Privacy Policy

Who is responsible

Starward VPN (the “App”) and the VPN service it connects to are provided by M.D.O.S. RESTAURANT LTD, a company registered in the Republic of Cyprus, address Flat 1, Protaras, Paralimni, 522 Kavo Gkreko, Strovolos, Nicosia 2003, Cyprus (“we”, “us”). We decide how the information below is used and are its controller under the EU General Data Protection Regulation (“GDPR”) and Cyprus Law 125(I)/2018.

This policy describes the current version of the App, which is free of charge and contains no tracking. If a later version starts handling data in another way — for example to sell subscriptions or to measure advertising — we will publish a revised policy before that version is released.

Stop 1Your iPhone

When you first connect, the App generates two random key pairs on your iPhone: one signs the App’s requests to our servers, the other builds the encrypted tunnel. The private halves of both keys never leave your device. The App keeps them, together with the identifiers our servers return (see Stop 2), in the iOS Keychain. Keychain items can outlive the App itself, which is why reinstalling the App restores your access without any sign-in. The location you chose and your settings stay on the device.

The App does not ask for access to your contacts, photos or precise location, and it does not read your advertising identifier.

Stop 2Our API server

The App talks to one API server, located in Frankfurt, Germany, to register your device and obtain access to the VPN.

Registration

The App sends the public half of its signing key, the platform (iOS), your iOS version and the App version. In reply, the server issues two random values — a device ID and an anonymous account code — that have nothing to do with your name, e-mail address or Apple Account. On our side we keep the device ID, the account code, the public key and the platform, with the time of registration and the time the device was last seen.

Access to the tunnel

To open a tunnel the App sends the public half of its tunnel key; the server you connect to is chosen on your iPhone. The API server assigns your device a temporary private address inside the VPN and notes the moments access is granted, renewed or given up, along with the private address used. Your public IP address does not appear in that note.

Request logs

Like any web server, the API server notes the IP address, time and technical details of each request it receives. These logs exist to run the service and defend it against abuse; we do not use them to find out who you are. The web server’s logs are deleted after 14 days, and the API program’s own logs disappear by themselves as rotation pushes out the oldest entries, by age or by size.

Entitlement check

From time to time the server asks Adapty, the subscription service we use, whether your anonymous account code is entitled to any paid features or server locations. The account code is the only thing sent. The current version sells nothing and contains no Adapty software.

Backups

Registration and access records are copied every hour. Each copy stays two days on the API server itself and 35 days on a separate backup machine in the United States.

Stop 3The VPN server

Once the tunnel is up, your traffic leaves through the VPN server you chose. That server necessarily sees the IP address your iPhone uses, but only to carry your traffic during the connection; it does not log it. It keeps no record of the websites you open, the contents of your traffic or your DNS lookups.

While you are connected, DNS lookups are answered through the VPN server, which hands them to the public resolvers run by Cloudflare (1.1.1.1) and Quad9 (9.9.9.9). To them, every lookup comes from the server, not from you. Our VPN servers are located in the Netherlands, the United Kingdom, Germany, Canada, the United States, Singapore and Australia.

Stop 4Our support inbox

If you e-mail us, we receive your address, whatever you write and any attachments. We use them to answer you and to keep a record of the conversation. Our e-mail is provided by Google through Google Workspace.

Stop 5This website

starwardvpn.com has no cookies, no analytics and no advertising. Its server records each request — IP address, time, page requested, referring page and browser user-agent — and deletes these records after 14 days. The site is hosted by Hetzner Online GmbH on a server in Helsinki, Finland, and reaches you through Cloudflare, which provides its DNS and protects it from attacks.

What we never receive

• your name, e-mail address or phone number — unless you write to us;
• your Apple Account details or payment information;
• which sites you visit or apps you open, or any browsing history;
• your DNS queries;
• what your traffic contains;
• your address book, photos or exact location;
• your advertising identifier.

The current version of the App contains no analytics platform, advertising kit, crash reporter or other tracking tool. If you have chosen in your iPhone’s settings to share analytics with app developers, Apple may pass crash reports to us under Apple’s own privacy policy.

Why we may use it

• Providing the VPN — registering your device, granting access and carrying your traffic is necessary to perform our agreement with you (Article 6(1)(b) GDPR).
• Security — request logs and backups serve our legitimate interest in a service that is protected against abuse and can be restored after a failure (Article 6(1)(f)).
• Correspondence — answering your messages is part of our service to you or, for business contacts, our legitimate interest (Article 6(1)(b) or (f)).
• Legal duties — keeping records that the law requires (Article 6(1)(c)).

When the App starts for the first time, it explains this use of data and asks you to agree before it connects. We do not sell personal data, do not use it for advertising or profiling and make no automated decisions with legal or similarly significant effects. You can object at any time to processing based on our legitimate interests.

Companies involved

• DigitalOcean runs the cloud machines behind our API server and VPN servers, in the locations listed above.
• Hetzner Online GmbH (Germany) hosts this website in Finland.
• Cloudflare, Inc. provides DNS for our domains and delivers this website.
• Google provides our e-mail through Google Workspace.
• Adapty receives the anonymous account code for the entitlement check.
• Apple distributes the App through the App Store as an independent controller under its own privacy policy.

Providers that process data for us act only on our instructions. Some of them are based, or process data, outside the European Economic Area. For those transfers we rely on adequacy decisions of the European Commission — including the EU–U.S. Data Privacy Framework where the recipient is certified — or on the Commission’s standard contractual clauses. If an authority lawfully requires information, we can hand over only what we hold, and we hold no browsing history.

How long things last

API web server logs, with IP addresses

14 days

API application logs

Until they rotate out by age or size

Device registration and access records

As long as the registration exists; deleted whenever you ask

Backups of those records

Two days on the API server; 35 days on the backup machine

Website server logs

14 days

Support e-mails

Up to 24 months after your question is answered

Your rights

Under the GDPR you may ask us for a copy of your data, have it corrected or erased, restrict or object to its use, and receive it in a portable form. Write to support [at] mdos-r.com. Because we do not know who you are, we may need your help to find the records that belong to your device — for example the approximate date you started using the App. We answer within one month; if a request is complex, we may extend this by two months and will tell you why.

Deleting the App does not remove your registration from our servers. To have it erased, write to us. You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy) or to the data protection authority of the EU country where you live.

Keeping it safe

Everything between the App and our servers is encrypted, and every request the App makes is signed with its own device key, so nobody else can act in its name. Our servers are administered with key-based access only, and only the people who run the service can reach them.

Updates to this policy

We will revise this policy when the App or the law changes. The current text and the date it became valid are always on this page; for significant changes we will also let you know in the App.

Reaching us