [OPEN: list]; and our VPN servers when you connect to them as an ordinary user of your own account.

  • POL-VDP-001 — 4. Rules for testing

    keep the details confidential until the earlier of [OPEN: 30] days after we release a fix and [OPEN: 90] days after your report, unless we agree another date in writing.

  • POL-VDP-001 — 4. Rules for testing

    keep the details confidential until the earlier of [OPEN: 30] days after we release a fix and [OPEN: 90] days after your report, unless we agree another date in writing.

Questionسؤال 10۱۰Can come laterمی‌تواند بعداً باشد

Website cookies: what do we use and what can visitors choose?کوکی‌های سایت: از چه چیزهایی استفاده می‌کنیم و بازدیدکننده چه انتخاب‌هایی دارد؟

What this is aboutموضوع چیست

Cookies are small files a website saves in the browser. The law requires a full list and a real choice for visitors. Engineering and marketing together: use the Google Tag Manager export and a cookie scan of the live site.کوکی فایل کوچکی است که سایت در مرورگر ذخیره می‌کند. قانون فهرست کامل و یک انتخاب واقعی برای بازدیدکننده می‌خواهد. تیم فنی و مارکتینگ با هم: از خروجی Google Tag Manager و اسکن کوکی سایت واقعی استفاده کنید.

Every cookie: name, company, purpose, how long it lasts (attach the scan)همه‌ی کوکی‌ها: اسم، شرکت، هدف، مدت ماندن (فایل اسکن را پیوست کنید)
Our other websites (e.g. help center)سایت‌های دیگر ما (مثلاً مرکز راهنما)
Can users log in on the website?کاربر می‌تواند در سایت وارد حسابش شود؟
Cookie banner: are “Accept” and “Reject” equally visible on the first screen?بنر کوکی: دکمه‌ی «قبول» و «رد» در صفحه‌ی اول به یک اندازه دیده می‌شوند؟
Is there a “Cookie settings” link at the bottom of every page?لینک «تنظیمات کوکی» پایین همه‌ی صفحه‌ها هست؟
Do we respect the browser's “do not sell or share” signal, and show that we did?به سیگنال «نفروش و به اشتراک نگذار» مرورگر احترام می‌گذاریم و نشان می‌دهیم؟
Web address of the “Your Privacy Choices” pageنشانی صفحه‌ی «انتخاب‌های حریم خصوصی شما»
＋ Add a note (optional): details, a link to proof, who confirmed it＋ افزودن توضیح (اختیاری): جزئیات، لینک مدرک، چه کسی تأیید کرده
Where this answer goes: 7 yellow items in the documentsاین جواب کجا می‌رود: ۷ نوشته‌ی زرد در اسناد
  • POL-PRIV-002 — 16. Additional information for U.S. residents

    To opt out of the sale or sharing of personal information or targeted advertising, use [OPEN: "Your Privacy Choices" link] or send a Global Privacy Control signal (Section 7).

  • POL-COOK-001 — Cookie Notice

    This notice explains how HidzoVPN, Inc. uses cookies and similar technologies on hidzovpn.com and its subdomains [OPEN: list other domains, e.g. help center].

  • POL-COOK-001 — 2. The cookies we use

    [ENGINEERING and MARKETING: complete from the GTM export and a production cookie scan (EV-212). One row per cookie. Remove any category that is not used. Cookie lifetimes must not exceed the periods in Privacy Policy §11.]

  • POL-COOK-001 — 2. The cookies we use

    Strictly necessary · Security, checkout, remembering your cookie choices [ENGINEERING: and sign-in, if the website has sign-in] · [ ] · HidzoVPN / [ ] · [ ] · No consent needed · No consent needed

  • POL-COOK-001 — 3. Your choices

    Cookie settings: you can accept or reject non-essential cookies, and change your choice at any time, using [ENGINEERING: "Cookie settings" link in the website footer]. [ENGINEERING: the first layer offers Accept and Reject with equal prominence]

  • POL-COOK-001 — 3. Your choices

    Cookie settings: you can accept or reject non-essential cookies, and change your choice at any time, using [ENGINEERING: "Cookie settings" link in the website footer]. [ENGINEERING: the first layer offers Accept and Reject with equal prominence]

  • POL-COOK-001 — 3. Your choices

    Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device and, if we know who you are, for your account, and we show on the website that your signal has been honored [ENGINEERING: confirm; status display] [COUNSEL: which state laws apply — EV-233].