Privacy Policy
Last updated: August 15, 2026
Draft — pending legal review
This document accurately describes what Nova VPN's systems actually do today, but it has not yet been reviewed or finalized by a lawyer, and Nova VPN's legal entity and jurisdiction are not yet finalized either. Don't treat this as a final, legally binding document until that review is complete.
Who we are
Nova VPN is made by LFAX. This policy covers the Nova VPN mobile app and the novarouting.com website.
What we collect
We collect the minimum needed to run your account and connection:
- Email address — to identify your account and let you log in.
- Password — stored as a one-way cryptographic hash (bcrypt). We never store or can see your actual password.
- Subscription status — whether you have an active plan or trial, and when it expires.
- WireGuard connection keys — the cryptographic keys and internal tunnel IP address needed to give you a VPN connection. These are not your real IP address or physical location.
- Payment records — the provider (Stripe, or Flutterwave/Paystack where used), transaction reference, amount, and plan for each successful payment. We do not receive or store your full card number — that's handled entirely by our payment processor.
- Device identifier (trial signups only) — if you start a free trial, we record a one-way cryptographic hash of your device's Android ID, and the IP address you signed up from. This exists solely to prevent the same device from claiming more than one free trial under different email addresses, and is never used for any other purpose.
What we don't collect
- We do not log the websites, apps, or services you connect to while using the VPN.
- We do not log your browsing activity or map your account to specific internet traffic.
- We do not sell your data to advertisers or data brokers.
How long we keep it
- VPN connection keys are automatically deleted 30 days after your subscription expires, if you haven't renewed. After that, we have no way to reconstruct your VPN identity.
- Payment records are kept for standard accounting, tax, and dispute-resolution purposes, the same as any payment processor requires.
- Your account and email are kept until you ask us to delete them, so you can resubscribe later without re-registering.
Who we share data with
We use a small number of infrastructure and payment providers to run the service:
- Stripe — payment processing (Flutterwave and Paystack are also integrated and may be used for certain markets).
- DigitalOcean — hosts our servers (control plane and VPN nodes).
We don't share your data with anyone else, and we don't sell it.
Your rights
You can delete your account directly in the app — open Settings → Delete Account. This immediately deletes your VPN identity and cancels your subscription; it can't be undone. Payment records are kept for accounting purposes even after account deletion, the same as any payment processor requires. You can also request a copy of the account data we hold about you, or ask us to correct it — see the Contact section below.
Security
Passwords are hashed, never stored in plain text. Login sessions use randomly-generated tokens, and only a hash of each token is stored server-side. All traffic between the app and our servers uses HTTPS.
Children's privacy
Nova VPN is not directed at children, and we don't knowingly collect data from anyone under 16.
Changes to this policy
If this policy changes materially, we'll update the date at the top of this page.
Contact
support@novarouting.com