Privacy
This page explains what data LAMPA needs for your connection and subscription, how App Store and Google Play purchases are verified, what the AppsFlyer and Google Firebase services receive, what the lampavpn.com website and the AppLovin advertising pixel on it collect, and what information about VPN connections we do not log. We do not sell personal data. We do not sell or share VPN traffic.
What we do not log or ask you to enter
| The websites you visit | We do not record these on the VPN server or in our database. The server does not keep connection logs, and the database has no field for browsing history. Automated checks in the code enforce both restrictions. |
|---|---|
| The domain names your device requests (DNS) | These are not recorded on the VPN server or in the database either. |
| The address you connect to the VPN server from | The VPN server keeps no connection log: neither addresses nor times. This has been checked on a running server carrying real traffic. Requests from the app itself to our servers, to AppsFlyer and to Google Firebase are described separately below. |
| When your VPN connection starts and how long it lasts | We do not log VPN connection start or end times. The device list may retain the date of a device’s last activity. AppsFlyer measures app opens separately; those records are not VPN connection logs. |
| Your name or phone number | You do not need to provide a name or phone number to use the app. The service recognizes your device by its key and links its access to a subscription. Buying your own subscription gives you separate access under that subscription. |
| Your full card number in LAMPA | Your payment provider or app store receives your full card number. You do not enter it in the LAMPA interface. The information we need to verify your payment is described below. |
What leaves your device, and why
| The first request to us, before the VPN is on | An app that has never connected asks us for server addresses over your regular network; it needs those addresses before it can connect. At that point, our server sees the address the request came from, as any website would. We check that address only in memory and do not record it; there is no database field for it. |
|---|---|
| Your device key | To connect, your phone creates a key pair and sends us the public key. The device signs requests with its private key, and we verify the signature with the public key. This is how the service recognizes your device. |
| Your device type | Whether the device is an iPhone or Android, so you can tell devices apart in the list. This may also include the date of its last activity, without the time of day. |
| How much data was transferred during a period | The total amount transferred during a period is used to account for server load. It has no breakdown by website or time; the previous period is reduced to a single total. |
| Payment events | Your selected plan, purchase result, subscription period and connected devices are needed to manage access. The payment provider reports a payment event identifier and its result. Your subscription is activated after payment verification. |
| Purchases through Google Play | The app sends our server a token: a technical identifier for the purchase. Google Play receives a technical code linking the purchase to your access. Our server checks the purchase with Google Play to activate or restore access and account for renewals, cancellations and refunds. The token is stored encrypted on our server. Google Play also tells the app your Google Play country so it can choose an available purchase method. |
| Purchases through the App Store | You pay in the App Store with your Apple Account; your payment details stay with Apple. Our server receives signed purchase information from Apple: the subscription status, the transaction ID and a random identifier the app uses to link the purchase to your access. Apple does not give us your email address or name. The server uses this information to activate or restore access and to account for renewals, cancellations and refunds. |
| Optional email address | After payment, you can leave an email address for subscription, renewal and failed-payment messages. You can skip this. News and offers have a separate checkbox, selected on the first request; you can clear it. Emails include an unsubscribe link. Your email address is not sent to AppsFlyer. The address and mailing preference are stored in the billing system. The email service receives the address and message text to deliver the email. The address is not written to app diagnostic logs. |
| Notifications | If you allow notifications, the app sends our server a notification token. On iPhone the token is issued by the Apple Push Notification service; in the Android app from Google Play it is issued by Google Firebase Cloud Messaging. We use the token to send notifications about your subscription and access; Apple and Google deliver them. |
AppsFlyer: advertising and app use
| Why LAMPA uses AppsFlyer | The iPhone and Android apps use the AppsFlyer SDK to count installs and opens, evaluate advertising campaigns and detect fraudulent installs. On Android, measurement starts after you acknowledge the data disclosure in the app; the SDK is not created before then. This version has no separate analytics switch. |
|---|---|
| What AppsFlyer receives | In the Android app, AppsFlyer receives information about installs, app opens and screens, payment steps and their outcomes, device enrolment, purchases and added seats. Purchase events include the plan, term, device count, amount and currency, without your name, email or order number. The SDK receives its install identifier, technical phone and app data, carrier information and the request IP address, which may indicate an approximate country or city. Collection of Android ID, available advertising identifiers and saved TCF consent preferences is enabled; availability depends on the device and system. Google Play installs also provide the install source. The app does not block sharing with AppsFlyer partners; this depends on partner settings in the service. VPN traffic, sites you visit and DNS requests are never sent to AppsFlyer. |
| Installs from Google Play | In the Android version distributed through Google Play, AppsFlyer also receives the installation source and click and install timestamps through Google Install Referrer. These describe how you reached the app, not the websites you visit. |
| Android settings | On Android, AppsFlyer anonymization and the block on partner sharing are not enabled. SDK settings do not disable collection of advertising identifiers or AppSet ID; actual availability depends on the system, permissions and included libraries. Saved TCF consent preferences are read if present. Facebook deferred links and detailed SDK logs are disabled. |
| Differences on iPhone | On iPhone, AppsFlyer counts installs and app opens; the app sends it no events of its own. AppsFlyer receives technical device data, the IDFV identifier, a random installation identifier created by the app and the request IP address. It receives the advertising identifier (IDFA) only if you allow tracking in the system prompt. Apple Ads and SKAdNetwork attribution are enabled, and saved TCF preferences are read if present. AppsFlyer anonymization and the block on partner sharing are not enabled, so AppsFlyer may share this data with advertising partners. Your chosen device name is not collected. The purchase and screen events described above apply to Android. |
| What the app does not send to AppsFlyer | The app does not send VPN traffic contents, DNS requests, visited website addresses, the selected VPN server, device keys, access codes, payment tokens, order numbers, full card details, your name, phone number or email address to AppsFlyer. The SDK runs in the main app, separately from the VPN tunnel. On iPhone it is also absent from the widget. |
Google Firebase: app statistics and crash reports
| App statistics | The iPhone app and the Android app from Google Play send Google Firebase Analytics events from a closed list: screens opened, steps, viewing plans, and purchases (plan, term, number of devices, amount and currency). The events contain no name, email address, phone number or order number. Firebase starts only after you acknowledge the data disclosure in the app. This shows us which screens and steps work. |
|---|---|
| Crash reports | If the app crashes, Firebase Crashlytics receives a report on the technical state of the app and the device at that moment. We do not add your name, email address or a user identifier to crash reports. |
| What Firebase does not receive | Firebase runs only in the app, not in the VPN tunnel. It does not receive VPN traffic contents, DNS requests, visited website addresses, device keys, payment details, your name, phone number or email address. |
Our database
We build and maintain LAMPA’s database ourselves. It has no fields for browsing history, DNS requests or VPN connection logs.
Automated checks monitor this database schema and the VPN server settings. These checks do not control the systems of AppsFlyer or Google Firebase; their data processing is described separately above.
How long data is kept
| Data transfer totals | The current period and one previous period. Beyond that, a single total is kept without a breakdown. |
|---|---|
| Payment records | We keep the information needed to verify purchases, renewals, cancellations and refunds, and to resolve payment disputes. Turning off the VPN or uninstalling the app does not cancel your subscription or delete these records. |
| Devices | Revoking a device’s access ends its access to the subscription. It does not delete all service records about the device and its purchases. |
Support through Telegram
When you contact LAMPA support through Telegram, @lampasupport_bot opens. If you open support from the app, the app may attempt to obtain a short-lived link from our server that is bound to that installation. If the chat cannot be linked, or if you open the bot directly, it still works without an installation link. Through a current linked session, support can receive a limited current summary of subscription state, devices, recent payments and refunds, app version and service status. That summary contains no VPN traffic, visited sites, DNS requests or connection logs.
Telegram supplies the bot with the profile name and username made available to bots, the numeric chat or user ID, and the messages you send; Telegram itself receives the original text. For an ordinary support conversation, LAMPA does not add the profile name or username to conversation memory or a human-support ticket. Before storing conversation text or sending it to the AI assistant, LAMPA automatically redacts protected identifiers. LAMPA stores the numeric ID, a pseudonymous installation link and the redacted text so an AI assistant or a human support agent can reply. When needed to answer, the AI assistant may also receive the limited linked summary described above. Redacted text may be processed through OpenRouter and Google with zero-data-retention routing; a human support agent may receive a redacted ticket transcript and current support summary in Telegram. Telegram processes the chat itself under its own privacy terms.
AI-assistant conversation memory is kept for up to 90 days. The /forget command immediately deletes that memory and the installation link; encrypted backups may retain them for up to 14 more days. A human-support ticket, if created, is kept by LAMPA for 12 months after its last message, and longer only while a related refund or payment dispute remains open. That period applies to LAMPA storage: copies of messages and summaries that remain in Telegram are handled under Telegram’s terms, and LAMPA cannot always delete them. /forget does not delete subscription, device or payment records and is not general account deletion.
The lampavpn.com website
This section and the next one cover only the lampavpn.com website. They do not apply to the LAMPA apps or to the VPN.
The website keeps its own visit statistics: which pages and sections were viewed, how far a page was scrolled, which buttons and links were tapped, which plan was chosen, whether you went on to an app store, and which steps were taken on the payment page. Along with these events our server receives, and may store, the IP address, the browser string, the language, the device type, the site you came from, advertising campaign tags and an ad click ID if they are in the page address. The events are kept for up to 90 days. A tap on a Google Play link is kept as a separate record with no time limit: the day, page, store, platform, campaign tags and a visit code, without the IP address or browser string. Through a random code in the link we connect that tap to the app install from Google Play, to count installs that came from the website.
In your browser the website stores a random visitor ID for 90 days and a visit ID for the duration of the visit, an AppLovin ad click ID from the page address if there is one (also for the visit), the language if you chose one (also in the lampa_lang cookie, for one year), your choice in the cookie bar (in the lampa_ads cookie, for one year), which version of a page your browser was given when we compare two versions, and whether you switched on the lamp shown on the website. AppLovin’s cookies are described in the next section.
Fonts, images and the website’s scripts are loaded from our domain. The exceptions are the AppLovin pixel’s scripts and the service images through which AppLovin matches cookies with Google, which load from AppLovin’s and Google’s servers.
If you enter your email in a quiz on the website, it is passed to the payment page together with the chosen plan and stored in the payment system. It receives messages about that purchase, including a reminder about an unfinished payment; news and offers are sent only if the separate checkbox is ticked.
Following a link to payment, an app store or Telegram opens that service. Its own privacy policy governs the data it processes.
Advertising measurement: the AppLovin pixel
| Why it is used | We advertise LAMPA through the AppLovin ad network and use the AppLovin pixel on lampavpn.com pages, including the quizzes, to measure which ads brought visitors to the website and led to a purchase. The pixel runs only on the website: it is not in the LAMPA apps or in the VPN. |
|---|---|
| What AppLovin receives | The pixel loads with the page and tells AppLovin that a page and the prices were viewed, which buttons and links were tapped together with the link address, and which plan was chosen at which price. AppLovin also receives the IP address, the browser string, the language, the screen size, the page address and title and the technical browser details its script collects, and it exchanges a browser identifier with Google to match ads. We do not pass the email or the answers from a quiz to the pixel, and the email field is closed to its automatic reading. |
| Cookies and browser storage | As of this revision, the pixel sets the _axwrt, _axwrt_ts and ax_visitor cookies on the website’s domain and the axcrt cookie on the applovin.com domain; each is kept for one year. After a click on an AppLovin ad, an _axeid cookie with that click’s ID may also appear. In browser storage the pixel writes _applovin_pixel_version and _axwrt_backup, and _axsid for the duration of the visit. AppLovin decides their names and lifetimes. |
| Reporting a purchase | After payment we report the purchase to AppLovin from the payment page or from our server if, when you went to payment, your browser carried an AppLovin ad click ID or the pixel’s _axwrt cookie. The pixel sets that cookie on any visit to lampavpn.com, so a purchase is reported even without an ad click. AppLovin receives the plan, amount, currency, purchase time, a random event number, the ad click ID and the value of the _axwrt cookie, the buyer’s IP address and browser string and, if you gave an email, its SHA-256 hash instead of the address itself. AppLovin does not receive the order number, card details, or information about your devices and VPN connections. |
| How to opt out | Until you make a choice, a bar about cookies and the AppLovin pixel is shown at the bottom of the website’s pages and quizzes. “Opt out” stops the pixel on the open page at once, deletes its cookies and browser storage entries on our domain and removes the ad identifiers from the payment link, so the purchase report described above is not sent to AppLovin. The choice is kept in your browser for one year (including in the lampa_ads cookie), and the pixel does not load on later pages of the website or in the quizzes. “Got it” only hides the bar. The website’s own statistics do not depend on this choice. You can also turn the pixel off in your browser: delete cookies and turn them off for lampavpn.com and applovin.com, or use an extension that stops AppLovin’s scripts from loading. You can exercise your rights of access and deletion with us, as described below, and with AppLovin under its privacy policy. |
| AppLovin’s privacy policy | AppLovin also processes this data under its own privacy policy. For more information about AppLovin’s collection and use of your information visit: https://legal.applovin.com/privacy |
Legal Bases for Processing under the GDPR
We process personal data on the following legal bases:
Performance of a contract — Art. 6(1)(b) GDPR: providing VPN access, managing subscription, devices, access and support.
Compliance with legal obligations — Art. 6(1)(c) GDPR: tax and accounting records, responding to lawful requests, resolving payment disputes and refunds.
Legitimate interests — Article 6(1)(f) GDPR: service security, preventing fraud and abuse, maintaining reliability, website statistics and measuring our advertising.
Consent — Art. 6(1)(a) GDPR: where required, for example for certain optional features or analytics on Android before confirmation of data disclosure. Consent can be withdrawn at any time.
Your Rights under the GDPR
If you are in the EEA, the UK or Switzerland, you have the right to: access your personal data — Art. 15 GDPR; rectify inaccurate data — Art. 16 GDPR; erasure of data — Art. 17 GDPR; restriction of processing — Art. 18 GDPR; data portability — Art. 20 GDPR; object to processing based on legitimate interests — Art. 21 GDPR; withdraw consent — Art. 7 GDPR; lodge a complaint with a supervisory authority — Art. 77 GDPR.
To exercise your rights, write to support@noltrasoft.com. We will respond within one month; for complex requests, the period may be extended by a further two months.
Rights are not absolute. We cannot delete data that we are required to retain by law, or data necessary for payment disputes, refunds or the protection of rights. We also cannot provide VPN logs, DNS queries or browsing history because we do not store them.
Recipients of Data and International Transfers
We do not sell personal data. We do not sell or share VPN traffic.
We may disclose data to these categories of recipients: AppsFlyer for advertising attribution, measuring installs, app opens and the Android events described above; AppLovin for measuring our advertising on the lampavpn.com website and the purchases made after it; Apple for App Store purchases and notification delivery on iPhone; Google Firebase for app statistics, crash reports and notification delivery on Android; Google Play for purchase verification, access recovery, renewals, cancellations and refunds; payment providers for processing and verifying payments; email services for delivering messages to the address you leave; Telegram for user support; OpenRouter and Google for AI processing of redacted support messages; hosting and infrastructure providers for hosting LAMPA servers and databases.
The servers that store LAMPA’s data are in the European Union: in Sweden, Germany and Lithuania. Encrypted backups are stored in the Netherlands.
Some of these recipients may be located outside the EEA. If data is transferred outside the EEA, we use appropriate safeguards such as the EU Standard Contractual Clauses or rely on an adequacy decision where applicable.
Security
We take reasonable technical and organizational measures to protect data: encryption of purchase tokens, access restrictions, automated checks of the database schema and VPN server settings, absence of VPN connection logs and fields for browsing history and DNS queries.
Children
LAMPA is intended for users aged 13 and over, not for children under 13. If you believe a child below that age has provided us with data, please contact us so that we can review the request and delete that data.
Changes to the Policy
We may update this Privacy Policy. A new version is published on the Mankrik website with an updated effective date. By continuing to use the service after changes, you agree to the updated policy, unless otherwise required by law.
Questions
For help with the app, contact LAMPA support.
Who operates the service and handles app data
The LAMPA service and its app data processing are operated by DRUSTVO SA OGRANICENOM ODGOVORNOSCU MANKRIK DOO BUDVA - OGRANAK BEOGRAD.
Address: BULEVAR MIHAJLA PUPINA 115A, Beograd (Novi Beograd) - 11070, Serbia (RS). The developer name shown on Google Play is Mankrik.
LAMPA support: support@noltrasoft.com.
Updated