BULBVPN SECURE TUNNEL
Legal

Privacy policy

The short version: the app has no accounts, does not upload your browsing history. Release builds do not show a session log. It does talk to a small, fixed set of remote services — each named below — and routes your traffic through community-run VPN servers.

Effective · 28 October 2026 Applies to · BULBVPN Android app & this website

1. Scope

This policy covers the BULBVPN Android application and this website, operated by the BULBVPN project ("we"). It describes what information is processed when you install the app, connect to a VPN endpoint, run a speed test, or browse this site.

BULBVPN does not require an account. We do not know who you are, and we do not want to find out.

2. What we collect

We collect only the following categories of information:

  • Usage events via Firebase Analytics — how the app's connection features are used, described in section 3.
  • Advertising data via Google AdMob — advertising identifiers, IP address, device and app information, approximate location derived from the IP address, and ad interaction data, described in section 4. This applies to the free, ad-supported build.
  • Standard Google Play / Firebase technical data — such as app version, device model, operating system version, and crash diagnostics that Google processes on our behalf under the Google Privacy Policy.
  • Your public IP address, transiently — when the app looks up your post-connection exit IP (section 5), that lookup is performed by Cloudflare; we store no result beyond rendering it on your screen.
We do not collect: your name, email, phone number, payment details (there is no billing), the domains or addresses you visit through the tunnel, DNS queries, or the contents of any traffic.

3. Analytics events

The app integrates Firebase Analytics (Google Ireland Limited, governed by the Google Privacy Policy). The following events may be sent:

EventPayloadWhen
vpn_connect_attempt connection method You tap connect
vpn_connected connection method, server name, connection duration Tunnel established / closed
vpn_disconnected — You disconnect
connection_method_changed new method You change connection preferences
server_selected server name You pick a server from the list

You can limit or reset analytics at any time through the Android system settings for Google Play Services, or by using Google's Ads Settings and My Activity controls.

4. Advertising (Google AdMob)

The free build of the app shows banner ads served by Google AdMob (Google Ireland Limited / Google LLC). To serve and measure ads, the Google Mobile Ads SDK may collect and process: advertising identifiers (the Android Advertising ID; on iOS the identifier for advertisers, only if tracking permission is granted), IP address, device and app information, approximate location derived from the IP address, ad interaction data (impressions, clicks), and diagnostics. We do not receive your name, accounts, or browsing history from Google; we receive aggregate performance reports.

Where the law requires it (EEA, UK, Switzerland), a Google-certified consent form asks whether personalised advertising is allowed before any ad is requested. You can reopen that choice from Settings → Ad privacy options. Declining personalised ads does not remove ads; it makes them non-personalised.

Google's handling of this data is governed by the Google Privacy Policy and AdMob's data policies. Ads are not directed at children; the app requires users to be 18 or older.

5. Remote services the app contacts

Beyond the VPN tunnel itself, the app makes outbound requests to exactly these kinds of services:

  • Server list mirror — a public JSON file on GitHub's raw content CDN (raw.githubusercontent.com) containing community VPN Gate server records (host name, country, IP, latency, session counts, operator notes, and OpenVPN profiles). Fetched on each connection or list refresh.
  • Exit-IP lookup — www.cloudflare.com/cdn-cgi/trace, which returns the public address and network attributes of the connection leaving the tunnel. Used solely to display your exit IP on the home screen.
  • Speed measurement — speed.cloudflare.com, contacted while a throughput test runs. Payload: timing samples of synthetic download/upload requests. No identifiers are attached.
  • Connectivity probe — www.google.com/generate_204, a standard Android-style reachability check used to decide whether the network is online.
  • VPN endpoints — the community servers you connect through; see section 6.

6. Community VPN endpoints

BULBVPN connects you to third-party community servers from the VPN Gate project. These operators are independent of us and can observe that traffic is passing through their machine — including your incoming IP address and the destination addresses of your traffic. Choose endpoints accordingly.

Before any tunnel starts, Android shows its system VPN connection request. Accepting that request is user consent for BULBVPN to route this device's traffic through the endpoint you picked. That system dialog is the prominent disclosure of what the VPN does: it carries your traffic; we do not upload a browsing history.

  • Endpoint metadata (operator name, country, uptime, public stats) comes from the public VPN Gate dataset and may be attributed to the community operator who published it.
  • Server availability, latency, and trustworthiness vary; the app shows this data so you can decide where to connect.
  • While tunneled, websites you visit see the endpoint's address instead of yours — that is the point of the product — but they are still the sites you visit, under their own privacy policies.

7. Session logs

Debug builds can keep a plain-text log of connection events (initialization, server selection, handshake progress, state changes, errors) on the device. Release builds do not show that log. It is not uploaded. If you attach a debug log to a bug report voluntarily, you do so yourself, and the report may include the server IP you connected through — review it before posting.

8. This website

  • No tracking cookies. Firebase Hosting serves these pages; it does not set analytics cookies of its own.
  • Live server list. Your browser fetches the same public server-list JSON from GitHub's CDN when you open the app page; the response is cached in your browser's local storage for six hours to avoid refetching.
  • Fonts. Google Fonts serves the typefaces used on these pages; standard IP-level processing applies under Google's policies.

9. Children

The app and this site are not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect data from them.

10. Changes

If the app's data practices change — new events, new remote services, new SDKs — this policy will be updated and the effective date revised. Continued use after a revision means you accept the updated policy.

11. Contact

Questions about this policy can be sent to hasanabbassorathiya12@gmail.com.