Privacy Policy

1. Who we are

SKYLIN VPN is developed by Sahand Ghandehari. This policy explains how we (“SKYLIN”, “we”, “us”) handle information in the SKYLIN VPN Android app (package com.skylin.vpn) and on skylinvpn.com, including the Founding 5,000 waitlist. We do not sell your personal information.

2. The SKYLIN VPN app

How the VPN works

SKYLIN VPN uses Android’s VpnService interface. When you connect, Android asks you to approve the VPN, and the app then routes your device’s network traffic through an encrypted tunnel between your device and a SKYLIN VPN endpoint (server). Traffic leaves the endpoint to reach the sites and services you use.

Traffic passing through the VPN

Your traffic is processed transiently by the endpoint so it can be encrypted, decrypted and forwarded. We do not intentionally store the contents of your browsing, and we do not use your traffic to build advertising profiles.

App and install information

To run, secure and support the app we process technical information about the app and its installation, such as the app version, the Android version and basic device characteristics needed for compatibility.

Connection metadata

To operate the service we process operational metadata about VPN connections, such as when a connection is established or ends, which SKYLIN endpoint is used, and connection status. We use it to provide, maintain and protect the service, for capacity planning, and to prevent abuse.

Connection features

The app can automatically connect the VPN when you join a Wi-Fi network it treats as unsafe, show notifications about your connection status, and reconnect automatically when your network changes. To do this the app checks the state of your device’s network connection on the device.

3. The website and Founding 5,000 waitlist

What you give us

• Your email address and, if you choose to give it, your first name.
• Your consent to receive waitlist and launch emails, with the date and the wording you agreed to.

Referrals, rank and rewards

We create a referral code for you, record who invited you and who joins through your link, and use this to calculate your rank, Founding Member status, levels, weekly race standing and rewards. We also record how you found us (campaign tags in the link you arrived from, first and most recent visit) for attribution. The public weekly board shows only the first initial of your first name, and you can hide yourself from it in your dashboard. We never show your email publicly.

Fraud and abuse prevention

To keep referrals fair we process abuse-prevention signals: a keyed one-way hash of your IP address and network, a hash of a random device identifier stored in a cookie, and your country. We don’t store your raw IP address or your browser’s full user-agent string. Bot protection is provided by Cloudflare Turnstile.

Emails

We send a confirmation email to verify your address, sign-in links for your dashboard, and, with your consent, waitlist updates and launch communications. Every marketing email has a one-click unsubscribe link.

Cookies

• sk_session: keeps you signed in to your dashboard (essential).
• sk_did: random device identifier for abuse prevention (essential).
• sk_ref, sk_utm, sk_utm_last: remember who invited you and which campaign link you used (30 days).

4. Analytics, error monitoring and ads

If enabled, PostHog product analytics records page views and sign-up funnel steps on the website without your email or name. We use Sentry to detect and fix errors; error reports are stripped of cookies, request bodies and IP headers.

SKYLIN VPN 1.0.0 does not show ads, and advertising pixels are not installed on the website. If that changes, we will update this policy first.

5. Service providers

We use service providers that process information on our behalf under their own security and privacy commitments: Supabase (database), Resend (email delivery), Cloudflare Turnstile (bot protection), Vercel (website hosting), Sentry (error monitoring), PostHog (analytics, if enabled), and the infrastructure providers that host SKYLIN VPN endpoints. Google Play distributes the app under Google’s own privacy policy.

6. Security

We use encryption in transit, keyed hashing of abuse-prevention signals, access controls that keep database credentials on the server only, expiring single-use sign-in and confirmation links, and rate limiting. No system is perfectly secure, but we work to protect your information and to fix problems quickly.

7. Retention and deletion

• Temporary abuse-prevention information: deleted approximately 90 days after you confirm your email (or 90 days after signing up if you never confirm), where applicable.
• Sign-in and confirmation links: expire within 72 hours and are deleted within about a week after.
• Waitlist record: kept until you ask us to delete it or the waitlist program ends.
• VPN connection metadata: kept only as long as needed to operate, secure and troubleshoot the service.

To access or delete your information, email privacy@skylinvpn.com from the address you signed up with. We may keep limited information where the law requires it or to prevent repeat abuse.

8. International processing

Our service providers and VPN endpoints may process information in countries other than yours, including the United States. Where required, we rely on appropriate safeguards for these transfers.

9. Children

SKYLIN VPN and the waitlist are not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

10. Legal requests

We may disclose information when required by valid legal process. We review each request and disclose only what the law requires. Because we do not intentionally store the contents of your browsing, we cannot provide it.

11. Changes to this policy

We will post changes on this page and update the date above. For material changes we will give notice in the app or by email where appropriate.

12. Contact