Vox VPN Browser Extension — Privacy Policy

Last updated: October 10, 2026

This policy describes how VoxAI OÜ ("we", "us") collects, uses, stores and shares data through the Vox VPN browser extension for Chrome and Chromium-based browsers (the "Extension"). It covers the Extension only; our mobile and desktop apps and the vox-vpn.com website are covered by our general Privacy Policy.

In short: the Extension sends your browser traffic through an encrypted proxy server that you choose, so websites see the server's IP address instead of yours. We do not record the pages you visit, we do not read or change website content, we do not show ads, and we do not sell any data.

1. Data we collect

• Random device identifier. When the Extension is installed it generates a random identifier (not derived from your hardware or browser). It is used to issue your proxy session, apply free-plan limits and link the Extension to your account.
• Account information (optional). If you sign in, your email address and password are sent to our server over HTTPS to verify your account. We store your email address and a one-way hash of your password, never the password itself. If you link the Extension with a 6-digit link code instead, only the code is sent. You can use the free server without an account.
• IP address and approximate country. When you connect, our API receives your IP address (as with any internet request). We record it with the connection session and derive your approximate country from it to apply free-plan rules and to prevent abuse.
• Connection session records. For each connection we store: device identifier, chosen server, plan (free or premium), your IP address, start time and expiry time.
• Usage events. The Extension sends a small number of usage events linked to the random device identifier: install, update, a once-a-day "active" signal, popup opened, sign-in, link code used, connect (server and plan), failed connection (server and error code), disconnect (server, reason and duration in minutes) and the WebRTC protection setting. Each event also includes the Extension version, browser language, browser name and version (for example Chrome 141) and operating system (for example Windows). We use them to measure reliability and improve the product.
• Uninstall feedback (optional). When you remove the Extension, your browser opens a page on vox-vpn.com that records that the Extension was removed (with the random device identifier and Extension version). On that page you can choose to tell us why and add a short note. Leaving the page without answering sends nothing more.
• Support messages. If you contact support, we receive whatever you choose to send.

2. Data we do NOT collect

• We do not collect or store your browsing history, the URLs or pages you visit, page content, form data, cookies, search queries, or anything you type on websites.
• The Extension does not read, inject into, modify or block web pages. Its <all_urls> host permission is used only to answer the login challenge of our own proxy servers.
• Traffic through the proxy is encrypted with TLS between your browser and our server. For HTTPS websites, which are most websites, the proxy only sees the destination hostname and port needed to open the connection, not the content.
• We do not collect payment or financial data in the Extension (there are no purchases in the Extension), health data, personal communications, or location beyond the approximate country derived from your IP address.

3. How the proxy servers handle your traffic

The proxy servers forward your connections and do not keep a record of the websites you visit. To find technical problems, a server writes a short diagnostic line to its local system log only when a connection fails or takes longer than 2 seconds to open. That line contains the destination hostname and port and the time taken, with no device identifier or account information. These system logs stay on the server, are rotated automatically and are not uploaded to any other system.

4. Data stored in your browser

The Extension stores the following locally with the browser's storage API: the device identifier, connection state, selected server, short-lived proxy session credentials, your account email and premium status if you signed in, the latest exit IP address, your WebRTC protection setting and the date the daily "active" signal was last sent. These stay on your device and are deleted when you remove the Extension. Signing out deletes the account details.

5. How we use data

We use the data above only to: (a) provide the proxy connection and keep it signed in, (b) check your Premium subscription and apply free-plan time and speed limits, (c) prevent abuse and protect our servers, (d) keep the service reliable and improve it, and (e) answer support requests. We do not use any data for advertising, profiling, creditworthiness or lending, and we do not track you across websites.

6. Sharing and third parties

We do not sell, rent or trade user data. Data is shared only with these parties, only as needed to run the service:

• Hosting providers: OVHcloud (API, database and the free Germany server) and Amazon Web Services / Amazon Lightsail (premium proxy servers). They host our servers and process data only on our behalf.
• ipify (api.ipify.org): after you connect, the Extension calls this public service to show your new IP address. The request goes through the proxy, so ipify sees the server's IP address, not yours. No identifiers are sent.
• Websites you visit see the proxy server's IP address instead of yours, as with any VPN or proxy.
• Authorities, only when the law requires it and limited to the data described in this policy, which does not include browsing history.

If our business changes ownership, this data may transfer under the same protections described here.

7. Storage, security and retention

• Server-side data is stored in our database on servers in the European Union (OVHcloud, France). Proxy servers are located in the countries listed in the Extension.
• All communication between the Extension and our servers is encrypted (HTTPS/TLS). Proxy credentials expire automatically (free: when the session ends; premium: within 12 hours) and are renewed in the background. Access to our systems is limited to authorized staff.
• Account data is kept until you delete your account. Usage events are deleted automatically after 60 days. Connection session records and the device record (browser, operating system, approximate country, install and uninstall dates) are kept while needed for the purposes above (abuse prevention and service statistics) and are deleted when you delete your account or ask us to delete your device's data. Billing records connected to a subscription are kept as long as the law requires.

8. Your choices and rights

• You can use the free server without an account, sign out at any time, and turn WebRTC protection on or off in the Extension.
• Removing the Extension deletes all data stored in your browser.
• Depending on where you live (for example, under the GDPR), you can ask to access, correct, export or delete your data. Use vox-vpn.com/delete_account.php or email support@vox-vpn.com. We reply within 30 days. You can also complain to your local data protection authority.

9. Permissions explained

• proxy: sends browser traffic through the server you pick, and turns this off when you disconnect.
• webRequest, webRequestAuthProvider: answer the login challenge from our own proxy servers. No requests are read, changed or blocked.
• privacy: stops WebRTC from revealing your real IP address while you are connected. Your original setting is restored when you disconnect.
• storage, alarms: save your settings, end free sessions on time and renew premium credentials.

10. Children

The Extension is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect data from children.

11. Changes

If we change this policy, we will update the date above. If we make material changes, we will announce them on this page and in the Extension's listing.

Contact