Privacy Policy

Last updated: 23 October 2026

This page says what leaves your device and what does not, without phrases like “we care about your privacy”.

In short

We keep no log of the sites you open, your DNS queries, or the contents of your traffic.
There is no account: we never ask for or store an email, phone number or password.
We do not claim the app collects nothing. It is an ad-supported app, and ad networks receive your device advertising ID.
What does leave the device is described below, by category.

Who processes the data

The operator is GENESIS RACK INSTALLATION LLC, the same developer the app is published under on Google Play. The contact address is support@liskavpn.com, the same one shown in the site footer. This policy applies to both test builds and the public release.

The website, however, is already running, and it has to be counted separately: see “This website’s data” below.

This website’s data

The site is static: no executable JavaScript, no analytics, no ads, no forms, no cookies. There is nothing on the page that could tie a visit to you personally. The one script tag on the page is a data block for search engines; the browser does not execute it.

But every web server sees the network data of a request, and our hosting provider is no exception: IP address, timestamp, the page requested, the browser string. Those records are created and kept by the hosting provider under its own retention rules; we do not query or use them.

What we do not do

These limits apply to the app itself and to our servers.

We do not record which sites or apps you open through the tunnel.
We do not record the contents of your traffic.
We keep no DNS query log.
We do not store your real IP address tied to your online activity.
We do not sell traffic, rent out your connection, or embed proxies in other apps.
We do not send the list of your apps anywhere: to let you choose exceptions, the app reads which installed apps have a launcher icon, and that list and your choices stay on the device.
The app does not ask for your email, phone number, name, contacts or photos, and does not request device location permission. The only location information we get is a country code — see the next section.

What leaves the device

Each item has its own purpose.

First-party telemetry about how the app works and is used: for example connections — their outcome, duration and quality (including speed and the amount of data transferred), the chosen location and connection method; configuration refreshes; automatic reconnects; returns to the app; why the app last closed (for example, a crash); in-app tips such as the battery settings guide and whether you used them; advertising load and display results, including the ad network’s name and the estimated revenue from an impression; connection-quality ratings you choose to give; reminders; and delivery of the events themselves. We use it to find broken locations, connection failures, and advertising problems, and to improve the app.
Each event carries pseudonymous technical identifiers: did links events from one app installation, and two more random identifiers mark a single app run and a single event. The did is not tied to an account because there is no account; it changes after app data is cleared or the app is reinstalled, and the other two are renewed more often.
Installation and its source. We send the installation time and labels from a fixed list: installation type, source lookup result and source; for a button on our website, the page, language and button position. These are linked to did to measure which installations lead to a working connection. We do not store the raw referrer string or full URLs, and do not send them to our telemetry.
Common technical fields: information about the device, app and network, for example the device manufacturer and model, Android version, processor architecture, whether battery saving or background restrictions on the phone apply to the app, system language, the device time zone, app version, network type, the mobile carrier’s country and network codes from the SIM card (MCC and MNC), and technical details about the app’s configuration and consent state.
Connection-quality rating. Sometimes, after you disconnect, the app asks you to rate the connection from 1 to 5 stars; you do not have to rate it. A rating you give goes to our telemetry together with the did.
Country code from the IP address. When ads start, the CAS.ai mediation partner determines the country from the IP address of the request and returns a two-letter country code to the app. The app sends that code to our telemetry together with the did. The IP address itself does not enter telemetry, and location is not resolved more precisely than the country.
We add no IP address, URL, domain, credential, or free-form text to telemetry. It also contains no visited sites or apps, DNS queries, traffic contents, or VPN node addresses or keys. The server adds the event receipt time and the number of the network the data came from (its autonomous system number, which shows which internet or mobile provider it was). The server determines that number from the sending IP address at the moment of receipt and then discards the address: the IP address is not stored and not written to any log.
Advertising data: the device advertising ID and the IP address the request comes from. Ad networks receive these, and so does AppMetrica (see “Advertising” below). We are the ones who put their code in the app, so the transfer is our responsibility — but this data does not enter our own telemetry and is not stored on our servers.

Who we pass it to

The app’s own telemetry is received only by our own server. Every day the operator copies the events to an offline archive on operator-owned storage, for long-term analysis and recovery. Neither the server nor the archive sends these events to a third-party analytics service.

Advertising data is processed separately by the mediation partner, the ad networks and AppMetrica named in the next section. We do not send our did to them.

Advertising

The app is free and paid for by ads. Ads are served through CAS.ai mediation, which connects third-party ad networks. Depending on the network, device settings, and consent, they may receive the advertising ID, the IP address of the ad request, and technical details about the device and app, and process them under their own policies.

The mediation and advertising auction may include Google AdMob, Meta Audience Network, Yandex Mobile Ads, Unity Ads, ironSource, Vungle / Liftoff, InMobi, Mintegral, Bigo Ads, Amazon Ads, AppLovin, Chartboost, Tapjoy, BidMachine, Pangle, PubMatic, Kidoz, Prado, Maticoo, Display.io, YSO Network, and MonetriX. This is not an exhaustive list: CAS.ai can change networks and auction participants without an app update. Their official policies are linked below; several brands in one corporate group may point to the same document.

One more SDK is named separately because it does analytics rather than ad serving: AppMetrica by Yandex. It comes into the app together with the Yandex Mobile Ads adapter bundled through CAS.ai, and we use it to measure which ad campaigns installations come from and how much ad revenue the app earns. For that it sends installation, device and usage information, the advertising ID and the revenue from ad impressions to Yandex, which processes them under its own policy. Our did and the rest of our own telemetry events are not sent to it.

You can reset the advertising ID and, on supported Android versions, delete it: Settings › Google › Ads. Once deleted, ad networks stop receiving that identifier. Ads themselves do not go away, and how personalised they remain depends on other settings and signals we do not control.

Permissions

VPN permission. Android itself asks for this with a system dialog. No VPN app can work without it: it is what lets the app create a tunnel.
Internet access. Needed in order to connect.
The persistent VPN notification. While the tunnel is up, Android requires it to be shown — that is a system requirement.
Notifications from us. When a session ends and the tunnel goes down, we send a notification offering to reconnect; we may also send reminders through a separate “Reminders” channel. These are our choice, not a system requirement, and each can be switched off separately in Android notification settings — the persistent one stays.

How long it is kept

On our server, raw first-party telemetry events are kept for a limited period and are then removed automatically.

The operator’s offline archive is kept long-term and is not cleaned up automatically: it lets us compare connection quality over a long period. The archive stays on operator-owned storage and is not passed to anyone.

To delete your events, open the support contact in the app and ask us to erase your telemetry. The app automatically adds the current did, along with the app version, device model, Android version and connection counters, to the support email draft; leave the did line in place so we can find the records. On such a request we delete that did’s events in both places — on the server and in the offline archive. Your sender address becomes associated with the did only if you choose to send the email.

Clearing app data or reinstalling changes the did, so new events are no longer linked to old ones. Reinstalling does not by itself delete events already sent: they are removed from the server when the retention period ends, and from the offline archive on a deletion request.

Data received by ad networks is held by them, under their rules — that is also where it has to be requested or deleted.

Children

The app is not intended for children under 13 and does not collect age information. If you learn that a child is using it anyway, write to us.

Changes

If we change this policy, the date at the top of the page changes with it. Material changes will also be noted in the Google Play release notes.