Your data, moment by moment

Who looks after your data

Secret Moon VPN (“the app”) and the VPN service behind it are developed and run by O.C.P.D PROPERTIES LTD (“we”, “us”). We decide how the data described here is used, which makes us its controller under the data protection laws that apply to it. Write to support [at] ocpd-properties.com about anything in this policy.

When you first open the app

The app downloads the public list of our server locations so it can show them to you. That download carries nothing about you; like any request on the internet, it reaches our server together with your IP address (see server logs). The app then asks you to read and accept how it handles data. It sends nothing else until you tap Connect.

The first time you tap Connect

Your device creates two pairs of cryptographic keys: one to sign the app’s requests to us and one for the WireGuard tunnel. The private halves never leave your device; they sit in the iOS Keychain. To register, the app sends us:

• the public half of the signing key;
• the platform (“ios”), the app version and the iOS version.

In return our server gives your device a random device number and a random account code, which the app also stores in the Keychain. No name, e-mail, phone number, Apple ID or advertising identifier is involved. We keep the device record for as long as the app on your device may use it, and delete it when you ask us to — the app will then simply register afresh next time.

Each time you connect

The app sends the public half of its tunnel key, signed with the device key, and asks for access. Our server answers with a private address for your device inside the tunnel, the address of the DNS resolver to use and an expiry time. We store that access record (device number, tunnel key, private address and times) while it is in use. It is removed automatically once it has expired and your device has not been in touch with us for 30 days.

The IP address you see on the app’s main screen is the address of the server you are connected to. The app does not ask any outside service to look up your own address.

While the tunnel is up

Your traffic travels encrypted from your device to the VPN server you picked, which passes it on to the internet under its own address. We do not record which sites or services you reach, the DNS names you look up, or the contents of your traffic.

DNS lookups made through the tunnel are answered by a resolver on the VPN server. When it does not know an answer, it asks Cloudflare (1.1.1.1) or Quad9 (9.9.9.9); those services see the VPN server’s address, not yours. The resolver keeps no log of the lookups.

For each tunnel, the VPN server tells our API server when the last WireGuard handshake happened and how much data has passed in total. It does not report your IP address. We use these figures to keep servers balanced and to retire access that is no longer used.

Connection reports

Making a VPN connect reliably on every kind of network takes evidence, so the app writes short technical reports and sends them to us about every five minutes. They are signed with the device key, which ties them to your device number. A report can contain:

• for each attempt to connect: the server and port tried, the order they were tried in, whether each one answered, the result or error code and its short description, how long it took, whether the tunnel was still up a minute later, and the kind of network (Wi‑Fi, cellular or other);
• events such as “tunnel started” or “tunnel stopped” with the reason and how long the session lasted;
• once a minute while connected: how much memory the VPN part of the app uses and the running totals of data received and sent — amounts only, never what the data was;
• the app version, the iOS version and the location chosen.

Until they are sent, reports wait on your device (at most 2,000 of them; the oldest are dropped first). On our side, connection attempts and events are deleted after 30 days, and the once-a-minute figures after 2 days. Hourly counts of connections for the whole service, with no device in them, may be kept longer.

When something goes wrong, the app shows a short code under the message. It is the beginning of that attempt’s number — quote it when you write to us and we can find the report.

Logs on our servers

Our API server, like most web servers, logs each request it receives: your IP address, the time, the address requested and the response. These logs exist to keep the service secure and to investigate faults. The web server’s log is deleted after 14 days. The API application keeps its own journal of requests, also with IP addresses, which the operating system trims when it reaches its size limit; how far back it goes therefore depends on how busy the server is. We do not combine these logs with anything that would tell us who you are.

Checking for a paid plan

The platform that runs our servers is built to support paid plans, so from time to time our server sends your random account code to Adapty, a subscription-management service, to learn whether a paid plan is linked to it. The current version of the app sells nothing, so the answer is “no plan”. Adapty receives the account code from our server and nothing else about you.

Backups

Every hour our API server makes a copy of its database — device records, access records and connection reports that are still within their retention periods. Copies stay 48 hours on the API server and 35 days on a separate backup server in the United States, after which they are deleted. Backups never contain anyone’s private keys.

When you write to us

If you e-mail us, we receive your address, your message and whatever you choose to include. We use it to answer you and keep the conversation for as long as it is useful for helping you, then delete it, unless the law requires us to keep it. Our mailbox is hosted by Google.

On this website

secret-moon-vpn.com sets no cookies and runs no analytics or advertising scripts; its fonts, pictures and code all come from this site itself. The web server keeps a log of requests (IP address, time, page, browser details) for 14 days. Cloudflare delivers the site and shields it from attacks, so it handles these requests on our behalf.

Who else is involved

We do not sell data, rent it out or share it with advertisers. We may disclose information if a valid legal order compels us to; because of how the service is built, we cannot hand over browsing history or DNS lookups, as we never have them.

How long things are kept

Why we are allowed to do this

Where the GDPR, the UK GDPR or similar laws apply, we rely on these grounds: providing the service you asked for (registration, access, the tunnel itself); our legitimate interests in keeping the service reliable, secure and free of abuse (connection reports, logs, backups, the plan check); and legal obligations, where a law requires us to keep or disclose something.

Data crossing borders

Our servers and partners sit in several countries, including some outside the European Economic Area and the United Kingdom. Where the law asks for a transfer safeguard, we use one it recognises, such as standard contractual clauses.

Your rights and choices

Depending on where you live, you can ask us for a copy of your data, ask us to correct or delete it, object to or limit how we use it, or ask for it in a portable format. You can also complain to the data protection authority where you live or work.

Since we don’t know who you are, an e-mail alone does not tell us which records are yours. Send us something that points to your device — for example a code shown under an error message, with the approximate time and location — and we will find, export or delete what we hold. You can stop all further collection at any moment by disconnecting and deleting the app.

Keeping it safe

Private keys are created and kept on your device. Every request from the app to us is signed, and the server checks the signature. Traffic in the tunnel is encrypted with WireGuard. No system is perfect, and if something went wrong that affected you, we would tell you where the law requires it.

When this policy changes

We will post the new version here with a new date at the top. If a change matters to how your data is used, we will also say so in the app or on this site before it takes effect.

Contact

O.C.P.D PROPERTIES LTD · support [at] ocpd-properties.com