SXB VPN - Privacy
Content version: 2026-09-09
Operator
Legal identity not confirmed. SXB VPN is the application name, not a verified legal entity.
Public contact
vpnsxb@gmail.com
Service and necessary data
SXB VPN is a VPN client using access codes and profiles. Activation and service use send account/client and device identifiers, activation codes, plan associations, upload/download volumes, quotas, dates and session actions to the backend. These support configuration delivery, access control, plan accounting and troubleshooting. Some historical records contain a name, email or phone supplied separately to the service or a reseller. The current mobile app does not call the legacy registration or status routes: their presence in the backend does not constitute automatic phone-number collection by the app.
Logs and diagnostics
The API logs IP address, route, method, status, duration and a request identifier; infrastructure may timestamp these logs. Activation and session actions also create audit records, and some sessions store IP address and user agent. Mobile technical reports may send app version, Android version, model, protocol, connection state/error, durations, reconnects and activity/battery indicators. The server associates them with a pseudonym calculated from account and device identifiers. Pseudonymous does not mean anonymous. The report schema rejects hosts, IP addresses, passwords and raw logs. SXB VPN does not promise a no-logs service.
VPN traffic and third parties
The tunnel routes traffic to the VPN endpoint in the selected profile. The VPN operator and DNS resolver process the necessary connections and queries; their logging practices require confirmation. Some DNS paths use Cloudflare (1.1.1.1), others the system or profile resolver. Google Firebase Cloud Messaging is integrated for notifications: Google processes push tokens, installation/device identifiers, versions and SDK/device metadata, and the necessary messages; the backend stores the token with account, device, platform and version. Backend hosting providers and VPN operators also participate in processing. We cannot claim that nothing reaches third parties or guarantee anonymity. The operator must confirm the exact providers, countries and any transfer safeguards.
Storage on your device
On Android, imported or provisioned VPN configurations are encrypted locally using AES-256-GCM with a key protected through SecureStore. Preferences, metadata, counters and pending technical reports may also remain on the device. Session tokens use SecureStore. Local diagnostic logs are distinct from reports transmitted to the server. Exclusively local storage is not, by itself, off-device collection. Removing a profile, signing out or uninstalling does not delete data already received by the service.
Retention
The code implements cleanup of technical reports older than 30 days and technical device records inactive for over 90 days. Cleanup is triggered by reports or summary queries, at most once every six hours after a successful cleanup; it is not a guaranteed deadline during inactivity or failure. This inventory does not establish a complete automatic deletion schedule for accounts, device registrations, plans, volumes, API/audit/VPN logs, push tokens or support tickets. Backup and third-party retention periods are not confirmed. The operator must set and publish these periods and justified exceptions before submission.
Your requests and contact
The public form lets you request information, access, correction or deletion of data associated with your use of SXB VPN without an installed app or account login. It collects a reply email, request type, message and optional non-secret device identifier. The ticket and creation date are stored in support with access limited to authorized staff. Messages sent through in-app support are also received with the associated account and display name. IP addresses may appear in HTTP logs and are used temporarily for abuse rate limiting. A temporary security cookie protects the form; these pages add no advertising tools or third-party scripts. The operator verifies your identity and scope before deletion. A receipt does not mean your data has already been deleted.
Choices, limitations and updates
Android permissions let you accept or refuse establishing a VPN and manage notifications. Any diagnostic and notification choices offered by your app version must match actual processing, including in the background. Refusing a permission or withdrawing agreement does not retroactively erase data. Local storage encryption does not prove that every importable profile encrypts all traffic: the published version's configuration and transports require verification. This information must be updated when the service changes.