How PDG Global Limited handles information in connection with the rVPN protocol and client applications.
PDG Global Limited ("we," "our," or "us") is committed to protecting your privacy. This privacy policy explains how we handle information in connection with the rVPN protocol and client applications ("Software").
Important: rVPN is open-source protocol software. Most users deploy and operate their own rVPN server. When you self-host a server, you are the data controller. We have no access to your server, its configuration, or any data that passes through it. This privacy policy governs the client applications we distribute and any servers operated by PDG Global Limited.
Our code is publicly available on GitHub for anyone to audit. We operate under a zero-logs architecture by design. Our protocol ensures that even the server operator cannot decrypt user traffic.
rVPN is designed with privacy as its foundational principle. The following data is never collected, stored, or logged by our client applications or any server operated by PDG Global Limited:
Our desktop and mobile client applications minimize data exposure.
Our client applications do not collect, store, or transmit any usage logs. This has been independently verified and submitted to Apple as part of the App Store review process.
Our applications do not collect or transmit crash reports. We do not use any crash analytics or telemetry services. Diagnostic data remains on your device.
Our client applications connect only to the rVPN server that you configure and operate. The application does not connect to any other internet service, API, or endpoint. It does not "phone home" or communicate with PDG Global Limited.
While our desktop and mobile client applications are closed-source, they are built on the rvpn-mobile library, which is fully open-source and available on GitHub. You can audit the core protocol implementation to verify our privacy claims.
rVPN server software is open-source and self-hosted. When you deploy and operate your own rVPN server:
Protocol-level privacy: because the rVPN protocol uses end-to-end encryption, even as a server operator you cannot decrypt user traffic. This is a feature of the protocol, not a policy choice.
If you connect to an rVPN server operated by PDG Global Limited or an affiliated commercial provider, the following applies:
The server stores prekey bundles (public keys) for initial key exchange. These are cryptographic public keys and contain no personal information. They are deleted after use or expiration.
Each server maintains an identity key pair for authentication. The public key is distributed to clients for verification. The private key never leaves the server.
During an active connection, the server maintains cryptographic state (ratchet keys, chain keys) for encryption. This state is held only in memory and is permanently destroyed when the session ends.
Server access is protected by a shared password known only to the operator and authorised users. We do not store, transmit, or have access to user passwords.
Data retention: because we do not collect browsing data, traffic logs, connection timestamps, or IP addresses, there is no data to retain, delete, or hand over to third parties. Active session state exists only in volatile memory and is destroyed on disconnect.
Law enforcement requests: rVPN's zero-logs architecture means we have no data to provide in response to subpoenas, warrants, or court orders. We cannot produce what we do not possess.
If compelled to disclose information, we will challenge the request in good faith and notify affected users unless legally prohibited from doing so.
Changes to this policy: we may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date. Material changes will be communicated through our website or application.
Contact us:
PDG Global Limited
Level 23, 99 Hennessy Road, Wanchai, Hong Kong
Email: privacy@rvpn.org