EroxNet Privacy Policy
Last updated: October 10, 2026
This Privacy Policy explains how EroxNet handles information when you use its Android VPN application and related services. For privacy questions or requests, contact support@eroxnet.com.
1. VPN service and network traffic:
EroxNet uses Android's VPN service and Xray-based networking components to provide VPN connectivity. Traffic routed through the VPN is processed to establish and maintain connections between your device, VPN servers, and the services you access.
The VPN is designed to encrypt traffic between your device and the VPN endpoint. Protection beyond that endpoint also depends on the destination service and its use of encryption, such as HTTPS. A VPN does not make every internet activity anonymous or guarantee complete security.
EroxNet does not sell the contents of your VPN traffic or use those contents to build advertising profiles. Technical connection information is processed to operate the service, manage access, prevent abuse, and investigate failures.
2. Information processed by EroxNet
Depending on your app version and the features you use, EroxNet may process:
- Device identifiers, including Android ID (Settings.Secure.ANDROID_ID), to authorize devices, manage VPN access and configurations, correlate technical reports, and prevent abuse.
- IP addresses observed by our servers when receiving requests or reports. An address may be your internet connection's address or a VPN exit address, depending on the route used at the time of transmission.
- Device manufacturer and model, Android version and API level, app version, and available operating-system or firmware build information. On supported devices this may include a MIUI or HyperOS version and a ROM branch inferred from its build suffix. A build suffix does not establish your physical location.
- The language selected in the app, event timestamps, elapsed time, and process information used to interpret technical reports and apply service configuration.
- Local network-status samples, such as whether Android reports an active VPN network, no active network, or an unavailable network-status check. These samples describe local connection state; they are not records of browsing content.
- In-app advertising diagnostics, including ad placement and ad-unit identifiers, load-attempt and request identifiers, load success or failure, retry, timeout, cancellation, display, dismissal, late SDK callbacks, and SDK diagnostic or test-device identifiers when available.
- App-run and event identifiers that associate related reports from the same device or operation.
These technical reports are associated with device identifiers and are not necessarily anonymous. We use them for app functionality, security, troubleshooting, and service reliability. Information unavailable in older app versions is not reconstructed from the device model.
3. Application authentication and security:
EroxNet uses security mechanisms such as signed requests, challenge-response verification, and application or device verification to help prevent unauthorized access.
For these checks, our systems may process public certificates and certificate chains, public keys, application-signing information, challenges, and signatures. Security diagnostics may include verification results, certificate validity dates and fingerprints, and limited certificate-extension information needed to investigate a failed verification. Certificate fingerprints in these reports refer to certificates, not biometric fingerprints.
Authentication private keys are managed through Android Keystore and are not included in the diagnostic reports. Authentication reports do not store passwords or session credentials. Credentials supplied to a sign-in feature are processed to authenticate access.
The app receives the connection configuration and access credentials needed to use the VPN. Administrative credentials, management tokens, and internal service secrets are not intended for inclusion in user-facing configurations.
4. Subscriptions and purchases:
Where subscription or Premium features are available, EroxNet processes information needed to provide and verify access, such as device authorization, plan or product identifiers, subscription status, expiration, and applicable traffic limits.
For Google Play purchases, our backend may process purchase tokens and purchase or renewal details to verify entitlement, prevent reuse, and manage subscription access. Google Play handles payment processing under its own terms and privacy practices; purchase verification does not require you to provide payment-card details to EroxNet.
5. Google AdMob and advertising choices:
EroxNet uses Google AdMob to display in-app advertisements where enabled. Google's advertising SDK may collect and share IP addresses, advertising or app-set identifiers, app and advertising interactions, and performance or diagnostic information for advertising, measurement, and fraud prevention. IP addresses may be used to estimate approximate location.
The advertising identifier is different from the Android ID used by EroxNet for service authorization and diagnostics. Advertising behavior depends on SDK configuration, availability, your privacy choices, and applicable requirements.
Where applicable, the app presents Google's consent or privacy-choice interface. You can also manage advertising-ID controls in Android settings and Google's advertising preferences. Choosing non-personalized or limited advertising does not necessarily eliminate all technical data processing.
6. Firebase services:
EroxNet uses Firebase services for app analytics, crash reporting, and push notifications.
Google Analytics for Firebase may process app-instance identifiers, device and app information, and app-usage events to understand use and improve the service. In the current app, analytics collection is controlled by the app's consent and service-readiness logic. Firebase Analytics advertising-ID collection is disabled in the current app configuration; that setting does not disable AdMob's separate advertising-ID processing.
Firebase Crashlytics collects crash and diagnostic reports, which can include stack traces, installation identifiers, device and operating-system details, and information about the app at the time of a failure. In the current app, crash-report collection is enabled at startup and is separate from the analytics-collection setting.
Firebase Cloud Messaging processes installation identifiers and messaging tokens to deliver service notifications. You can manage notification permission through Android settings. Denying notification permission affects notification display and does not necessarily prevent Firebase from processing installation or messaging identifiers.
7. Sharing and service providers:
EroxNet does not sell personal information. Information is processed by our backend and infrastructure providers as needed to host and operate the service, protect it against abuse, and investigate technical failures. Google processes information through the services described above. Third-party processing is not limited to data stored in EroxNet's own report panel.
Information may also be disclosed where legally required or necessary to protect the service and the rights or safety of others, subject to applicable law.
8. Retention:
The current backend retains the AdMob diagnostic reports and application-authentication report events described above for up to seven days. Each of these report stores also has an event-count limit, so some reports may be removed sooner. This limit does not apply to every operational record or to data retained by Google.
Device authorization, active service or subscription records, purchase-verification records, and other operational information are retained as needed to provide access, manage purchases, address abuse or disputes, and meet applicable obligations. Local app settings and temporarily queued reports may remain on your device until processed or removed.
Firebase, Analytics, AdMob, and other service providers apply their own retention settings and policies. For example, Firebase's published policy describes a separate retention period for Crashlytics reports and associated identifiers. EroxNet's seven-day report-panel limit does not control that period.
9. Your choices and requests:
You can stop VPN use, manage available advertising and privacy choices, manage Android notification permission, and clear local app data or uninstall the app. Clearing app data or uninstalling does not itself delete information already received by our servers or service providers.
For access, correction, or deletion requests, contact support@eroxnet.com. Include enough information to identify the relevant service or device records, but do not send passwords, authentication private keys, or payment-card details. We may need to verify that the request concerns your records. Some information may need to be retained for security, purchase verification, legal obligations, or unresolved disputes; where applicable, we will explain the reason.
10. Security and changes:
EroxNet uses measures such as encrypted communications, protected administrative access, request authentication, access restrictions, and rate limiting. No transmission or storage system can be guaranteed completely secure.
We may update this policy when the app, data handling, or applicable requirements change. The revision date appears above. Where required, material changes will be accompanied by an in-app notice or a request for consent.
Contact: support@eroxnet.com