# DeadPixel VPN Privacy Policy

Version 14, 29 October 2026. This policy is written in English only.

## 1. Who we are

DeadPixel VPN ("the app") is a free app (the app is released under the GPL v2; DeadPixel's own source files are also available under the LGPL v2.1 or later) with three parts: the VPN, the DNS protection modes (AdBlocker, Family Protection and Cloudflare 1.1.1.1), and Pixel Hosts, which lets you point hostnames at IP addresses of your choice on your own phone. Its source code is available on request (see section 6 of the Terms of Service and the About page in the app). The operator is DeadPixel. Contact: use the Contact button in the app (on the "Before you start" screen and under Legal in the More tab). The button opens the operator's Discord profile.

The app is for people who are 18 or older.

## 2. The short version

- No account, no ads, no analytics, no advertising ID and no third-party tracking code.
- We do not collect your browsing history, contacts, location or the content of your traffic.
- The relays you connect to are public and run by volunteers. The app does not make you anonymous.
- The list of public relays normally comes from the DeadPixel service on Cloudflare, which keeps a recent copy of it. The app sends that service nothing about you except what any web request carries (your IP address and the time). If that service does not answer, the app reads the public list directly instead.
- When servers fail to connect, the app shares the failed server's IP address, the type of failure and a random install ID with a small free service, so other users can skip dead servers.
- Only while a DNS protection mode is on: your name lookups go to the DNS servers of that mode's provider (AdGuard DNS or Cloudflare), or to its backup (Google DNS or Cloudflare) when the first one stops answering. They are sent as plain DNS, or encrypted (DNS over HTTPS) if you switch on Encrypted DNS on Home. The app does not keep or log them.
- Only if you choose a filtered DNS inside the VPN (optional, off by default): while you are connected to a relay, your name lookups go through the VPN to the DNS servers of the provider you chose (AdGuard DNS or Cloudflare). The relay can still see them. They are sent as plain DNS. The app does not keep or log them.
- Only if you choose which apps use the VPN (optional, all apps by default): the app tells the VPN engine on your phone which apps to send through the VPN. Apps left outside use your normal connection, so websites and your network see your real address for them. Nothing about your choice is sent anywhere.
- Only when you tap "Check for updates" on the About page, or, if you switch on "Check for updates when the app starts" (off by default), once each time the app starts: the app asks the DeadPixel download site (a small website on Cloudflare) for the list of the newest published versions of the app. The site sees your IP address. Nothing else about you or your phone is sent, and the app never downloads or installs an update itself.
- Every web request the app makes names itself with the fixed text "DeadPixelVPN" (the "user agent"), and nothing more: not the app version, not your phone model, not your Android version.

## 3. What stays on your phone

- A saved copy of the public server list, kept up to 3 days so the list is there when the app opens.
- This phone's memory of servers that failed: they are hidden for 1 to 6 hours.
- The results of quick checks whether servers answer (kept in memory only).
- A saved copy of the shared list of failed servers (ignored after 12 hours).
- A random install ID (32 random characters, not made from any device ID or account) and a short record of which failed servers were already reported, so the same one is not reported twice within 6 hours.
- The server you are connected to and since when, so the app can show it again when you come back. This is removed when you disconnect.
- The settings of the server you connect to, which the VPN engine keeps in the app's private storage while it is in use.
- Your Pixel Hosts rules (hostname and IP address, and whether each is switched on), the apps you chose for Pixel Hosts, and the DNS server you typed in, if any. They are never sent anywhere. If you tap Share, the rules go only to the app you pick in Android's share sheet.
- The mode you chose on Home (Country VPN or a DNS protection mode), and your choice of filtered DNS inside the VPN (off, AdBlocker, Family Protection or Cloudflare 1.1.1.1), so Home shows them again. They are never sent anywhere.
- Your choice of which apps use the VPN (all apps, only the apps you chose, or all apps except the ones you chose) and the package names of the apps you chose. They are never sent anywhere.
- Your choice whether to check for updates when the app starts (off by default). It is never sent anywhere.
- The fact that you accepted these documents (the version and the date). It is never sent anywhere.

Clearing the app's data or uninstalling the app erases all of this. A new install gets a new install ID.

## 4. What leaves your phone

Here is every flow.

- The public server list. On start and when you refresh, the app asks the DeadPixel service (the same small free service on Cloudflare that is described below) for its copy of a public list of volunteer-run relays. The service reads that public list from a third-party website itself, every few minutes, and keeps every relay it saw in the last 45 minutes, so the app gets one combined list. Like any web host, Cloudflare can see your IP address and that you asked for the list; the service does not store your IP address for this and does not log requests. The third-party website sees the service, not you. Only if the service does not answer (or has no list yet), the app downloads the public list directly from that third-party website (its address is in the app's source code), and then that site can see your IP address and that you asked for the list.
- Connecting to a relay. When you tap Connect, your traffic goes through a relay run by a volunteer. The relay operator sees your IP address and any traffic that is not encrypted by the website or app you use, and may keep logs (the operator's own policy applies). This is not anonymous and not a guarantee of privacy or security.
- Failed-server reports. When a server fails to connect in a way that points to the server, the app sends the server's IP address, the type of failure (auth, noanswer, handshake or timeout) and the random install ID to a small free service on Cloudflare (a Cloudflare Worker with a D1 database).
- The shared list. On start and when you refresh (at most every 15 minutes) the app downloads the list of servers that other users flagged as failing from the same service. Flagged servers are hidden for a few hours.

What that service stores:

- The install ID only as a salted one-way hash.
- Reports: deleted after 48 hours.
- Flags (a server that at least two different installs reported): they last 6 hours, or 12 hours if the server fails again within 24 hours, and the entry is deleted 48 hours after it expires.
- A salted one-way hash of the caller's IP address that includes the day, kept up to 3 days, only to limit abuse. The service does not store your IP address itself and does not log requests.
- The copy of the public relay list: only public relay data (address, country, the reported ping and speed, the operator's own text and the connection settings the list publishes), no data about any user. A relay is deleted when it was not in the public list for 45 minutes.
- Cleanup runs when new reports arrive, so deletion can happen later than the times above when few reports come in.

Like any web host, Cloudflare can see that a request was made. Nothing is sent when you cancel, when the phone has no working network, or when several servers in a row fail in a way that points to your own network. There is no switch to turn reporting off in this version.

- Pixel Hosts lookups. Only while Pixel Hosts is on: Android sends the name lookups (DNS) of the apps you chose to the app. Names that match one of your rules are answered on the phone and go nowhere. Every other name is passed on, unchanged, to the DNS server of your phone's network (your Wi-Fi or mobile provider), or to the DNS server you typed in, or to Cloudflare's 1.1.1.1 if the phone's DNS cannot be found. That server can see the names, like it does without the app. The app does not keep, log or send the names it sees; they are held in memory only for as long as it takes to answer. The counters on the Pixel Hosts screen are numbers in memory and the last rule used; they are gone when you turn Pixel Hosts off.

- DNS protection modes. Only while AdBlocker, Family Protection or Cloudflare 1.1.1.1 is on: Android sends the name lookups (DNS) of all apps to the app, and the app passes every one of them on, unchanged, to the DNS servers of the provider of the mode you chose: AdGuard DNS (AdBlocker), AdGuard DNS family (Family Protection) or Cloudflare 1.1.1.1 (Cloudflare 1.1.1.1). That provider can see the names and your IP address and handles them under its own privacy policy, and, with plain DNS, so can anyone on the network path, because plain lookups are not encrypted. Your phone's own DNS is not used for these lookups, except as described next for Encrypted DNS. By default the lookups go out as plain DNS (unencrypted). If you switch on Encrypted DNS (DoH) on Home before turning a mode on, every lookup of that run is sent instead over an encrypted HTTPS connection (DNS over HTTPS) to the DoH address of the same provider (the backup provider's DoH address while a backup is in use); then the network cannot read the names, but the provider still can. To open that connection the phone's own network DNS looks up the provider's host name (for example family.cloudflare-dns.com, never one of your names), so your network sees that you connect to that provider. With Encrypted DNS on, the app never falls back to plain DNS or to your phone's DNS: if the provider's DoH address does not answer, the lookup fails and counts as unanswered, and the backup rule below applies. To answer repeated lookups faster, answers are kept in memory for at most five minutes, never written to disk, and emptied when you turn the mode off or the app switches provider. A mode can switch to a backup provider when the first one stops answering (three lookups in a row without an answer, or very slow answers): Cloudflare 1.1.1.1 can switch to Google DNS (Google Public DNS), and Family Protection can switch to Cloudflare for Families (1.1.1.3, which filters malware and adult sites but not ads). While a backup is in use it sees the names and your IP address under its own privacy policy, and Home says which provider is answering. Every few minutes during that time the app sends one test lookup (the fixed name example.com, never one of your names) to the first provider (encrypted too, if Encrypted DNS is on), and goes back to it when it answers again. Which provider is in use is held in memory only. The app does not keep, log or send the names; they are held in memory only for as long as it takes to answer. The lookup counter on Home is a number in memory and is gone when you turn the mode off.

- Filtered DNS inside the VPN. Only if you chose AdBlocker, Family Protection or Cloudflare 1.1.1.1 under "DNS Protection" on Home or on the Protection page (it is off by default) and you are connected to a relay: the VPN uses the DNS servers of that provider (AdGuard DNS, AdGuard DNS family or Cloudflare 1.1.1.1) for the name lookups that go through the VPN, instead of the DNS the relay would give you. The lookups travel inside the VPN to the relay, which passes them on, so the relay operator can see the names and may keep logs, and the provider sees the names and the relay's IP address (not yours) under its own privacy policy. They are plain DNS, not encrypted: Encrypted DNS (DoH) and backup providers do not apply here, and if the provider does not answer, lookups fail. The choice is read when a connection starts, so a change takes effect at the next connection. The app does not keep, log or send the names.

- Update check. Only when you tap "Check for updates" on the About page, or, if you switch on "Check for updates when the app starts" under Settings (it is off by default), once each time the app starts, in the background and only when the phone has a connection (never before you accepted these documents): the app makes one request to the DeadPixel download site (https://deadpixel-vpn.pages.dev, a small website on Cloudflare Pages) for the list of the newest published versions of the app. To answer, the site asks GitHub, where the app's releases are kept, for that list, using its own access key; GitHub sees the request of the site, not your IP address. Cloudflare, like any web host, can see your IP address, the time of the request and that it asks for the list, and handles this under its own privacy policy; the site's code does not store your IP address and does not log requests. The app puts only its name in the request: no version, no install ID and no device details. The answer is held in memory only and is gone when you leave the page or close the app. If a newer version exists and you tap "Open download page", your browser opens the download page of the site; from then on the browser and the site apply, not the app. The app never downloads or installs an update itself.

- The name sent with web requests. Every web request the app makes itself (the server list, the shared failed list and its reports, Encrypted DNS lookups, the update check) carries the fixed text "DeadPixelVPN" as its user agent, instead of the default text Android would add, which can include the phone model and the Android version. The site that receives a request still sees your IP address and the time, as with any web request.

Nothing else leaves your phone: no accounts, no analytics, no ads, no advertising ID, no third-party SDKs, no browsing history, no contacts, no location, and no content of your traffic is collected by us.

## 5. Permissions and why

- Internet and network state: to download the lists, to check for updates (when you tap the button on the About page, or at start if you switch that on), and to tell "no network on this phone" from "dead server".
- Android's VPN permission: asked when you tap Connect, or when you turn Pixel Hosts or a DNS protection mode on.
- Notifications (Android 13 and newer): for the VPN status notification and the Pixel Hosts and DNS protection notifications (each has a Stop button).
- Foreground service: keeps Pixel Hosts or a DNS protection mode running while it is on.
- The list of apps that have a launcher icon: only to show the app lists of Pixel Hosts and of the VPN inside the app. It stays on your phone.
- Receive boot completed: needed by the VPN engine's keep-alive job. The app does not start at boot.
- The standard Android permissions a VPN service needs to run.

## 6. Why we use this data and your rights

Reports are sent for the app's core function, which is skipping dead servers. Because only hashed values are stored, we usually cannot find or identify "your" data in the service. Laws where you live, such as Indonesia's personal data protection law, may give you rights over personal data. To ask a question or to ask for deletion, use the Contact button in the app. Uninstalling the app or clearing its data removes everything on your phone.

## 7. Children

The app is not for anyone under 18 and we do not knowingly collect data from them. If you are under 18, stop using the app and uninstall it.

## 8. Changes to this policy

When this policy changes in substance, the app asks you to accept again. Version 2 added Pixel Hosts. Version 3 added the DNS protection modes. Version 4 added backup DNS providers. Version 5 added the optional Encrypted DNS (DNS over HTTPS) switch. Version 6 reworded how the public server list and the relays are described; what the app sends and stores did not change. Version 7 added the note about the source code licences; what the app sends and stores did not change. Version 8 added the optional filtered DNS inside the VPN. Version 9 added the optional choice of which apps use the VPN; the choice stays on your phone. Version 10 added the update check on the About page, which contacts GitHub only when you tap the button. Version 11 added the optional switch that does the same check once each time the app starts; it is off by default. Version 12 moved the update check from GitHub to the DeadPixel download site (hosted on Cloudflare, which now sees your IP address for that check instead of GitHub), and says that the source code is given on request; the check is still made only when you tap the button, or at start if you switch that on. Version 13 made every web request of the app send only the fixed name "DeadPixelVPN" as its user agent, instead of Android's default text, which can include the phone model and the Android version, and stopped calling the app "open source" because its source code is given on request; what else the app sends and stores did not change. Version 14 moved the server list: the app now asks the DeadPixel service for its recent copy of the public relay list, and reads the public list directly only when that service does not answer.

## 9. Contact

DeadPixel. Use the Contact button in the app, on the "Before you start" screen or under Legal in the More tab.