Scope
This policy covers package io.orylume.vpnfiles, version 1.0.0 (1). The app has no user account, advertising, analytics, subscription, trial, payment, or sale of personal data. It is not directed to children under 13.
Traffic handled by the VPN
While the VPN beacon is active, relay.orylumevpn.com:51820 necessarily processes the connection's source IP, DNS requests, destination addresses, and packet contents in transit so it can route traffic through London, United Kingdom. WireGuard encrypts data from the device to that endpoint. The node is configured not to store browsing destinations, DNS-query history, packet contents, connection timestamps, or per-user bandwidth history. Traffic is not sold, profiled for advertising, or shared for another company's independent use.
Local files and document work
When you enable All files access, Orylume can read shared-storage paths, names, sizes, dates, and the content of documents you open. Those values are used on the device for the file and reading desk, search, document rendering, exact-copy comparison, and actions you explicitly choose. File inventories and document content are not uploaded to the provisioning API, VPN endpoint, policy website, analytics, or advertising services.
APK selection
Orylume does not download applications. If you select a local APK, the app explains the permission and may grant Android's system package installer temporary read access to that one file. Android presents the final decision. The APK is not uploaded to the operator or VPN endpoint and this flow is not used for self-updates.
Device route profile
The app generates a WireGuard key pair. The private key is encrypted and remains on the Android device. The matching random public key is sent by HTTPS and stored at the endpoint with an assigned tunnel address. It remains until you use the in-app profile deletion action. That action requests removal of the server peer and erases the local encrypted key and cached route profile.
Controls and deletion
You can leave storage access disabled, disconnect the VPN, decline package-install access, revoke either special access in Android settings, or delete the VPN device profile in the app. There is no account or cloud document library. Questions and privacy requests must be sent to the monitored publisher contact that will replace the placeholder below before release.
Infrastructure providers
Cloudflare delivers the public website, privacy notice, and reviewer media and may process ordinary web-security and delivery records under its terms. BitLaunch supplies the virtual machine used for the VPN endpoint. These service providers do not receive the app's local file catalogue. No advertising, analytics, attribution, or third-party crash-reporting SDK is included.
Operator and contact - required before release
Legal operator: [PUBLISHER/LEGAL ENTITY REQUIRED]
Postal address: [REGISTERED ADDRESS REQUIRED]
Privacy email: [MONITORED EMAIL REQUIRED]
Suggested mailbox after activation: privacy@orylumevpn.com
Changes
A material change to data handling, retention, recipients, or app permissions will require an updated notice and, where applicable, renewed in-app disclosure and Play Console declarations.