NODIF privacy notice

1. What stays on your device

Your subscription URL, access token, device HWID, raw VPN configurations, server hosts and addresses, and route history are used locally to connect and choose routes. They are not part of routine NODIF analytics.

The app keeps a small rotating diagnostic timeline for up to 7 days. It contains coded tunnel stages, timings, state changes, and redacted error categories. It excludes browsing activity, credentials, subscription links, raw server addresses, and packet content. You can copy or clear it in Settings; it is not uploaded automatically.

2. Optional service-improvement telemetry

“Help improve NODIF” is off by default. The VPN works if you decline. If you opt in, the app may send typed operational events about connection attempts, route measurements, route switches, session summaries, app lifecycle, platform and app version, and coded app errors.

Quality fields may include bounded handshake time, latency, jitter, packet-loss percentage, download/upload rate, route score, connection stage, protocol, transport, entry and balancer categories, and a coarse route-shape category such as direct, provider-balancer, clean-IP-fronted, domain-fronted, two-hop, or multi-hop. These are fixed labels—not endpoint values. Random NODIF catalog IDs are permitted only for provider-owned infrastructure registered with NODIF; arbitrary third-party hosts or configurations never receive a stable endpoint ID.

3. Coarse network context

Before the VPN starts, and only after opt-in, the service may use the source IP momentarily to derive coarse country, region/city, and network/ASN categories. The full IP is discarded immediately and is not written to application, proxy, access, analytics, or cache logs. NODIF does not use GPS. Upload traffic after connection is never treated as the user’s location because it may come from a VPN exit.

4. What NODIF does not collect

• Browsing destinations, URLs, search history, DNS queries, packet content, or traffic payloads
• Subscription URLs or tokens, VPN credentials, raw configurations, HWIDs, Wi-Fi SSIDs, or exact device location
• Free-form client logs or stack traces in routine telemetry
• Exact provider hosts/IP addresses derived from third-party subscriptions

5. Retention and security

An opted-in pending queue is encrypted on the device and expires after 7 days. Raw typed events are designed to expire after 30 days. Cohort aggregates may be retained for up to 395 days to compare service trends. Uploads use HTTPS, credentials are stored using platform-secure storage, and administrative access is separated, authenticated, rate-limited, and audited.

6. Provider analytics

VPN providers may receive only tenant-isolated aggregate reports for eligible operational categories. Every cohort row is withheld until the configured minimum number of distinct opted-in installations qualifies; the current production threshold is 20. Eligible Ultimate providers may receive recommendation-only guidance derived from those protected cohorts, such as testing a route shape or recovery policy in a canary group. Guidance never exposes another provider’s infrastructure, individual installation or session identifiers, raw events, source IPs, or exact host values. NODIF does not sell or expose individual event records, raw IPs, precise location, subscription data, browsing activity, or cross-provider user profiles.

7. Branding and provider links

Subscription responses may point NODIF to a provider ID and an opaque branding token. Branding is accepted only from a fixed NODIF control service and only after signature, expiry, schema, URL, asset, and contrast checks. Provider support, renewal, and privacy pages open only after a user action in the external browser. Branding tokens are not included in telemetry.

8. Provider access requests

If a VPN provider submits the onboarding form, NODIF processes the contact name, work email, provider or company name, requested plan, approximate active-user range, subscription platform, consent choice, and the message derived from those selections. These details are used only to review and respond to the request, are kept separately from VPN telemetry, and are automatically deleted after the configured lead-retention window. They are not added to a marketing list.

9. Choice, deletion, and rights

You can turn telemetry off at any time. NODIF then clears the encrypted pending queue, revokes the random telemetry identity, and requests deletion of associated raw events. Aggregates that can no longer identify or single out an installation may remain. You may request deletion of provider-contact details through the privacy address below. Applicable privacy law may also give you rights to access, correct, delete, restrict, or object to processing.

10. Contact and launch details

Privacy contact: privacy@nodif.app. The operator’s registered legal name, address, applicable jurisdiction, subprocessors, and any international-transfer mechanism must be added and legally reviewed before general public release.

11. Optional per-server test reports

A deep test temporarily stops the VPN to compare direct internet with the selected VPN entry, after a clear warning and confirmation. Up to 20 reports remain in encrypted device storage for up to 30 days. Saving does not upload them.

Choosing “Share with NODIF” separately for a report sends its random Test ID, timestamps, outcomes, app version/platform, protocol, entry/balancer counts, per-test salted route fingerprint and quantitative measurements. It excludes subscription credentials, raw configurations, server names/hosts/IPs, device/install identifiers and browsing activity. Only authenticated master admins can look up individual reports; providers cannot.

Encrypted pending shares and deletions retry with bounded backoff while the app is active. New reports can be submitted within seven days of testing. Shared copies expire after 30 days. Deleting a report, or displacing it from the bounded local history, queues deletion of any shared copy; a temporary retired-ID marker prevents old uploads from recreating it. This support feature is separate from aggregate telemetry consent. Transport addresses are used transiently for abuse prevention, not added to test reports. Measurements are client-reported, not independently verified.