ST VPN — Privacy Policy

Last updated: 2026-07-25

ST VPN ("the app") is a VPN and proxy client for Android, published by STService / Intercode. This policy explains what data the app handles and how.

What the app does not collect

• No account registration — there are no usernames, email addresses, or passwords.
• No personally identifiable information is collected or stored by the app or its developers.
• No advertising SDKs, analytics SDKs, or crash-reporting SDKs are included in the app.

Node code login

Instead of an account, the app uses a "node code" that you enter to activate the service. When you submit a node code, the app:

• Queries a DNS TXT record (via a public DNS-over-HTTPS resolver) containing the node code, to check whether it is valid, banned, expired, or already used.
• If valid, retrieves a subscription URL associated with that node code, and uses it to download your VPN/proxy configuration.

The node code itself is not tied to any personal identity we hold — it is an activation code, not a username. The code is cached on your device only, so it doesn't have to be re-entered on every app start.

VPN / proxy traffic

Like any VPN or proxy app, once connected, your network traffic is routed through the proxy servers defined in your downloaded configuration in order to provide the service. This is inherent to how a VPN/proxy client functions.

Permissions

The app requests the following notable permissions:

• VPN service — required to route traffic through the configured proxy/VPN servers.
• Query installed apps — used only for the app's per-app proxy access control feature (letting you choose which installed apps use the VPN). This list is used locally on your device and is not transmitted anywhere.
• Notifications — used to show the VPN connection status.

Data stored on your device

The app stores the following locally on your device only, never transmitted to us:

• Your VPN/proxy configuration profile (downloaded from your subscription URL).
• Login attempt counters and a temporary cooldown timer, used to rate-limit repeated invalid node code attempts.

Third parties

Validating a node code requires sending a DNS query (containing the node code) to a public DNS resolver. Once validated, your device downloads your proxy configuration from the subscription URL associated with your node code, and subsequently routes traffic through the proxy/VPN servers defined in that configuration.

Children's privacy

The app is not directed at children and we do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page.

Contact

Questions about this policy can be sent to business@intercode.se.