Privacy Policy

Our commitment

Duvia will not sell, use, or disclose to third parties any data for any purpose. Elviont Technologies handles the information listed in this policy only to provide the service to you.

Duvia is a VPN service developed and operated by Elviont Technologies in the Netherlands, on its own servers. It has no advertising, no analytics and no tracking across apps and websites. This policy covers the app, the account service, the account website and support.

Information we handle

Account and purchases

Your email, a salted hash of your password, your account ID, sign-in sessions, verification and recovery records, purchases and payment references, and your package allowance and expiry. For App Store purchases this includes the App Store transaction ID, product, purchase date, price and currency.

Data used

Uploaded and downloaded byte totals for your account, to enforce the package allowance. They do not include the content of your traffic or the sites and services you visit. Both routes count toward the allowance; the app shows each route’s own statistics on the device.

Device identifier

The app creates a random identifier when it is installed and sends it to Duvia’s VPN servers when it connects. It keeps the device’s address inside the VPN the same when it reconnects, and lets a new connection replace that device’s older one. It is not derived from your device or Apple identifiers, is not sent to the account service and is not written to the connection log.

Connection log

When a device connects or disconnects, the VPN server records the time, a short reference to your package, the device’s address inside the VPN, the app version and, on disconnecting, the reason. It does not record the sites or services you visit, your DNS requests or the content of your traffic.

Sign-in log

When you create an account, sign in, sign out or change your password, the sign-in service records the event with your email, account ID and IP address, to protect your account.

IP address and country

Like any internet service, our servers receive your IP address with each connection and request, and the web server’s access logs record it with the time and the address requested. The app does not look up your location from your IP address and does not ask for GPS location. The account website estimates your country from your IP address with a local database, to show prices in your currency. Rate limits keep a hashed key until it expires.

On your device

Connection history and preferences stay on the device. The network type shown on Home (for example Wi-Fi or mobile data) is read from iOS on the device and is not sent to us. Session tokens and VPN credentials are kept in the iOS Keychain. Notification choices are local; there is no remote push-token registration.

Support

The email, message, attachments and diagnostics that you choose to send.

How information is used

Account, purchase and usage records are used to sign you in, verify your email, recover your account, confirm purchases, provide VPN access, enforce allowances and prevent abuse. The device identifier, connection log and sign-in log are used to run connections and accounts, troubleshoot them and protect the service. Network checks show connection information and measure performance. Speed tests transfer data through the VPN and count toward your allowance.

The account website uses a locally stored DB-IP country database for regional prices; your IP address is not sent to DB-IP.

Where it is stored

Account, purchase and usage records are stored on Duvia’s own server in the Netherlands. Passwords are sent over HTTPS and stored only as salted hashes. The app keeps its session and VPN credentials in the iOS Keychain. Diagnostics hide credentials and the device identifier.

The account website keeps you signed in with an HttpOnly session cookie; passwords and session tokens are not saved in the browser’s local storage. Signing out ends the current session.

Daily backups are encrypted on our server before they are stored, on that server and with GitHub. These measures protect your information, but no network or storage system is perfectly secure. Keep your password and VPN credentials private.

Service providers

Elviont Technologies runs Duvia’s servers and software itself. The providers below do part of the work. Each receives only what its part needs, and we use only providers that protect it to at least the standard of this policy.

Vultr (Netherlands)

Hosts Duvia’s server in the Netherlands: the account service, these pages and the International route’s VPN server.

Alibaba Cloud (Hangzhou, China)

Hosts the China route’s VPN server.

Apple

Processes App Store purchases and tells our server about refunds and revoked purchases.

Stripe

Processes payments made on the Duvia website.

Microsoft 365

Sends verification and recovery emails, and receives support email.

GitHub

Stores the encrypted daily backups. It cannot read them.

Cloudflare

Answers DNS requests on the International route, and serves the speed tests you start, through the VPN.

AliDNS and DNSPod

Answer DNS requests on the China route.

Google and Baidu

While connected, the app measures latency through the VPN against Google’s connectivity check (International route) or Baidu (China route).

While the VPN is off, the app measures latency against Duvia’s own server. The DNS, speed-test and connectivity services receive standard request information and may keep operational logs under their own policies. Duvia does not send them account details, purchase records or the device identifier. The app does not use IP-geolocation services.

Payments

In the app, packages are sold as App Store purchases and Apple processes the payment. Each purchase is linked to your Duvia account by an account identifier included in the purchase. Our server receives Apple’s signed transaction (transaction ID, product, purchase date, price and currency) and checks Apple’s signature before activating the package. We do not receive your Apple Account details or payment card. Apple notifies our server of refunds and revoked purchases, which end the related access.

Purchases made on the Duvia website are processed by Stripe, which receives your email and the payment details you enter. We store the purchase status, amount and transaction reference, not your card details.

Payment confirmation activates the package. Expiry, refunds and payment disputes decide whether access continues.

How long we keep it

Account records

Your account, purchases and usage are kept while the account exists. Deleting the account removes them from the active database straight away.

Backups

Encrypted daily backups are replaced on a rolling basis. Deleted data is gone from our backups within 90 days.

Retired purchases

A limited record of retired App Store transactions is kept after deletion, so the same purchase cannot be used again. Apple and Stripe keep their own payment records under their own policies.

Logs

The connection log and the sign-in log are kept for 14 days, and the web server’s access logs for 7 days. Then they are deleted.

Support email

Kept as long as needed to answer your request and follow it up.

Rate limits

Hashed rate-limit keys are deleted when they expire.

These pages

These pages need no account and use no advertising or analytics cookies, remote fonts or third-party scripts. Help search runs in your browser and does not send your search text anywhere.

The web server’s access log is counted into daily visit totals without cookies; the totals do not keep addresses. Links to other services, such as Apple, open those services, where their own policies apply.

Your choices and rights

You can turn notifications on or off, change preferences and reset the VPN configuration. Signing out removes the session and VPN profiles from the device; it does not delete the account.

To delete your account, open Settings → Account → Delete account, or Delete account on the Your access step if you haven’t bought a package yet, and confirm with your password. If you can’t open the app, email support from your account email. Deletion removes your account, purchases and usage from the active database and ends access straight away. It does not refund a purchase; App Store refunds are requested from Apple at reportaproblem.apple.com.

You can ask us for access to, correction or deletion of your information, ask us to restrict or stop processing it, or receive it in a portable form. Email us at the address below. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority where you live. Do not send passwords, VPN credentials or full payment-card details.