Privacy Policy

Last updated: 1 October 2026 · Applies to Oshi Free-Dom VPN on Android (app.diopta.vpn), iOS, macOS, tvOS and visionOS.

Most VPN privacy policies are written to be agreed to. This one is written to be checked: every claim below names the mechanism behind it, so you can go and confirm it rather than take our word for it.

Who is responsible for your data. Oshi Free-Dom VPN is published by Oshi Lab, operated by Hugo Moriceau as an individual, who is the data controller for everything this policy describes. Contact: contact@oshi-messenger.com.

The short version

We do not sell, use, or disclose to third parties any user data for any purpose.

We do not log your browsing. We do not know your name. There is no account. We hold the minimum required to route a packet to your device and to apply the free plan's limit, and nothing else.

What we do not collect

What we do hold, and why

A random device identifier. Generated on your device the first time you open the app. It is not derived from your Google or Apple account, your hardware, or any identifier shared with other apps. It exists so a node can recognise the same device returning, and nothing more.

Your device's public key and its tunnel address. Required to route packets to you. Your device generates its own key pair and sends only the public half — the private key never leaves your device, so no server of ours can hold it, disclose it, or have it seized.

A monthly byte total. A single running number, used to apply the free plan's data limit. It is not a history: we do not store when you connected, for how long, or which location you used.

A signed purchase receipt, if you subscribe — Google Play's purchase token on Android, Apple's signed receipt on iOS and macOS. It is used to verify the subscription and nothing else. We never see your card, your payment method, or your store account. Google or Apple is the merchant of record.

What your device keeps, that we never see

The app stores a list of your own sessions on the device — when each started, which location it used, and how many bytes it carried — so you can see your own usage. This list is never transmitted. On Android it is under Settings › Usage, and you can delete it there at any time.

The speed test and the map

The speed test contacts Cloudflare, and only when you tap Start. It measures your connection by downloading and uploading test data from Cloudflare's public speed test service (speed.cloudflare.com), the same one its website uses. While you are connected, that traffic goes through the VPN, so Cloudflare sees the exit node's address, not yours; while you are disconnected, it sees your own. Cloudflare also tells the app which IP address and country it saw, and the app shows that to you. Nothing about the test or its result is sent to us, and the result is kept only in the app's memory. A test moves a few dozen megabytes, which counts toward the free plan's monthly limit. Cloudflare handles the requests under its own privacy policy, as it would for any website you visit.

The map makes no network request. The world map is drawn from data built into the app. No map service is contacted, so nobody learns which part of the world you are looking at.

Both are in the Android app from version 1.0.3.

What we cannot promise

A VPN is not anonymity, and we would rather say so than let you assume it:

• A website you sign in to still knows who you are.
• Content scanned on your device before encryption is outside the tunnel.
• Using Oshi Free-Dom moves trust from your network provider to us. This policy exists so you can judge whether that trade is worth making.

Where your traffic exits

Every exit node is ours — the machine, the configuration, the resolver, the keys. Nothing is resold capacity on somebody else's VPN, which is what much of the market actually is: a familiar name in front of infrastructure they do not run and cannot answer for.

The machines sit in independent data centres across the United States, the United Kingdom, Switzerland and France. Those facilities provide racks, power and a network connection. They receive no user data from us and have no access to it — the only thing they can see is encrypted traffic entering and leaving a server whose keys they do not hold.

Switzerland is a special case, stated because it affects you: Swiss law on provider obligations is under revision and may impose logging duties on VPN operators. The app marks that location accordingly. If those obligations come into force in a way we cannot meet consistently with this policy, we will remove the location rather than quietly change what we do.

Legal basis and your rights (GDPR)

We process the data in "What we do hold" on the basis of performance of a contract (Art. 6(1)(b)) — it is what makes the service function.

You may request access, correction, deletion, portability, or restriction of processing, and you may object to processing. Write to contact@oshi-messenger.com.

Because we hold no identifying information, we can act on a request only if you supply your device identifier, which the app shows in Settings. We cannot find "your" data from an email address, because we never had one.

You may lodge a complaint with the CNIL (France) or your local supervisory authority.

Retention

To have what we hold deleted now rather than waiting, see Delete your data.

• Device identifier, public key, tunnel address: kept while the device is in use, and deleted automatically after 30 days without a connection.
• Monthly byte total: reset each calendar month, never archived.
• No backups of either are retained.

Children

Oshi Free-Dom is not directed at children under 13, and we knowingly collect no data from them. Since we collect no identifying data at all, we cannot determine a user's age.

Permissions on Android, and why each exists

Android additionally asks for your explicit consent, in a system dialog, before any VPN can be established. You grant that to the app, and you can revoke it at any time in Android's settings.

How you would check all this

The claims above are not meant to be taken on trust. These are the mechanisms behind them.

• Each device generates an X25519 key pair locally; only the public key is transmitted. There is no server-side key escrow because there is no server-side private key.
• Every session additionally wraps its WireGuard pre-shared key with ML-KEM-768 (FIPS 203). On Android the client refuses the classical form outright, so there is no downgrade path.
• Resolvers run dnsmasq bound solely to the tunnel interface, with query logging off and the journal set to volatile storage.
• The control-plane agent suppresses its own access log, which would otherwise record client IP addresses.
• Byte accounting reads a kernel counter and stores a single integer. There is no time series to reconstruct.
• Peers idle for 30 days are removed automatically, which deletes the association between a device identifier and a tunnel address.

What the filter does not block, and why

The blocklist is a third-party feed (StevenBlack's unified hosts file), so what it covers is not our editorial choice. What we override is — and an override that weakens the product's own promise should be stated rather than discovered.

One domain is deliberately allowed through: googletagmanager.com. It is a script loader as much as a tracker. Sites route consent banners, checkout steps and form handlers through it, so blocking it leaves banners that will not dismiss and checkouts that stop halfway.

This is a real trade and worth being plain about: allowing it lets a Google script run on pages that ask for it. The analytics endpoints it commonly reports to — google-analytics.com, app-measurement.com, doubleclick.net, googleadservices.com — remain blocked, so the measurement it tries to send still has nowhere to go.

Deliberately left blocked, because blocking them is inconvenient rather than breaking: app-measurement.com (Firebase Analytics), crashlytics.com, and mixpanel / appsflyer / adjust. No domain required for a device to function is filtered.

Changes

Material changes will be announced in the app before they take effect. The date at the top always reflects the current version.

Contact

Data controller: Oshi Lab, operated by Hugo Moriceau as an individual. Questions about privacy or your subscription: contact@oshi-messenger.com