Who is responsible for your data
The Xiaoniu VPN apps for iPhone / iPad, Android and Windows and the website vpn.fll8.tv are operated by DIVINE BUSINESS VENTURES LLC ("we"). This policy covers all of these apps and the website.
For any privacy question or request, email 3540259857@qq.com.
Information we collect
Email address: provided when you register or sign in with an email account on iPhone. Used for sign-in, password reset and verification codes. Passwords are stored only as a one-way hash (Argon2id); we cannot see your password.
User ID: the identifier we assign to each account. For login codes we store only a hash of the code and its last few characters, never the full code.
Device ID: a connection key generated randomly on your device when the app is installed, plus the device record we keep (a name such as "This iPhone", platform, assigned tunnel address and last-used time) to enforce your account's device limit. We do not use the advertising identifier (IDFA) or read hardware serial numbers.
Purchase history: for App Store subscriptions, Apple-signed transaction details such as the original transaction ID, product, purchase / expiry / refund dates, and a random identifier with no personal information (appAccountToken) that links the subscription to your account. We never receive your Apple Account, payment card or billing address.
Other diagnostic data: when a connection fails, the app uploads the app version, OS version, device model, connection stage, error code, selected region and time, so we can investigate. Diagnostics never include the sites you visit, traffic content, passwords or full login codes.
VPN traffic and what we do not do
We do not record the content of traffic sent through the VPN and we do not build browsing histories. Route servers keep only the warning and error logs needed to keep the service running.
For security and reliable operation, our website and API servers produce standard access logs (for example IP address, time and requested page). Abuse limits on sign-in and verification codes use keyed hashes of IP addresses, emails or codes rather than the raw values.
The apps contain no advertising or third-party analytics SDKs. We do not sell your information or use it for advertising or cross-app tracking.
How we use information
The information above is used only for app functionality: signing you in and keeping you signed in, verifying subscriptions and login-code entitlements, enforcing device limits, sending verification emails, investigating connection problems, and preventing abuse and protecting accounts.
This information is linked to your account but is not used for tracking (combining it with other companies' data for advertising, or sharing it with data brokers).
Where data is stored
Account, device, purchase and diagnostic data is stored on servers in Hong Kong. Verification emails are sent through Tencent Cloud in Singapore; App Store transactions are processed by Apple. By using Xiaoniu VPN you understand that your information may be processed outside your country or region.
How long we keep it
Account, device and sign-in data: kept while your account exists and permanently deleted when you delete the account. Sign-in sessions expire after 30 days without use, and after 90 days at most.
Verification codes: valid for 15 minutes and deleted automatically about 24 hours after they expire.
Diagnostic data: deleted automatically after 30 days.
App Store transaction records: kept for Restore Purchases, refunds and accounting; after account deletion they are no longer linked to you.
Security audit records: kept after account deletion with user identifiers and email erased. The deletion receipt is removed 30 days after deletion completes.
Server backups: backups made before a deletion may still contain your data until those backups are deleted; backups are kept only on access-restricted servers.
Your rights and account deletion
You can ask to access, correct or delete your personal information. On iPhone you can delete your account in the app (Account > Delete account). For Android or Windows login-code accounts, or any other request, email 3540259857@qq.com.
To protect your account we may need to verify that the request comes from you; we will never ask for your full login code or password. What deletion does is explained on the Account & support page.
Security
We use encrypted connections, store passwords and login codes only as one-way hashes, keep sign-in credentials in the operating system's secure storage, and restrict server access. No online service can guarantee absolute security.
Children
Xiaoniu VPN is not directed at children under 13, and we do not knowingly collect their personal information. If you believe we have, contact us and we will delete it.
Changes and contact
When this policy changes we will post it here with a new effective date. For significant changes to what we collect or why, we will tell you in the app or by email in advance.
Operator: DIVINE BUSINESS VENTURES LLC. Privacy and support email: 3540259857@qq.com. Support page: https://vpn.fll8.tv/account-support.