Privacy Policy

1. Who we are

Rampart VPN (the “App”) is developed and operated by NOSEYBOARD LTD, a private limited company registered in Scotland under company number SC900910, with its registered office at 4 Weston Place, Prestwick, KA9 2ED, United Kingdom (“we”, “us”). We are the controller of the information described in this policy under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. Where the EU General Data Protection Regulation applies to people in the European Union, we follow it as well.

2. What this policy covers

This policy covers version 1 of the App, the VPN service it connects to, and this website. If a later version changes how data is handled — for example by adding subscriptions — we will publish an updated policy before that version is released.

3. Information we don’t collect

We do not collect, and the App never sends us:

• your name, email address or phone number;
• your browsing history, the websites and apps you use, or your DNS queries;
• the content of your internet traffic;
• your contacts or photos;
• your precise location;
• your advertising identifier.

4. Information the App sends to our servers

Device registration. The first time you connect, the App creates a random cryptographic key on your iPhone and registers it with our servers. It sends the public part of that key, together with the platform (iOS), your iOS version and the App version. Our servers then create a random device ID and an anonymous account code. These are not linked to your name, email or Apple Account. The App stores them in the iOS Keychain, so they may stay on your iPhone after the App is deleted and restore your access if you reinstall it. Our servers keep the device ID, account code, public key and platform, and when the device was registered and last seen.

VPN access. To set up the encrypted tunnel, the App sends a public tunnel key, and our servers assign your device a temporary private address inside the VPN. Our servers keep a record of when access was granted, renewed or released, together with that private address — not your public IP address.

Connection diagnostics. To keep connections reliable and to fix problems, the App sends technical reports linked to the device ID:

• the result of each connection attempt, error codes and messages, the stage at which an attempt failed, the VPN servers and ports tried, the connection mode used, retries and timings;
• the type of network you are on, such as Wi-Fi or mobile data;
• session events — when the tunnel starts and stops, network changes, sleep and wake — and how long a session lasts;
• how much data was transferred during a session — the amount only, never the content;
• how much memory the App’s VPN extension uses;
• the country of the server you chose, and the App and iOS versions.

These reports never include the websites you visit, the content of your traffic or your public IP address.

Feature check. Our servers periodically look up your anonymous account code with Adapty, our subscription-management provider, to determine which features and server locations your device may use. Only the account code is sent. This version of the App offers no purchases and does not contain Adapty’s software.

IP address. Our servers necessarily see the IP address your iPhone connects from. The VPN servers use it only to carry your traffic while you are connected and do not record it. Our API server — which the App uses to register and get access — records the IP address, the time and technical details of each request in its logs. We use these logs only to run and secure the service, and we do not use your IP address to identify you.

DNS. While you are connected, your DNS lookups are handled by our VPN server and forwarded to the public resolvers of Cloudflare (1.1.1.1) and Quad9 (9.9.9.9). They see the VPN server’s address, not yours, and we do not record these lookups.

Connection checks. After connecting, the App checks that the tunnel works by contacting test addresses of Cloudflare (1.1.1.1) and Google (gstatic.com) through the VPN. These requests come from the VPN server’s address and carry no information about you.

When you contact us. If you email us, we receive your email address and your message, and we use them only to answer you.

Crash reports. This version of the App contains no crash-reporting tools. If you have chosen in your iPhone’s settings to share analytics with app developers, Apple may provide us with crash reports and diagnostics in line with Apple’s own privacy policy.

5. How we use information, and our legal bases

• To provide the VPN: register your device, give it access and connect it to a server — necessary for our agreement with you (Article 6(1)(b) UK GDPR).
• To keep connections reliable and to find and fix problems — our legitimate interest in running a working service (Article 6(1)(f)).
• To protect the service from abuse and attacks — our legitimate interest in security (Article 6(1)(f)).

The App asks for your agreement to this data use when you first open it. We do not use this information for advertising or profiling, and we never sell it. You can object to processing based on legitimate interests at any time (section 10).

6. No third-party tools in the App

This version of the App contains no analytics platforms, advertising SDKs, crash-reporting or tracking tools, or marketing tools.

7. Where data is processed, and who receives it

• Our servers. The API server is hosted in Germany. VPN servers are located in the Netherlands, the United Kingdom, Canada, the United States, Singapore, Australia and Germany. They are run by hosting providers that process data only on our instructions.
• Backups. Registration and access records are backed up every hour. Backups are kept for 48 hours on the API server and for 35 days on a backup server in the United States. Connection diagnostics are not included in backups.
• Adapty receives the anonymous account code, as described in section 4.
• This website is hosted by Hetzner Online GmbH on servers in Finland, with Cloudflare, Inc. providing DNS and content delivery (section 8).

Transfers outside the United Kingdom rely on UK adequacy regulations where they exist (for example for the European Economic Area and Canada), and otherwise on the International Data Transfer Agreement or Addendum issued by the Information Commissioner, or the UK Extension to the EU–U.S. Data Privacy Framework. We do not sell or share your information. We may disclose information if the law requires it — but we cannot hand over what we do not have, such as your browsing history.

8. This website

This website sets no cookies and runs no analytics, advertising or tracking code. Its server keeps a standard log of each request — IP address, time, address requested, referring page and browser user-agent — for 14 days, to deliver the site and protect it against abuse.

9. How long we keep it

• Connection diagnostics: up to 30 days; memory reports: up to 2 days.
• API server logs with IP addresses: the web server’s logs are deleted after 14 days; the application’s logs are deleted automatically as they rotate, by age or by size.
• Registration and access records: while your registration exists. You can ask us to delete them at any time.
• Backups: 48 hours on the API server, 35 days on the backup server.
• Website logs: 14 days.
• Emails to support: as long as needed to answer, then up to 24 months.

10. Your rights

You have the right to access, correct or delete your information, to object to or restrict its use, and to receive a copy of it. To exercise these rights, write to us. Because we do not know who you are, we may need your help to find the information linked to your device. We answer within one month.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority: ico.org.uk, telephone 0303 123 1113. If you live in the European Union, you may complain to the data protection authority in your country.

11. Children

The App is not intended for children under 16, and we do not knowingly collect their information.

12. Security

Connections between the App and our servers are encrypted, requests from the App are signed with its device key, and access to our servers is limited to the people who run the service.

13. Changes

We will update this policy when the App, the service or the law changes. The current version is always on this page with its effective date; significant changes will also be announced in the App.

14. Contact