Privacy Policy

01 Who we are

This policy applies to the IzOne Max mobile application (ma.izone.max) distributed on Google Play, and to the backend service the app talks to. In this document, “IzOne Max”, “we” and “us” mean the publisher of that application, who is the data controller for the information described here.

For any privacy question, or to exercise the rights in section 12, write to [YOUR-PRIVACY-EMAIL]. We also run a community channel at t.me/izonemaxpro, but privacy requests should go to the email address so we have a written record.

02 The short version

• No account. You do not register, and we never ask for your name, email address, or phone number.
• No browsing logs. We do not record the websites you visit, your DNS queries, or the contents of your traffic.
• We do collect a device identifier and technical device information, which we need to run the service and enforce abuse limits.
• If you turn analytics on, we record which apps used the tunnel and how many bytes each one moved. This is off unless you opt in, and you can turn it off again at any time. See section 05 — please read it.
• The app shows ads through Google AdMob, which uses its own identifiers.

03 What the VPN does not log

IzOne Max routes your device’s network traffic through a VPN server so it is encrypted in transit. Because a VPN sits in the path of everything your device sends, we want to be explicit about what we do not keep:

• We do not log the contents of your traffic.
• We do not log the websites, domains, or IP addresses you connect to, and we do not keep DNS query logs.
• We do not store your full originating IP address. Where an address is needed to answer a request, it is coarsened to a prefix before being written down.
• We do not sell your data, and we do not share it with data brokers or advertisers beyond the ad SDK described in section 09.
• We do not use the VPN connection to inject, modify, or redirect your traffic.

The VPN is only ever active after you grant Android’s system VPN permission and press connect. Android displays a persistent key icon in your status bar for as long as the tunnel is up. Disconnecting in the app tears the tunnel down.

04 What we collect

Everything the app collects is listed below. Nothing outside this table is sent to our servers.

We do not collect your name, email address, phone number, contacts, photos, files, calendar, SMS, call logs, precise or GPS location, or any payment information.

05 App-usage measurement

How it works and what limits it:

• It runs only while the VPN is connected, and only if you have opted in to analytics. It is off by default.
• It records the app identity and byte totals. It does not record what those apps sent, who they talked to, or which sites or accounts were involved.
• Totals are aggregated into windows of several minutes, not per connection. Apps that move only a trivial amount of data in a window are dropped, and a limited number of apps are reported per window.
• Turning analytics off in Settings stops this collection immediately.

We treat this as the most sensitive thing the app collects, which is why it is opt-in and called out separately here. If you would rather not share it, leave analytics off — the VPN works exactly the same either way.

06 Permissions the app requests

07 Why we use this data

We use the data in section 04 only to:

• establish and maintain your VPN connection;
• keep track of your connection time balance and the rewards that top it up;
• recommend servers suited to your carrier and region;
• detect and block abuse of the service, including blocking devices that break our terms;
• diagnose crashes, failures, and capacity problems;
• show ads, which is how the free tier is funded;
• send you service notices, if you have allowed notifications.

We do not use it to build advertising profiles ourselves, and we do not sell it. Under the GDPR, our lawful bases are contract (running the VPN you asked for), legitimate interests (security and abuse prevention), and consent (analytics, personalized ads, and notifications).

08 Third-party services

IzOne Max includes the following third-party SDKs. Each handles data under its own privacy policy, which we do not control.

These SDKs may collect device and advertising identifiers, coarse location inferred from IP address, and interaction events, in line with their own policies.

09 Advertising and consent

IzOne Max is free and funded by ads. Watching a rewarded ad is one of the ways you can earn connection time; you are never required to watch one, and declining costs you nothing but the reward.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the app shows a Google-certified consent dialog before serving personalized ads, and records your choice. You can reopen that dialog at any time from Settings → Privacy options to change or withdraw your consent. On Android you can also reset or delete your advertising ID in Settings → Google → Ads.

10 How long we keep data

• On your device: your time balance, preferences, and cached server list stay until you clear the app’s data or uninstall it.
• Device records: kept while the install is active, so your balance and any block survives an app restart.
• Analytics events: retained in aggregate for service analysis and deleted or aggregated beyond recovery once no longer needed for that purpose.
• Session keys: encryption sessions expire automatically, by default within 24 hours.
• Push tokens: deleted when you disable notifications, or pruned once the token is dead.

11 How we protect it

• All traffic between the app and our backend runs over HTTPS. Release builds refuse plain-text connections outright.
• On top of HTTPS, the app and backend negotiate a per-session key (X25519 key agreement) and encrypt API responses with AES-256-GCM. The app verifies an Ed25519 signature from the server on every new session, so a device cannot be fed a forged server list.
• Requests are signed and single-use, so a captured request cannot be replayed.
• Sensitive values stored on your device are encrypted with keys held in the Android Keystore, which is backed by device hardware where available.
• No permanent shared secret is embedded in the app, so extracting the APK does not yield a key that unlocks anyone’s data.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please report it to [YOUR-PRIVACY-EMAIL] before disclosing it publicly.

12 Your choices and rights

Controls in the app

• Turn analytics off in Settings. This stops connection events, screen views, and the app-usage measurement in section 05.
• Change ad consent from Settings → Privacy options.
• Turn notifications off in Settings or in Android; the push token is then deleted.
• Decline the phone-state permission to stop carrier detection.
• Clear local data from within the app, or uninstall it to remove everything stored on the device.

Legal rights

Depending on where you live — including under the GDPR in the EEA and UK, and under Morocco’s Law 09-08 on the protection of personal data — you may have the right to access the data we hold about you, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time.

To exercise any of these, email [YOUR-PRIVACY-EMAIL]. Because we deliberately hold no account or contact details, we will ask you for your in-app device identifier so we can locate your records — without it we may be unable to identify your data, and we will tell you so rather than guess. We aim to respond within 30 days. You also have the right to complain to your local data protection authority.

13 Children

IzOne Max is not directed at children and is not intended for anyone under 13 (or the minimum age of digital consent where you live, whichever is higher). We do not knowingly collect data from children. If you believe a child has used the app and provided data, contact us and we will delete the associated records.

14 International transfers

Our backend and database are hosted with cloud providers whose infrastructure may be located outside your country, and our VPN servers are by design in a range of countries. The third parties in section 08 are US-based and operate globally. Where data is transferred out of the EEA or UK, it is done under an approved safeguard such as the European Commission’s standard contractual clauses.

15 Changes to this policy

We may update this policy as the app changes. The effective date at the top always reflects the current version. If a change materially affects what we collect or why, we will tell you in the app before it takes effect, and where the law requires it we will ask for your consent again.

16 Contact

Questions about this policy, or about the data we hold on your device: