Privacy Policy
Last updated: 9 April 2026
01 Introduction
PDG Global Limited ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we handle information in connection with the R-VPN protocol and client applications ("Software").
Important: R-VPN is open-source protocol software. Most users deploy and operate their own R-VPN server. When you self-host a server, you are the data controller — we have no access to your server, its configuration, or any data that passes through it. This Privacy Policy governs the client applications we distribute and any servers operated by PDG Global Limited.
Open-Source by Design
Our code is publicly available on GitHub for anyone to audit. We operate under a zero-logs architecture by design — our protocol ensures that even the server operator cannot decrypt user traffic.
AUDIT OUR CODE02 Data We Do Not Collect
R-VPN is designed with privacy as its foundational principle. The following data is never collected, stored, or logged by our client applications or any server operated by PDG Global Limited:
Browsing Activity
We do not log websites visited, URLs accessed, or DNS queries made.
Traffic Content
All data is end-to-end encrypted using the Double Ratchet Algorithm. The server relays encrypted packets but cannot decrypt them.
Connection Timestamps
We do not record when you connect or disconnect from the server.
IP Addresses
We do not log your real IP address or the IP address assigned by the tunnel.
Bandwidth Usage
We do not track how much data you transfer through the tunnel.
Session Metadata
We do not record session duration, frequency, or usage patterns.
03 Client Application Privacy
Our desktop and mobile client applications are designed to minimize data exposure:
3.1 No Logs
Our client applications do not collect, store, or transmit any usage logs. This has been independently verified and submitted to Apple as part of the App Store review process.
3.2 No Crash Reports
Our applications do not collect or transmit crash reports. We do not use any crash analytics or telemetry services. Diagnostic data remains on your device.
3.3 Limited Network Access
Our client applications connect only to the R-VPN server that you configure and operate. The application does not connect to any other internet service, API, or endpoint. It does not "phone home" or communicate with PDG Global Limited.
3.4 Open-Source Foundation
While our desktop and mobile client applications are closed-source, they are built on the rvpn-mobile library, which is fully open-source and available on GitHub. You can audit the core protocol implementation to verify our privacy claims.
04 Self-Hosted Servers
R-VPN server software is open-source and designed to be self-hosted. When you deploy and operate your own R-VPN server:
-
You are the data controller.
PDG Global Limited has no relationship with your users, no access to your server, and no responsibility for your data handling practices.
-
We do not collect server data.
Your server does not transmit any data back to PDG Global Limited. We do not operate any central server, telemetry endpoint, or remote management service.
-
You are responsible for compliance.
You must ensure your deployment complies with applicable laws in your jurisdiction.
Protocol-Level Privacy
Because the R-VPN protocol uses end-to-end encryption, even as a server operator you cannot decrypt user traffic. This is a feature of the protocol, not a policy choice.
05 PDG-Operated Servers
If you connect to an R-VPN server operated by PDG Global Limited or an affiliated commercial provider, the following applies:
5.1 Prekey Bundles
The server stores prekey bundles (public keys) for initial key exchange. These are cryptographic public keys and contain no personal information. They are deleted after use or expiration.
5.2 Server Identity Keys
Each server maintains an identity key pair for authentication. The public key is distributed to clients for verification. The private key never leaves the server.
5.3 Active Session State
During an active connection, the server maintains cryptographic state (ratchet keys, chain keys) for encryption. This state is held only in memory and is permanently destroyed when the session ends.
5.4 Password Authentication
Server access is protected by a shared password known only to the operator and authorized users. We do not store, transmit, or have access to user passwords.
06 Data Retention & Law Enforcement
Data Retention
Because we do not collect browsing data, traffic logs, connection timestamps, or IP addresses, there is no data to retain, delete, or hand over to third parties. Active session state exists only in volatile memory and is destroyed on disconnect.
Law Enforcement Requests
R-VPN's zero-logs architecture means we have no data to provide in response to subpoenas, warrants, or court orders. We cannot produce what we do not possess.
If compelled to disclose information, we will challenge the request in good faith and notify affected users unless legally prohibited from doing so.
07 Changes & Contact
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Material changes will be communicated through our website or application.