Privacy Policy

Last updated: 30 October 2026 · Tap VPN browser extension for Google Chrome

No browsing logs. Tap VPN does not record the websites you visit, your traffic or your DNS lookups, and we do not store your IP address. The free VPN works without an account: we only have your name and email if you choose to sign in with Google or buy VIP. We never sell your data or use it for advertising.

For the free daily limit we keep a one-way hash of your IP address, not the address itself, for up to 24 hours.

1. Who we are and what Tap VPN does

Tap VPN is made by Orbitex AIO ("we"). It routes your Chrome browser's web traffic through our proxy servers over an encrypted (TLS) connection, so websites see the server's IP address instead of yours. It only covers Chrome; other apps on your device are not affected.

2. What we do not collect

Browsing activity: the websites, pages or URLs you visit, and your searches.
Traffic content: forms, passwords, cookies or downloads.
DNS lookups.
Your IP address: our servers see it while handling a request, as every server does, but we do not store it. The only exception is the free daily limit: we keep a one-way hash of your IP address (not the address itself) together with the time used, and delete it after 24 hours.
Precise location: no GPS or similar.
Name, email or phone number, unless you choose to sign in with Google or buy VIP (see below).
Full card or bank details: Lemon Squeezy handles payments. It only tells us the card type and its last four digits, never the full card number.

3. What we collect and why

Data	Why	Where it is kept
Random device ID, created on install	Give this device its own proxy login, and let us revoke one device without affecting others.	Our servers
Session token and per-device proxy login	Connect you to our servers.	Your browser and our servers (password encrypted, token stored only as a hash)
Device label such as "Chrome on Windows", and the store the extension was installed from	Show your devices so you can remove one.	Our servers
Country (a two-letter code such as PK), looked up from your IP address with a database on our own server; the IP itself is not stored	Know where our users are and plan server locations.	Our servers
Free daily limit: a one-way hash of your IP address and the connected time counted for it	Apply the free plan's 90-minute daily limit per network, so that reinstalling the extension does not reset it.	Our servers
If you sign in with Google: email address, name and Google account ID	Identify your Tap VPN account and link your devices and purchases.	Our servers
Plan (free, VIP monthly, VIP yearly or VIP lifetime), its end date and your devices	Unlock VIP locations and enforce the device limit.	Our servers
Codes you enter (VIP or device-linking codes)	Activate VIP or add a device to your account.	Our servers
If you buy VIP: your email and the name on the order, plan, subscription status and dates; for each payment or one-time lifetime purchase its amount, currency, tax, any refund, the card type and its last four digits, and a link to the invoice (all from Lemon Squeezy)	Billing, receipts, refunds and support.	Our servers
Diagnostic events: install and update; connect, disconnect, connection verified, failed, dropped or recovered (with the VPN location, session length or error type); speed test (VPN location, rounded Mbps); connect or disconnect from the keyboard shortcut, right-click menu or auto-connect; plan changed; checkout opened (plan, and email if signed in with Google); code applied; Google sign-in or sign-out (email); daily free limit reached; proxy conflicts and rejected proxy logins; extension version	Find broken servers and fix connection problems.	Our servers, linked to the random device ID
Account history: account created, codes applied, Google sign-in, checkout opened, subscription and purchase changes, devices added or removed, and changes made by our support staff	Support, billing questions and abuse prevention.	Our servers
Background check about once a minute while connected, sending only your session token	Apply plan changes, announcements and server updates quickly.	Our servers
If you uninstall and choose to answer: your reason and comment, device ID, version and whether your last connection worked	Learn what went wrong.	Our servers

Kept only in your browser and never sent to us: your settings (location, favourites, kill switch, WebRTC protection, ad blocking, time-zone matching, auto-connect, notifications, right-click menu and theme), site rules, recent locations, server ping times, your speed test history, your connection activity history (the Activity screen: when and where you were connected, kept for your last 100 sessions), and your daily free-plan usage. If you signed in with Google, the usage counter is also saved in your browser's sync storage so it follows your Chrome profile; we don't receive it. "Export settings" saves a file to your own computer; nothing is uploaded.

When you connect, the extension asks our endpoint vpn-ip.orbitexaio.com for your IP address through the Tap VPN server, so it only ever sees the server's IP.

4. Our website

Our website (tapvpn.orbitexaio.com) uses no advertising or analytics trackers, sets no cookies and loads no third-party fonts. If you choose a light or dark theme, that choice is kept in your browser's local storage. The VIP buttons take you to Lemon Squeezy's checkout, which runs under Lemon Squeezy's own privacy policy.

5. Google sign-in (Limited Use)

Signing in with Google is optional. We request only the openid, profile and email scopes, and use the result (your email address, name and Google account ID) only to identify your Tap VPN account and link your devices and purchases to it. We do not access any other Google data.

Tap VPN's use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell this data, use or transfer it for advertising, use it to determine creditworthiness or for lending, or let people read it except for support you ask for, security, or to comply with the law.

6. How we use and share data

We use the data above only to run, secure, support and improve Tap VPN. We do not sell it and do not use it for advertising or profiling. We share it only with:

Lemon Squeezy, our merchant of record, when you buy VIP. It collects your email, payment details and billing country (for tax) under its own privacy policy.
Our hosting providers (Contabo in the EU, Oracle Cloud in the US), which run our servers and do not use the data for their own purposes.
Cloudflare, which sits in front of our website and API to protect them and deliver them quickly. It handles your IP address to pass your requests on, under its privacy policy. Your VPN traffic does not go through Cloudflare.
Authorities, only when required by law.

7. Ad & tracker blocking and time-zone matching

When you turn ad blocking on, it runs entirely inside your browser with built-in content blocking rules and fixed lists shipped with the extension (EasyList and EasyPrivacy). Nothing about the pages you visit or what was blocked is sent to us.

When you turn time-zone matching on, a small script makes pages read the time zone of your VPN location. It doesn't read or send anything.

8. Our proxy servers

Our servers carry your connections to the sites you visit. They do not log the sites you visit or your traffic. For abuse prevention and capacity planning they may keep aggregate counters, such as connections or bytes per device per day, for up to 90 days.

9. How long we keep data

Account data (devices, plan, country, Google sign-in details, email): while your account exists.
Diagnostic events: 90 days.
Free daily limit counter (hash of your IP address and time used): 24 hours.
Account history and uninstall feedback: 365 days.
Payment records: as long as tax and accounting law requires us to keep them.
Server backups: overwritten on a rolling basis (currently the last 14 copies).

10. Your choices and deleting your data

Use the free VPN without signing in: we then have no name or email for you.
Sign out of Google in the extension (Account) to unlink that browser from your account.
Clear your local Activity history any time from Settings → Activity → Clear history.
Email [email protected] to see, correct or delete your data. We delete your account, devices, email and history within 30 days, except payment records we must keep for tax or legal reasons (Lemon Squeezy also keeps its own).
Uninstalling the extension stops all data collection from that browser.

11. Security

Connections to our API and proxy servers use TLS. Each device has its own proxy login; proxy passwords are stored encrypted and session tokens only as hashes. Access to our admin tools is restricted and every admin change is recorded.

12. Permissions the extension uses

proxy: set Chrome's proxy to Tap VPN servers while you are connected.
webRequest, webRequestAuthProvider: supply your proxy login to Tap VPN servers only, and notice when a page fails to load because a server is down.
storage: keep your settings, history and session on this device.
alarms: refresh the server list and re-check the connection periodically.
identity: optional Google sign-in.
contextMenus: the optional right-click menu ("Connect / Disconnect Tap VPN" and "Skip VPN on this site"). You can turn it off in Settings.
notifications: the optional alert when your connection drops. It is off until you turn it on.
Access to all sites: required by Chrome for the proxy login above.
privacy (optional, asked when you turn it on): WebRTC leak protection.
declarativeNetRequestWithHostAccess: ad & tracker blocking, only when you turn it on.
scripting: the time-zone script, only when you turn time-zone matching on.

13. Children, changes and contact

Tap VPN is not directed at children under 13, and we do not knowingly collect their data. When our practices change we'll update this page and its date, and announce significant changes in the extension.

Questions or data requests: [email protected] (Orbitex AIO).