Privacy Policy

Effective and last updated: 23 July 2026

This policy explains how Whale VPN handles data in its Android application and related account, attribution, reliability and analytics services. Usage Analytics is enabled by default for new installations, can be disabled in the app settings, and is not required for the core VPN service.

1. Account and service data

When you create or use an account, the service processes the credentials and account information needed for authentication, subscription entitlement, device management, billing and support. Passwords are transmitted only to the account service for authentication and are never sent to Google Analytics for Firebase.

2. VPN operation

The app processes subscription configuration, selected routes and network traffic to establish the VPN connection. VPN infrastructure necessarily processes network connections while carrying them. Whale VPN does not send node names, node addresses, gateway domains, SNI, visited domains, destination IP addresses or subscription contents to Firebase Analytics.

3. Usage analytics

Google Analytics for Firebase starts enabled with the Android application and is enabled by default for new installations. You can turn Usage Analytics off or on independently in the Android app settings at any time. Because collection starts from application startup, some startup events can be collected before a previously stored off setting is loaded and applied.

When enabled, Firebase may process an automatically generated app-instance identifier, app lifecycle and session events, app interactions, device/app metadata, and coarse location derived by Google from a masked IP address. Whale VPN also sends custom events for onboarding, verified VPN connection outcomes, confirmed download attribution, and VPN use after at least 16 KB of real proxied traffic.

4. Download attribution

For a direct APK or Google Play install, the app sends a short one-time download token and a 32-character Whale installation identifier to Whale VPN's attribution gateway to match a download with an installation. The Whale identifier is derived on the device from Android's app-scoped system identifier; the original Android system identifier is not transmitted. After the gateway confirms the claim, and only when Usage Analytics is enabled, the app also sends the validated download token, Whale installation identifier and the fixed channel value direct_apk or google_play to Firebase Analytics. This creates an exact link between the gateway download record and Firebase app activity for conversion analysis.

5. Crash reporting

Crash reporting is a separate optional setting. If enabled, Firebase Crashlytics may receive crash diagnostics and device/app metadata needed to investigate stability problems. Turning Usage Analytics on or off does not change the Crashlytics setting.

6. Purposes, processors and transfers

We use data only to provide accounts and VPN connectivity, secure and operate the service, attribute installations, measure aggregate retention, diagnose fixed connection failure categories, and improve reliability. Google acts as a service provider for Firebase Analytics and, when separately enabled, Crashlytics processing. Data is encrypted in transit.

7. Retention and choices

Operational and account records are retained only for the period needed for the purposes above, legal obligations, security and dispute handling. Firebase data follows the retention controls configured for the Whale VPN Firebase property. Turning off Usage Analytics or Crash Reporting stops future collection by that product. To request account or associated data deletion, or ask a privacy question, use the customer-support entry inside the app or contact Whale VPN support on Telegram.

8. Changes

We may update this policy when the app, providers or legal requirements change. The effective date at the top identifies the current version.