Privacy Policy

Last updated: 25 October 2026

This notice explains how Mslm Dev, trading as VPNDetection ("we", "us"), collects, uses and shares personal information when you visit vpndetection.io or use the VPNDetection API. Questions go to privacy@vpndetection.io.

1. What we collect

We collect the following from you directly:

• Account details: your name, email address, and a hashed password. We never store your password in a form we can read.
• Authentication data: if you sign in with Google or GitHub, the identifier and email that provider returns to us.
• Billing details: handled by Paddle as merchant of record. We receive a record of the subscription and its status. We do not receive or store your full card number.
• Support conversations: what you write to us in the chat on our sites, in the console, through the contact form or by email, the files you attach, the address you give us to reply to, and the page you wrote from. With each conversation we also record the IP address it came from and what our own network data says about it, to answer you well and to stop abuse.
• Newsletter: if you subscribe, your email address, the topics you choose, and a record of your signup and its confirmation (when, which page, your IP address and your browser), which we keep to show the subscription was asked for. We also record each email we send you and whether it was delivered.

We collect the following automatically when you use the Service:

• Session and security data: the IP address a request came from, the browser or client user agent, and timestamps. We use this to keep you signed in, to show you your own active sessions, and to detect abuse.
• Usage data: a record of each API request and each lookup made on this website, including the key that made it, the address it looked up and when, so we can meter your plan, support you and investigate abuse.
• Server logs: for every request that reaches our servers, including visits to this website, the address it came from, the user agent, the page or endpoint asked for, the referring page and when. We use them to run and secure the Service, and match the address against our own network data to tell people from automated traffic.
• Site measurement: unless you turn measurement off, each page you view on our sites and in the console, how long it was in front of you, whether you scrolled, clicked or typed on it (never what you typed), the buttons we count, such as sign-up, where your visit came from, your screen size, time zone and language, and the address it came from. We match the address against our own network data to tell people from automated traffic, and use the rest to see which pages help.

We do not process special category or sensitive personal information, and we do not buy personal information from third parties.

2. IP addresses we classify are not personal information about you

This is worth stating plainly because it is the part people ask about. The IP addresses you submit for classification are processed to answer your query and are not used to build a profile of any individual. Our classification datasets describe network infrastructure, such as which ranges belong to VPN operators or hosting providers, and are derived from network measurement, published operator server lists and public internet registry records. They are not derived from the queries our customers make.

If you submit IP addresses that constitute personal data in your jurisdiction, you are the controller of that data and we process it as your processor for the purpose of answering your query.

3. How we use it

• To create and operate your account, and to authenticate you.
• To provide, meter and bill the Service.
• To keep the Service secure, including preventing fraud and automated abuse.
• To answer your support conversations. Our AI assistant answers chat and console questions first where it can, and a person takes over whenever you ask or it cannot help; a person answers everything sent through the contact form or by email.
• To send you the newsletter, if you subscribe or have an account.
• To understand aggregate usage so we can improve the Service.
• To comply with our legal obligations.

Account holders get the monthly product update unless they opt out. The sign-up form offers it with a box that's already ticked, which you can untick, and you can turn it off at any time under Notifications in the console's settings. Every newsletter email has a one-click unsubscribe link.

4. Legal bases (EEA and UK)

• Contract: operating your account and providing the Service you subscribed to.
• Legitimate interests: securing the Service, preventing abuse, and improving what we offer, where those interests are not overridden by your rights.
• Legal obligation: retaining records we are required to keep, and responding to lawful requests.
• Consent: optional cookies, and marketing email where we rely on consent. You can withdraw consent at any time.

5. Canada

Where PIPEDA applies, we rely on your express or implied consent, which you may withdraw at any time. In limited circumstances the law permits processing without consent, for example to investigate a breach of an agreement or to detect fraud.

6. Sharing

We share personal information only with:

• Paddle, for payment and billing as merchant of record.
• Anthropic, whose Claude models power our support assistant: it receives the conversation it is answering, with the files you attach to it, and under its commercial terms does not use them to train its models.
• Amazon Web Services, which receives the email you send our support addresses and delivers our replies.
• Cloudflare, whose Turnstile challenge protects sign-up, sign-in, the contact form, the newsletter signup and the address lookup from automated abuse.
• Google and GitHub, if you choose to sign in with them.
• Google, whose Ads tag and conversion measurement tell Google Ads which of our ads brought you here, while you allow advertising.
• Infrastructure providers that host the Service under contract with us.
• Authorities, where we are legally required to.

We may transfer information in connection with a merger, acquisition or sale of assets. We do not sell personal information. While you allow advertising, we share the pages you visit on our sites, the ad click that brought you and, if you sign up or buy, a hashed form of your email address with Google, to measure our ads and show them to you on other sites, which California law calls sharing for cross-context behavioral advertising. Advertising is off until you allow it in the EEA, the UK and Switzerland, and off everywhere for a browser that sends Global Privacy Control.

7. Cookies

We set strictly necessary cookies, one optional functional cookie that is off until you agree to it, and analytics cookies of our own that measure how the site is used, which are on until you turn measurement off. Google sets advertising cookies, which are on until you turn advertising off, and off until you allow them in the EEA, the UK and Switzerland. In full:

Signing in with Google or GitHub sends you to that provider, which sets its own cookies on its own domain under its own privacy policy. We do not set cookies on their behalf.

Everything above except the Google sign-in prompt, the search recents, and the analytics and advertising cookies is strictly necessary to provide a service you asked for. The prompt and the recents are conveniences rather than necessities, so they are off until you accept functional cookies, and nothing is loaded from Google for the prompt until you do. The analytics cookies are on until you turn measurement off; turning it off deletes them and stops our measurement. The advertising cookies are on until you turn advertising off, except in the EEA, the UK and Switzerland, where they are off until you allow them, and for a browser that sends Global Privacy Control; turning advertising off deletes ours, stops Google's tag from loading and stops us telling Google which ad brought you. You can change any choice at any time in the cookie banner or from the Cookie preferences link in the footer.

There is no single agreed standard for Do Not Track signals, so we do not currently respond to them. We do honor Global Privacy Control, as above.

8. Retention

We keep account information for as long as you have an account, and for a limited period afterwards where we need it to meet legal, tax or accounting obligations or to resolve disputes. Session and security logs are kept for a short period appropriate to detecting abuse. Server logs, and what we derive from them about each address, are kept for 90 days, as is our own measurement of the site with the address of each page view; the per-visit figures we build from it, without the address, are kept for 400 days. Records of API requests, holding the time, the address looked up and, where there is one, the key and organization that made it, are kept for 13 months, for billing questions, support and abuse investigation. Hourly counts of the addresses and user agents that call the API most, which your dashboard shows you for your own keys, are kept without a set deletion date, and those of the addresses and user agents that reach our servers most are kept for 400 days. A newsletter subscription and the record of its signup are kept until the address is removed. If email to an address bounces or is reported as spam, we keep the address on a list of addresses not to email again, even after it is removed. A support conversation started from an account is kept until the account is deleted, which deletes it; one started without an account, or by email, is deleted 24 months after its last message. Email to our support addresses is kept with its conversation, and our email provider deletes its own copy 7 days after it arrives. What our support assistant spent on each answer is kept for 13 months, without the conversation's words. When we no longer need information, we delete or anonymize it.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, hashed passwords, first-party session cookies that scripts cannot read, and optional multi-factor authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to access your personal information, to correct it, to delete it, to restrict or object to processing, to portability, and to withdraw consent. We will act on requests in line with applicable law and will not treat you differently for exercising a right.

To exercise a right, email privacy@vpndetection.io. We will verify your identity before acting, usually by confirming control of the account email. You can also export your data, deactivate your account or delete it yourself, from Settings → Data & privacy in the console. If you subscribed to the newsletter without an account, you can delete your address and its record yourself from the preferences page every newsletter email links to.

If you are in the EEA or UK and believe we are processing your information unlawfully, you may complain to your local supervisory authority. In Switzerland, that is the Federal Data Protection and Information Commissioner.

11. California

The categories of personal information we have collected in the past twelve months, using the CCPA's own categories:

We have not sold personal information in the preceding twelve months, and we do not intend to. Since October 21, 2026, while you allow advertising, we share the pages you visit and the ad click that brought you with Google and, since October 24, 2026, a hashed form of your email address if you sign up or buy, as section 6 says, which California law counts as sharing. You can opt out from the "Your privacy choices" link in the footer, or with Global Privacy Control. California residents may request access, deletion, or correction, and may use an authorized agent who provides proof of authorization.

12. Children

The Service is for users aged 18 or over. We do not knowingly collect information from children. If you believe a child has provided us information, contact privacy@vpndetection.io and we will delete it.

13. Changes

We update this notice as our practices or the law change. The "Last updated" date above shows the current version, and we will notify account holders of material changes.

14. Contact

Mslm Dev
195-B Jasmine Block Sector C Bahria Town
Lahore, Punjab 53720, Pakistan
privacy@vpndetection.io