1. Who we are and what this covers
BROTHER BUSINESS LIMITED ("heybro", "we", "us" or "our") is responsible for the processing described in this policy. Our address is Room B3, 19/F, Tung Lee Commercial Building, 91–97 Jervois Street, Sheung Wan, Hong Kong.
This policy covers heybro.io, VPN 2026 (App Store ID 6799810207), and support communications relating to these services. It distinguishes website information, VPN operation, third-party SDK data and purchase records. Visiting this site does not install the app or activate its SDKs. A link to another company’s service does not make that company’s processing part of our website.
2. VPN operation and connection logs
We do not save or retain VPN connection logs. We do not maintain a historical log of your VPN connection sessions. There is consequently no VPN connection-log retention period.
A live VPN connection necessarily processes network addresses and traffic transiently to route data between your device and the network. Transient processing needed to deliver a connection is different from retaining a history of connections. Our policy is not to use VPN traffic or connection information for advertising, profiling or tracking, or to provide that information to Firebase or AdMob.
No VPN connection logs does not mean no personal data. Website requests, support messages, Apple purchase information, and the separate SDK information described below are outside the scope of the connection-log statement. We do not represent the app as collecting no data or providing complete anonymity.
3. Other information we process
- Support and enquiries: your email address, message and information you choose to provide, such as app version, device model and a redacted purchase reference or receipt and the reason for a refund-related enquiry. We use this to respond and resolve your request. Do not send passwords, full card details, browsing history or VPN traffic.
- Purchase and entitlement information: product identifier, transaction reference, purchase/expiry dates and subscription status provided through Apple’s purchase systems, to verify access and restore eligible purchases. Apple holds the payment account and billing details.
- App settings: preferences needed for the functions you select. Device-local settings are removed according to your device’s app-data controls.
- Website delivery and security: our Cloudflare Pages hosting provider processes request information, including IP address, requested URL, browser information and technical/security events, to serve and protect this website. This is separate from VPN connection logs.
- SDK information: the app, device, installation, diagnostic, notification and advertising information described in section 4.
We use information to deliver requested functions, maintain reliability, verify purchases, answer enquiries, protect the services and meet legal obligations. We do not seek access to your contacts, photos, microphone or precise location merely because you use this website or a VPN.
4. Firebase and Google AdMob
The app integrates the following Google services. Collection depends on the SDK version, enabled settings, permissions and the features you use; the categories below describe the relevant processing rather than a promise that all collection is disabled. We remain responsible for choosing and configuring providers appropriately.
Firebase Analytics
Analytics processes app interaction events, app-instance identifiers and device/app attributes to understand product use. Approximate geography can be derived from network information. Where enabled and permitted, advertising-related identifiers can also be involved. Analytics events concern the app experience; VPN browsing contents and connection histories must not be included.
Firebase Crashlytics
Crashlytics processes crash stack traces, device/OS details and app diagnostic state to investigate faults. Reports can include app-event breadcrumbs when integrated with Analytics. Diagnostic reports must not contain VPN traffic, connection histories or sensitive content.
Firebase Cloud Messaging
Cloud Messaging uses notification registration tokens, installation identifiers and device/app metadata to deliver messages. Notification interactions can be measured through Analytics. iOS notification permission controls visible notifications; turning notifications off does not necessarily delete a previously created registration token.
Firebase Remote Config
Remote Config processes installation/app metadata and locale-related information to provide configuration values. When integrated with Analytics, it can also use app-event or audience information for configuration selection. It does not require a VPN browsing history.
Google AdMob
The ad-supported app experience uses Google AdMob. The Mobile Ads SDK can process IP-derived approximate location, device or advertising identifiers, ad impressions/interactions and diagnostics for ad delivery, measurement and fraud prevention. Non-personalized ads can still involve personal data. An active premium subscription removes in-app ads; this does not, by itself, disable Firebase, remove previously collected data or make other SDK processing anonymous.
We do not sell VPN traffic or connection information or disclose it to these SDKs. Device and app information processed by third-party SDKs is distinct from VPN connection logs. Consent or an advertising setting must not be treated as permission to process data in a way prohibited by applicable platform requirements.
Provider information: Firebase privacy and security, Firebase Apple-platform data disclosures, AdMob data disclosures and Google Privacy Policy. These notices supplement this policy and do not reduce our obligations.
5. Permissions, consent and your choices
- VPN permission: your device asks for permission to add a VPN configuration. You can disconnect or remove the configuration in device settings.
- Notifications: allow or disable notifications in iOS Settings → Notifications → VPN 2026.
- Tracking: where cross-app or cross-site tracking is proposed, Apple’s App Tracking Transparency permission is required before tracking. You can review it in Settings → Privacy & Security → Tracking. Refusing tracking must not remove paid features. Tracking permission does not turn off every SDK or override stricter VPN rules.
- Privacy choices: use any privacy controls presented in your app version, or contact [email protected] to withdraw optional consent or ask about processing. We will explain any available controls and their effects. This policy does not promise an in-app toggle that is not available in your version.
Where consent is required for optional collection, it must be obtained before that collection and be withdrawable. Necessary processing for a requested function, legal compliance or security may continue where law permits. A purchase is not consent to optional advertising or analytics.
6. Recipients and disclosures
Google processes the SDK information described in section 4. Cloudflare processes website delivery/security information. Apple processes store transactions under its own privacy terms; our purchase systems receive the limited information needed to manage entitlements. Email and operational service providers process enquiries on our behalf.
We require providers acting for us to protect information under appropriate contractual and security obligations, including protection consistent with this policy and applicable platform rules. An SDK provider may also have independent responsibilities, as explained in its notice. We do not authorize recipients to receive VPN traffic or connection histories for advertising or profiling.
We may disclose the minimum information legally required by a valid, binding legal demand, or necessary to protect legal rights, where permitted by law. We review the request and cannot provide connection logs we do not retain. If ownership of the business changes, any transfer of retained information must carry appropriate privacy protections and notice where required. We do not sell personal information as a business model; we do not use that statement to deny statutory rights concerning advertising-related sharing.
7. Retention and deletion
VPN connection logs are not retained. Support records are kept while an enquiry remains open and afterwards only as needed for follow-up, dispute handling or legal obligations. Purchase records are kept as needed to maintain entitlements, handle disputes and satisfy accounting/legal requirements.
SDK records follow the applicable service’s retention and deletion settings and provider terms; different categories have different lifetimes. Cloudflare’s security/request records follow the hosting service’s applicable settings and requirements. We do not state one universal retention period for these independent systems. We review retained information and delete or de-identify it when no longer needed for the stated purpose, subject to legal holds and backup expiry.
Request deletion at [email protected]. We will identify records we can locate, explain any information we must retain and apply deletion to relevant systems and providers where available. We may be unable to associate SDK identifiers with you without additional, proportionate information. Removing the app does not automatically erase provider records, cancel an Apple subscription or delete Apple’s purchase history.
8. Security and international processing
We use reasonable access controls and technical and organizational measures to protect information. No network, storage system or VPN can guarantee absolute security.
We operate from Hong Kong. Service providers may process information in other countries, including the United States. Where applicable law requires international-transfer safeguards, we use appropriate contractual or other recognized protections. Contact us for information about the safeguards relevant to your request.
9. Your privacy rights
Depending on applicable law, you may request access, correction, deletion, portability, restriction or an explanation of processing; object to certain uses; withdraw consent; or opt out of qualifying sale, sharing or targeted advertising. We will not discriminate against you for exercising a protected right. Withdrawal does not invalidate processing lawfully performed before withdrawal.
Email [email protected] with your request. We may verify your identity using information proportionate to the request and respond within the period required by applicable law. Where permitted, an authorized agent may act for you with proof of authority. You may complain to a competent privacy authority, including Hong Kong’s Privacy Commissioner for Personal Data, or the authority in your region.
Where the GDPR or similar rules apply, our legal bases are performance of the requested service, consent for optional processing where required, legal obligations and legitimate interests such as responding to support or protecting service security, subject to your rights and a balancing assessment. These bases do not override stricter Apple VPN restrictions.
10. Website storage and external links
This website does not load Firebase, AdMob, analytics tags or advertising scripts, and does not set marketing cookies. It uses locally hosted fonts and assets. Cloudflare may use necessary security functionality and process delivery information as described above. External links to Apple, Google or another site are governed by the destination’s own practices when you choose to visit.
11. Children
Our services are not directed to children under 13 or a higher minimum age required by local law. The App Store age rating describes content suitability; it is not a statement that a child can independently consent to processing or make purchases. Where legally required, a parent or guardian must authorize use and purchases. If you believe a child has provided information contrary to this policy, contact us so we can investigate and take appropriate action.
12. Changes and contact
We will update the date on this page when the policy changes. For material changes, we will provide additional notice and seek consent where required, rather than treating continued use as consent to new optional processing.
BROTHER BUSINESS LIMITED
Room B3, 19/F, Tung Lee Commercial Building, 91–97 Jervois Street, Sheung Wan, Hong Kong
Privacy: [email protected]
Support: [email protected]
English and Russian versions are provided for accessibility. Neither translation limits your mandatory local rights. See also our Terms of Service.