Skip to content
StarVPN

StarVPN documents

Privacy Policy

How StarVPN handles account, subscription, support, diagnostic, and service-security data.

This policy covers RYKO VPN for iOS and the StarVPN service operated by DMD GROUP, MMC. The same company provides the account, subscription and support services described below.

  • Effective date: 2026-06-18
  • Last updated: 2026-10-02
  • Provider / data controller: DMD GROUP, MMC — "DMD GROUP" Məhdud Məsuliyyətli Cəmiyyəti, a limited liability company registered in Azerbaijan on 19.12.2024 (VÖEN 2008939081, D-U-N-S 933893438) ("StarVPN", "RYKO VPN", "we", "us")
  • Director / authorized representative: Dadashov Rovshan Eldar oglu
  • Registered address: AZ1123, Baku, Khatai District, Xudu Mammadov St. 3, Apt. 70, Azerbaijan
  • Privacy / data-protection contact: legal@dmdmmc.com · +994 99 738 83 38 · https://dmdmmc.com/

1. Summary

StarVPN is a consumer VPN. We sell access to encrypted VPN servers through our website and supported app platforms. We do not log your browsing. We collect the minimum needed to run your account, deliver the service, keep it reliable, and bill you. We do not sell or rent your personal data or use VPN traffic for advertising or profiling. Processing by infrastructure providers is described in section 6.

2. Our no-logs commitment

While connected to StarVPN we do not record:

  • the websites, domains, or services you visit;
  • your DNS queries;
  • destination IP addresses or SNIs of your traffic;
  • the contents of your traffic;
  • a history that maps your account to the sites/apps you used.

Our servers process this traffic in transit only to deliver it; it is not written to logs or retained.

VPN-core access, destination/error and DNS-query logs are disabled. Service health checks and byte counters do not contain a list of the websites or apps you use.

3. Information we do collect

Account data. Email address (for email-code sign-in), account identifiers, and your subscription/entitlement state. Email is optional for guest access.

Device & connection data (operational). A per-device install identifier, device slot, platform (for example, Android or iOS), app version, chosen server location/protocol, and connection diagnostics: connect/disconnect events, latency and success/failure of connection attempts, and the node selected. These are used to operate, secure, and improve reliability — not to profile your activity. Where available and with your consent, coarse network context (e.g., ASN/ISP, client country) for regional quality. The app does not request GPS or precise coordinates. In the mobile apps, automatic connection-quality reports can be disabled in Settings without disabling local recovery behavior. Full diagnostic reports sent for support may also include session timing, VPN-extension memory use and CPU time to help investigate hangs and connection failures. These counters do not identify the websites or apps you use.

The service also maintains authentication state, connection/session counts and uploaded/downloaded byte counters for access control, capacity and fair-use checks. These counters can be associated with an account/device; they are not anonymous and do not identify traffic destinations. A source IP is necessarily visible when a device connects. For connection-quality and diagnostic records we use a keyed hash and coarse network context rather than a browsing history. Our website/API infrastructure may also retain service-access and security logs with the requesting IP, time, StarVPN endpoint, response status and user agent. These concern requests to StarVPN itself, not the destinations of your VPN traffic.

Subscription and payment data. We process the product and term, payment method, amount, currency, status, our order identifier, and the provider's transaction identifier. For website SBP payments, we send RollyPay the order and account identifiers, subscription description, amount, and return URLs. We do not receive or store bank-account details. For Apple in-app purchases, we receive the receipt/entitlement and renewal status, not the payment details of the Apple Account. For Google Play subscriptions, we receive the product, purchase token, order and subscription state needed to verify access, process refunds, and stop renewals. The Play purchase token is encrypted at rest. We do not receive payment-card or bank-account details from the user's Google Account.

Support data. Messages, metadata, screenshots you select, and full diagnostic reports you explicitly attach or send for support. StarVPN does not read your full photo library; the mobile operating system presents a picker for individual images. Before saving a diagnostic report, the API removes recognized raw VPN-core traffic lines and masks network addresses, URLs and named credentials in diagnostic text. Support messages and selected screenshots may contain personal information you choose to include; please do not send passwords or sensitive browsing content.

4. How we use information and legal bases

  • Provide and operate the service, your account, and devices — *performance of a contract*.
  • Keep the service reliable and secure (admission, fair-use, quality, abuse prevention) — *legitimate interests / contract*.
  • Process subscriptions, referral rewards, and support — *contract / legitimate interests*.
  • Comply with law — *legal obligation*.
  • Automatic connection-quality reports — *consent*, withdrawable in the app's Settings. Full diagnostic reports, support messages, and screenshots are sent only after your explicit action.

5. Mobile VPN commitment

We do not sell your personal data or use VPN traffic for advertising or profiling. We process traffic to deliver the connection you request. The account, operational, security and optional diagnostic data we retain are described in sections 3 and 4. Infrastructure providers used to deliver the service receive and process data as described in section 6, including the processing of optional reserve connections.

Before the first connection, the mobile app explains that Android or iOS will route internet traffic through the selected StarVPN server and shows a data and privacy disclosure describing what we collect and why.

6. Sharing and subprocessors

We share personal data only with service providers ("subprocessors") that help us run StarVPN, under contract and only as needed:

  • cloud/edge server providers (Zomro for our primary service host, and Podaon SIA and Regxa nodes used by the current managed VPN network);
  • Apple (in-app purchase and app distribution);
  • Google (Google Play distribution, billing, and subscription-state verification);
  • RollyPay (website SBP payment creation and confirmation);
  • Resend, for email sign-in codes and optional support notifications. Resend receives the recipient address and email content. Support emails contain a notification and an authenticated link, not the conversation, screenshots or diagnostic report. Resend states that its customer data is stored in the United States: https://resend.com/security/gdpr.

Account, entitlement, connection-quality and support records are stored in our access-controlled service database. The database and private, self-hosted support image storage run on our Zomro-hosted server in the Netherlands, not in a public image bucket. VPN endpoint credentials and traffic counters are processed on the selected server; the current managed network has nodes in the Netherlands, Germany, Poland and the United States. Provider access is limited to what is necessary to operate the relevant service. We do not send VPN browsing activity to advertising or third-party analytics services.

We do not sell personal data. We may disclose data if required by valid legal process, but we cannot disclose traffic logs we do not keep.

7. International transfers

We operate servers in multiple countries; selecting a server can involve cross-border processing. Resend processes transactional email in the United States under its Data Processing Addendum: https://resend.com/legal/dpa. Applicable transfer safeguards depend on the provider and jurisdiction. You can request information about the providers and safeguards relevant to your data from legal@dmdmmc.com. This policy does not claim that every destination country has an adequacy decision.

8. Retention

We keep account and billing data while your account is active and as required for legal/accounting, refund, and fraud-prevention purposes, then delete or anonymize it. Automatic connection-quality events are retained for no more than 7 days; full diagnostic logs explicitly sent by a user are retained for no more than 30 days; and user-selected support screenshots are retained for no more than 180 days or deleted earlier with the account. VPN traffic logging is disabled. These deletion periods apply to the live service. Restricted disaster-recovery backups follow their backup-rotation schedule; removed records are not used to operate the service and deletion/privacy filters must be reapplied before a backup is restored to service. Backups made before the diagnostic cleanup on 24 September 2026 may contain earlier versions of user-submitted reports with network addresses, until those copies rotate out. They are not used for analytics or to operate the live service.

9. Your rights and account deletion

Subject to your jurisdiction, you may request access, correction, deletion, portability, restriction, or objection, and may withdraw consent. You can delete your account and personal data directly in the app (Settings → Delete account) or the account portal (Account → Delete account). Public instructions are available at https://starvpn.tech/legal/en/account-deletion. If you have an active Apple subscription, cancel it in iOS Settings because Apple billing continues independently. Before deleting an account with a known auto-renewing Google Play subscription, StarVPN asks Google to stop the next renewal; deletion does not complete if that request cannot be confirmed. Account deletion does not automatically refund a completed payment. To exercise other rights, contact legal@dmdmmc.com. You may also complain to your local data protection authority.

10. Security

We use encryption in transit, access controls, pinned credentials, and operational hardening. No system is perfectly secure, but we work to protect your data.

11. Age and children's data

The minimum age for using StarVPN is 13 years, subject to the eligibility requirements in our Terms of Use. StarVPN is not intended for children under 13, and we do not knowingly collect their personal data.

The minimum age for using the service is not the same as the age at which a person may independently consent to personal-data processing. Where we rely on consent, the applicable local consent requirements still apply. Acceptance of the Terms of Use or approval of an app-store purchase does not replace any legally required authorization for personal-data processing.

If you believe we have collected a child's personal data without the required legal basis, contact legal@dmdmmc.com to request review and deletion under section 9.

12. Changes

We may update this policy; material changes will be notified in-app or by email, and the "Last updated" date will change.

13. Contact

legal@dmdmmc.com · DMD GROUP, MMC, AZ1123, Baku, Khatai District, Xudu Mammadov St. 3, Apt. 70, Azerbaijan.