Privacy Policy

1 Introduction

RootNet ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").

RootNet is a VLESS/V2Ray proxy application that routes your internet traffic through encrypted tunnels to servers worldwide. We are designed with privacy as a foundational principle — we do not log, monitor, or store your online activity.

By using RootNet, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2 Information We Collect

We collect only the minimum information necessary to provide and improve the Service:

3 How We Use Your Information

We use the collected information for the following purposes:

• To Provide the Service — Authenticate your account, connect you to VLESS servers, manage your VPN session timer, and display connection status.
• To Serve Ads — Show rewarded video ads via Google AdMob that grant you VPN session time. Ad personalization is controlled by Google's ad services; you can opt out of ad personalization in your device settings.
• To Ensure Security — Check app version compatibility, prevent unauthorized access, enforce rate limits, and detect replay attacks.
• To Communicate — Send password reset emails and critical service notifications (we do not send marketing emails).
• To Improve the Service — Analyze aggregate usage patterns to optimize server selection and app performance.

4 Data Sharing & Third Parties

We do not sell, trade, or rent your personal information. We may share data only with trusted third-party service providers who help us operate the Service:

Each provider is contractually bound to use your data only as necessary to provide their service and to maintain appropriate security measures. Google AdMob's data handling is governed by Google's Privacy Policy.

5 Data Security

We implement industry-standard security measures to protect your data:

• Encryption in Transit — All communication between the app, our API (Cloudflare Workers), and Supabase is encrypted via TLS 1.3.
• Encrypted Tunnels — Your internet traffic is encrypted using VLESS/V2Ray protocol with AES-256-CBC encryption.
• JWT Authentication — Access to our API requires a valid, time-limited JWT token verified against cached JWKS keys.
• Rate Limiting & Replay Protection — Our API enforces strict rate limits and request deduplication to prevent abuse.
• No Client-Side Secrets — Sensitive data (VLESS server configs, service keys) are never stored in the app; they are fetched on-demand from our secured API.

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6 Data Retention

We retain your personal information only as long as necessary to fulfill the purposes described in this policy:

• Account data (email, auth metadata) — Retained until you delete your account or request removal.
• VLESS server configs — Not stored by us; they are fetched in real-time from our secured database and are never cached on the device beyond the current session.
• Session logs — Connection timestamps are ephemeral and not persisted beyond the current app session.
• Advertising data — Governed by Google AdMob's retention policies.

You may request deletion of your account and associated data at any time by contacting us at the email below.

7 Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request deletion of your account and associated data ("right to be forgotten").
• Objection — Object to the processing of your data for specific purposes (e.g., ad personalization).
• Data Portability — Request a copy of your data in a machine-readable format.
• Withdraw Consent — Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at the email address below. We will respond within 30 days.

8 Children's Privacy

RootNet is not intended for use by individuals under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.

9 International Data Transfers

Your information may be transferred to and processed in countries where our third-party service providers operate (including the United States and the European Union). We ensure appropriate safeguards are in place through standard contractual clauses and data processing agreements with our providers.

By using RootNet, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence.

10 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new policy on this page with an updated "Last updated" date
• Displaying a notice within the app upon next launch
• Sending an email notification (for significant changes)

We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

11 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@rootnet.app
• Website: https://rootnet.pages.dev

We aim to respond to all inquiries within 48 hours.