OwnTunnel — Privacy Policy
1. Who is responsible
OwnTunnel is published by CATALUMIA S.L., a company registered in Spain (Calle Calabria 149, ent 1ª, 08015 Barcelona, Spain, tax ID Y5575476Z). Under the GDPR, CATALUMIA S.L. is the data controller for anything described here.
Contact: [email protected]
We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale processing of personal data. As explained below, we do not process personal data at all.
2. The short version
OwnTunnel has no back end. There is no account, no sign-in, no e-mail address, no analytics, no crash reporting and no advertising. Nothing you do in the app is reported to us, because there is nowhere for it to be reported to: what we run is this website and a support mailbox, and the app never contacts either of them.
Your VPN traffic goes from your device to a server you control. It never passes through anything we operate. There is no traffic log for us to keep, hand over or lose, because your traffic never reaches us.
On iOS and macOS the app does less than even that implies: it takes a WireGuard configuration you paste or scan, and the tunnel is the only connection it ever opens. It asks for no credentials, stores none, and makes no request of its own to anybody — not to us, and not to any cloud provider. On Android it can do one thing more: with an API token you give it, from your device straight to your provider, it can build the server in the first place.
3. What we do not collect
We do not collect, receive, store or have access to:
- your name, e-mail address, phone number or postal address;
- any account or user identifier — there are no accounts;
- your IP address, either your real one or the one your tunnel gives you;
- your browsing history, DNS queries, connection times, session durations or bandwidth figures;
- your WireGuard keys or configuration;
- your cloud provider API token — on Android, where one exists; the iOS and macOS apps never ask for one;
- device identifiers, advertising identifiers or IDFA;
- crash reports, diagnostics, performance data or usage analytics;
- contacts, photos, location or health data;
- purchase or payment data — the app sells nothing and contains no in-app purchases.
The app contains no analytics, advertising, attribution, crash-reporting or A/B-testing SDK — none of the class of library whose purpose is to watch users. What it does depend on are open-source technical components that do the actual work: the WireGuard implementation itself (WireGuardKit on iOS and macOS, WireGuard's own Android library on Android) and, on Android, the ZXing QR decoder alongside the AndroidX camera and encrypted-storage libraries. None of them collects anything about you, and none of them reports to us. When the source is published, that is checkable line by line.
4. What stays on your device
How much is stored depends on the platform. The rule does not: whatever is stored is encrypted, tied to that one device, and kept out of every backup.
On iOS and macOS there is exactly one secret, and it lives in the system Keychain:
| What | Where | Protection |
|---|---|---|
| Your WireGuard configuration, including the private key | Device Keychain | AfterFirstUnlockThisDeviceOnly, not synchronizable |
Version 1.2.0 of the iOS and macOS apps keeps no cloud provider API token, because it has no use for one: it creates no servers and speaks to no provider. Versions up to 1.1.1 could, and a device upgraded from one of those may still be carrying what it left behind — a token in its own Keychain item, and a short list of server IDs in ordinary app settings. None of the code that could read either of those is in 1.2.0 at all, so the first launch of 1.2.0 erases both, once, without being asked and without being able to show them to you first. A live credential that no screen in the app can display, explain or delete is not something an upgrade should quietly leave behind.
What those two protection flags mean in practice:
- Not synchronizable — these items are excluded from iCloud Keychain. They are never uploaded to Apple or to anyone else.
- ThisDeviceOnly — these items are excluded from device backups, including encrypted ones. Restoring a backup onto a second device does not carry your private key with it.
A third copy of the configuration exists in a shared Keychain group so that the VPN system extension — a separate process required by iOS to run the tunnel — can read it. It carries the same protections and does not leave the device either.
On Android there are two secrets — your configuration, including its private key, and the cloud provider API token if you gave the setup wizard one. Both are written as encrypted files in the app's own private storage, using Jetpack Security's EncryptedFile. The key that decrypts them is generated on the device and held in the Android Keystore, so it never exists anywhere else and cannot be read off a copied file. The app declares allowBackup="false" together with explicit data-extraction rules, which keeps both files out of cloud backup and out of device-to-device transfer — the Android equivalent of the "this device only" flag above. There is no shared-storage copy: on Android the tunnel runs inside the same app, so nothing has to be handed to a second process.
Beside the secrets, both apps keep a few ordinary settings that are not credentials and open nothing: your preferences, and on Android whether you have accepted the disclosure Google Play requires.
Android keeps one list beyond that, and it exists because the wizard does: the numeric IDs of servers this device asked a provider to build and has not finished with. That list is what lets the app offer to clean up a half-built machine you are being charged for without ever offering to delete a server some other device of yours is using. An entry disappears as soon as the question about it is settled. It is stored in ordinary app settings rather than encrypted storage, because a server ID of your own cannot open a tunnel or spend money. The iOS and macOS apps keep no such list — they start no servers — and, as described above, 1.2.0 deletes the one an earlier version may have left.
"Forget this configuration", on the Your data screen, erases what the app holds: the stored configuration, the extension's copy of it on iOS and macOS, the API token on Android, and the VPN profile the app installed in system settings. If any part of that erasure fails, the app tells you so rather than claiming success. On Android the list of unfinished servers is deliberately not erased with it — losing track of a machine that is still on your bill is not something a privacy button should do to you. It never leaves the device either way, and deleting the app removes it along with everything else.
5. Every network connection the app makes
This is the complete list. There are no others.
On iOS and macOS there are two, and the first one is the tunnel:
- The VPN tunnel itself: UDP to the server named in your configuration, on the port that configuration names, encrypted with WireGuard. Direct, device to your server.
- Informational and legal links you tap, which open in your browser: OwnTunnel's privacy, terms and support pages.
That is the whole list for those two platforms. The app itself originates nothing: no provider API call, no telemetry endpoint, no update check, no licence check, and no provider sign-up, referral, billing or purchasing link. On macOS this is enforced below the app as well — the com.apple.security.network.client entitlement was removed from the Mac app in 1.2.0, so the sandbox would refuse an outgoing connection even if one were attempted. Only the tunnel extension, which has to speak WireGuard's UDP, still carries network entitlements.
On Android both of those exist too, and the setup wizard adds two of its own:
- To your cloud provider's API (
https://api.hetzner.cloud/v1), and only while you are using the setup wizard or answering the "leftover server" question at launch. Your API token is sent in theAuthorizationheader of that request, from your device straight to Hetzner. It does not pass through us, and we could not read it if we wanted to — we operate nothing on that path. What Hetzner does with that request is governed by Hetzner's own privacy policy and by the contract between you and Hetzner. We are not a party to it. - To the server the wizard just created, a single TCP connection on port 51821, repeated until it succeeds. This is how the app knows the installation has finished. It carries no data — the connection opens and closes. That port is shut by the server itself 15 minutes after boot.
On neither platform is there an OwnTunnel server, a telemetry endpoint, an update check or a licence check. The Your data screen states this inside the app, and it is accurate.
6. DNS
A WireGuard configuration can name a DNS resolver, and while the tunnel is up your device uses the one it names. Which resolver that is depends on who wrote the configuration.
The servers the Android wizard builds are set up for 1.1.1.1, Cloudflare's public resolver. On those, your DNS queries reach Cloudflare — not us — and Cloudflare's privacy commitments for that resolver apply to them.
On iOS and macOS the resolver is whichever one the DNS = line of your own configuration names, because the configuration is yours. The app neither chooses it nor changes it. If your configuration came from an Android OwnTunnel server, it will say 1.1.1.1 and the paragraph above applies to it.
We mention this because it is the one third party your everyday traffic touches by default, and a privacy policy that quietly omitted it would be a bad one. You can change the DNS = line in your configuration to any resolver you prefer, including one on your own server. A future version of the Android wizard will put the resolver on your own server by default.
7. The camera
The app asks for camera access for exactly one purpose: reading a QR code that contains a WireGuard configuration.
The camera frames are analysed on the device and then discarded. On iOS that work is done by the system's built-in code detector; on Android it is done by ZXing, an open-source QR decoder compiled into the app, which likewise runs entirely on the device and talks to no network. No image or video is written to disk, saved to your photo library, or transmitted anywhere. The app does not request photo library or gallery access at all. If you decline camera access, everything else works; you paste your configuration as text instead.
On macOS there is no scanner at all — the system's code detector does not work there — so the Mac app never asks for camera access and declares no camera permission.
The Android build declares five permissions and no others: internet access and network-state access, which a VPN client cannot work without; camera, for the scanner described here; notifications, so the tunnel can show its own status; and permission to be told the device has finished booting, which is only used if you have asked the tunnel to come up at start-up. It declares no advertising ID, which is why the Play data-safety form can say that nothing is collected.
8. The server at the far end
On iOS and macOS, OwnTunnel creates nothing. The server is one you already run or control, and the app's only dealing with it is the tunnel: it has no credentials for it, no management connection to it, and no screen that could change anything on it. What that machine records, and who is allowed to reach it, is a matter between you and whoever runs it. Your private key is never sent to the server or anywhere else — it is the key inside the configuration you imported, and it stays in this device's Keychain.
On Android, the setup wizard creates a virtual server in your own cloud account, on your own bill. It is yours to control. We have no access to it, no credentials for it and no way to reach it.
- Both key pairs are generated on your device. The server is sent its own private key and your device's public key. Your private key is never sent to the server or anywhere else.
- Servers the app creates are tagged with the label
owntunnel. The app only ever lists or deletes servers carrying that label, so your unrelated machines are invisible to it, and it never deletes anything without asking you first. - Anything the server itself records — system logs, your provider's own billing and infrastructure records — belongs to you and to your provider. We cannot see it. If you want it gone, delete the server; your provider's data retention terms then apply.
- A server the wizard builds also listens for new devices, so a second phone or laptop can join the server you already pay for instead of costing you another one. That listener is bound to the server's address inside the tunnel and to nothing else: it has no port on the public internet, and the only way to reach it is to be connected already. A joining device generates its own key pair and sends only the public half; its private key never leaves it either.
- Two consequences are worth knowing before you share a configuration with anyone. Any device holding your configuration can add further devices, because being inside the tunnel is the only proof the server asks for. And a device that has been added cannot be removed — there is no revoke, so the only way to take access back is to delete the server and set up a new one. Treat your configuration as a key to the server, not merely a ticket through it.
- Devices sharing a server can reach one another across the tunnel, the way machines on a home network can. For your own phone and laptop that is usually the point; if you have handed your configuration to somebody else, they are on that network too.
The iOS and macOS apps have no "add a device" screen, so joining a second device to a server is not something they can do. An Apple device set up from such a server's configuration is simply a peer on it, like any other WireGuard client.
9. Referral links
The iOS and macOS apps accept no credentials at all, and contain no provider account sign-up, referral, billing or purchasing links. A future Android build or our website may offer a clearly disclosed provider referral link, subject to the rules of that platform.
If we offer one, an equivalent plain link that earns us nothing will be available beside it. The provider reports only an aggregate service credit, not your identity: we do not learn that you signed up, what you bought or what you ran there.
10. Children
OwnTunnel is not directed at children and collects nothing from anyone, children included. It is rated 4+ because it contains no objectionable content, not because it is aimed at young users.
11. Changes to this policy
If the app's behaviour changes, this policy changes with it, before the change ships. The current version always lives at https://owntunnel.app/privacy with its effective date at the top. Because we hold no contact details, we cannot notify you individually; material changes will be noted in the app's release notes.
What changed on 5 October 2026. The iOS and macOS apps no longer create servers. Everything to do with cloud accounts came out of those builds — the provider API call, the API token, and the record of servers the device had started — and version 1.2.0 erases, on its first launch, whatever an earlier version had left on the device. The Android app is unchanged and still has the setup wizard, which is why this document now separates the two throughout.
12. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, to object to processing, and to lodge a complaint with a supervisory authority.
We state honestly what those rights mean here: we hold no personal data about you, and we cannot identify you. There is no account to look up, no record to export and nothing to erase on our side. Under Article 11 GDPR, a controller who cannot identify a data subject is not required to acquire additional information solely in order to comply with a request — and we will not start collecting identifying data in order to be able to answer such requests.
The data that exists is on your device, under your control, and the Your data screen erases all of it in one action.
If you believe we are processing personal data about you, write to [email protected] and we will answer. You may also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es, or to the supervisory authority in your own country of residence.
13. Contact
[email protected] — CATALUMIA S.L., Spain.
This policy was written to describe what the software actually does, line by line against its source code. It is not legal advice, and review by a qualified lawyer is recommended before publication.