Privacy Policy

Last updated: October 14, 2026

Bot Changer Inc. provides BotChanger VPN and botchanger.com. This policy explains how information is used to operate the service and how to contact us about your information.

Apple and Android are different

The iPhone, iPad and Mac apps provide Premium access without advertising. Eligible iOS users may also receive a Welcome Pass. Android offers ad-supported Free access and paid access without ads. The Android advertising and analytics sections below do not apply to the Apple apps. Ad-free Android access removes advertising, but does not by itself disable service diagnostics or analytics.

Information used to provide the service

App and device information: app installation identifiers, app/system versions, device information, service requests and security-check results help operate and protect the service and prevent abuse. Our services and service providers receive your IP address and basic request information when you contact them.
Access and purchases: store transaction identifiers or purchase tokens, product, purchase and expiry information, verification results and associated installation identifiers are used to verify subscriptions, restore access and prevent misuse. Welcome Pass eligibility and activation records prevent repeated claims. In-app purchases do not provide us with your store password or full payment-card details.
Support: we store messages and issue details you submit, replies, ticket status and timestamps. Email support receives your email address and the information you include. Apple in-app support uses a verified identifier associated with your App Store use to keep conversations together; we do not receive your Apple Account email or password through this feature. Devices associated with the same identifier may share support history.
Optional technical reports: if you attach a report, it includes device model, system/app version, network type and recent app connection events, including selected server, timing, session references and diagnostic reasons. You can preview it before sending and create a request without a report. Reports help investigate your issue.
Notifications: a device notification identifier, permission status, app installation reference and app version are used to deliver notifications when registered. Support reply notifications do not contain conversation text. You can disable notifications in device settings.
Website orders: voucher checkout uses order references, purchase email, items, payment status and fraud-prevention information to fulfil purchases and handle disputes. Our payment provider processes payments under its own policy.
Reliability: app versions with enabled crash reporting may send crash details, app/device information and diagnostic events to our reliability service provider. Optional support reports are a separate feature.

Android analytics and diagnostics

On Android, we use Google Analytics for Firebase and Firebase Crashlytics to understand app use, measure acquisition campaigns and improve reliability. Analytics events and crash reports are sent from the app to Google and processed in Google’s services. We view reports in Google’s tools; the connection and referral analytics described here are not copied into a separate BotChanger analytics database.

Depending on app version, this includes first launches, active sessions, app and operating-system versions, device characteristics, installation or advertising identifiers, acquisition source and campaign information, ad impressions and revenue, crash reports, and app interactions. Connection measurements include attempts, successful connections, failures, cancellations and disconnects; selected server identifiers and countries; connection type; timings; and predefined diagnostic reasons. We also measure whether an app-sharing prompt was shown, a button was used, or the system share sheet was dismissed or a sharing target selected. Selecting a target does not tell us that a message was delivered or that someone installed an app.

The Android app does not request precise, approximate or background location permission and does not obtain GPS coordinates. Google’s services and advertising providers can derive an approximate location from an IP address. Connection analytics can also use a country code reported by the mobile network, or an unknown value when unavailable. These values are not verified physical locations and may reflect a VPN exit or mobile network.

Our custom connection and sharing events do not include browsing destinations, DNS queries, VPN traffic content, IP addresses, Wi-Fi names, credentials, share recipients or message content. Google’s SDKs separately process their automatic identifiers and technical information. Analytics and diagnostic records can be associated with an app installation; they are not claimed to be anonymous.

We use linked Google Analytics, Google Ads, Google Play and AdMob reporting to distinguish ad engagement, store acquisition, first app launch, VPN activation and ad revenue. A download, first launch and successful connection are different measurements. Applicable consent settings and platform controls affect processing. The Android app currently has no separate in-app switch to turn off all analytics and crash reporting; ad-free access is not an analytics opt-out.

VPN traffic

A VPN processes network traffic to route your connection through your selected server. Our VPN servers do not record or retain browsing destinations, DNS queries, traffic contents or VPN connection logs. We do not sell VPN traffic or use it to personalize advertising or create advertising profiles.

This server no-logs policy is distinct from the app and service records described above: purchase and access verification, Android analytics and diagnostics, support conversations and optional technical reports. Android app connection analytics are sent automatically as described above. On Apple platforms, recent connection events may be kept on your device for troubleshooting and included in a technical report when you choose to attach it to a support request. Using a VPN does not make every online activity anonymous.

Service providers

Service providers process information for service delivery, security, support, purchases, notifications and reliability. These include Cloudflare (hosting and service operations), Google Firebase (app operation, Android analytics and reliability), Apple and Google Play (store and platform services), and Stripe (website payments). Android Free advertising providers include Google AdMob and, when enabled through mediation, Meta Audience Network. The linked policies explain these providers’ data practices.

Advertising — Android Free access only

Android Free access includes advertising. Advertising providers may process advertising/device identifiers, IP-derived approximate location, app/device information, ad interactions and diagnostics to deliver and measure ads, personalize them where permitted, and prevent fraud. This is separate from VPN browsing traffic. Paid access does not show ads. Device settings and applicable consent requirements affect advertising; this policy does not replace legally required consent.

Advertising providers and their privacy policies are listed above. Depending on applicable law, advertising disclosures can constitute “sharing” for targeted advertising. Contact us about your rights or requests.

Website storage

Our website, hosting protections and payment services may use necessary browser storage, cookies and request information for checkout, security and service operation. Blocking storage may prevent checkout from working. Linked services have their own privacy practices.

Retention

Our Google Analytics settings retain event-level data for 2 months and user-level data for 14 months. New activity resets the user-data retention period. These settings do not limit most aggregated standard reports, and Google’s processing and deletion schedules apply.
Firebase Crashlytics retains crash traces, extracted diagnostic data and associated identifiers for 90 days before starting removal from live and backup systems. Other Firebase installation and notification records follow the relevant service lifecycle and deletion procedures. We do not promise that all app data is automatically deleted within 90 days.
Attached technical reports expire after 30 days and are removed by scheduled cleanup.
Resolved in-app support conversations, messages and report attachments are deleted after 12 months without further customer-visible activity. Open or waiting requests remain available while we handle them; reopening a request prevents resolved-ticket cleanup.
Purchase, entitlement and Welcome Pass records are retained as needed to restore access, handle disputes and prevent repeated or fraudulent claims. Necessary transaction, legal and abuse-prevention records may remain after a deletion request.
Providers have their own retention obligations and backup lifecycles. Removal from active support storage does not guarantee immediate erasure from every provider backup.

Your choices and requests

You may decline technical reports, manage notification permissions, stop using the VPN, and request access, correction or deletion of information relating to you. See the steps for requesting deletion. Email [email protected] with the subject “Privacy request”, or use an existing in-app support conversation. We verify ownership before disclosing or deleting records; a ticket number alone is insufficient. We explain any records we must retain and respond within applicable legal time limits. Deleting app or support data does not cancel a store subscription.

Depending on your location, you may also have rights to restrict or object to processing, receive a portable copy, withdraw consent where processing depends on consent, opt out of qualifying sale or sharing, or complain to a data-protection authority. We do not penalize you for exercising applicable privacy rights.

Purposes, safeguards and international processing

Information is used to provide requested services, fulfil purchases, respond to support, maintain security, understand app use and reliability, measure acquisition and advertising, and comply with legal obligations. Where applicable, legal bases include contract performance, legitimate interests in operating and securing the service, legal obligations and consent for optional processing. Information may be processed in the United States and other countries where providers operate. We use safeguards required by applicable law; no system guarantees absolute security.

Children

BotChanger is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can investigate and remove it where appropriate. Local age and parental-consent requirements may also apply.

Changes and contact

We update this policy when practices change and provide additional notice or request consent where required. The date above identifies this version.

Bot Changer Inc. · [email protected] · +1 201 554-2228