Our no-logs policy
Zori VPN is operated by KYTTARA, LLC, listed on Google Play as Kyttara. This policy covers the Android app, VPN service, website and support communications.
Our VPN servers do not retain browsing history, traffic contents, DNS queries or server-side connection logs, including source and destination IP addresses and connection timestamps. Network destinations and traffic are processed to forward your connection, not stored as a record of your VPN activity.
The connection API keeps anonymous aggregate reliability statistics. Separately, the app sends usage and diagnostic events to Firebase. The no-logs commitment concerns VPN server activity logs; it does not mean that the app or its service providers process no data.
Data needed to connect
The app sends a device identifier (Android ID, or a generated identifier if unavailable) to the connection API to obtain configuration and authenticate access. Requests also contain technical information such as app and Android versions, package identity and request metadata. These requests are separate from browsing activity.
Firebase configuration requests include an installation identifier and authentication token, app and platform versions, package and certificate information, time zone, and country or language parameters. SDK services also use installation, app-instance and session identifiers. These identifiers are not advertising IDs, but can distinguish installations.
VPN gateways process network addresses and traffic to route your requests. Apps excluded from the VPN use their ordinary network connection. A VPN does not hide information you voluntarily send to websites from those websites.
Aggregate connection statistics
Our backend groups connection duration and connection success rates by country and carrier to assess service reliability. It stores aggregate results only, not a statistics record for each individual connection. These totals are separate from the Firebase events described below.
We do not promise a fixed deletion period for these anonymous aggregate totals. This does not extend the retention of individual VPN activity logs: those logs are not retained.
App analytics and diagnostics
Firebase Analytics records app usage, screen visits, language changes, connection attempts and outcomes, recovery outcomes, and operation or session durations. Crashlytics collects crash, native crash and ANR diagnostics, stack traces, app and device information, and installation and diagnostic session identifiers. Performance Monitoring measures startup, supported rendering metrics and configuration, node retrieval, connection and recovery operations.
Analytics can derive approximate location, such as country or city, from the IP address used to reach Google. Performance data can include country and carrier information. The app does not request GPS or precise-location permission. Device and technical metadata can include model, operating system, app version, language and network characteristics.
Our custom events use predefined categories and timings. We do not attach browsing contents, DNS queries, destination websites, node addresses, authentication tickets, credentials, Android ID, installed-app lists or feedback text to these events. SDK-generated diagnostics are processed separately and may include technical crash details.
Collection is enabled by default in production releases. Version 1.0.0 does not include an in-app switch to turn off analytics, crash reporting or performance monitoring. We use these data to understand usage, measure connection reliability and investigate failures.
Advertising-ID collection and advertising-personalization signals are disabled in the app. Google Signals and sharing Analytics data with Google products and services are disabled. We have not linked the project to Google Ads or BigQuery. Aggregated modeling contributions, technical support and business recommendations remain enabled in the Analytics account; those settings do not mean that all provider processing is disabled.
How long data is retained
Our Google Analytics settings retain event-level data for 2 months and user-level data for 14 months. New activity resets the retention period for the user identifier, so continued use can extend that period. These settings do not limit standard aggregated Analytics reports. See Google Analytics retention guidance.
According to Firebase, Crashlytics begins removing crash data and associated identifiers after 90 days. Performance Monitoring begins removal after 30 days for IP-associated events and 60 days for installation-associated and de-identified data. Removal from live and backup systems is a process, not a promise of immediate deletion on that date. See Firebase privacy and retention information.
Configuration installation identifiers have a separate provider lifecycle; the Analytics event window does not automatically delete them. Provider policies explain these lifecycles. Local settings remain until cleared or the app is uninstalled. We retain support correspondence only as needed to handle the request and related issues or meet applicable legal obligations.
Information stored on your device
Language preferences, app bypass choices, a service identifier, connection configuration and credentials are stored locally. Sensitive configuration is encrypted using Android Keystore-backed storage.
The list of installed launchable apps is accessed locally to display app bypass choices and icons. The app does not upload this list to our servers.
Clearing app data or uninstalling removes local settings and cached credentials. It does not reset Android’s underlying Android ID or delete data already received by Firebase, the connection API or a support provider.
Service providers and the website
We use Google Firebase for configuration, installation services, analytics, crash diagnostics and performance monitoring; Google and Cloudflare services for DNS and connection checks; and Cloudflare Pages to host this website. These providers receive network requests, which can expose an IP address and technical metadata. Their processing follows the applicable service terms and policies.
The website has no advertising, analytics scripts or contact form. Cloudflare may process request and security information to deliver and protect it. Support email is processed by Google Gmail.
Service infrastructure may process data outside your country. We do not sell your personal data or use VPN activity for advertising. Our VPN no-logs commitment does not mean independent infrastructure providers retain no technical data.
Support and data requests
If you email us, we receive your email address and the content and attachments you choose to send. An in-app feedback report may contain your description, app and Android versions, protocol and VPN status. You choose whether and through which app to send it; feedback text is not uploaded silently. Automatic crash reporting is separate.
To request access, correction or deletion of information you have sent to support, contact the address below. We may request enough information to verify the request. No user account is required, so there is no app account to close.
We do not currently offer a workflow for deleting a particular installation’s Firebase analytics and diagnostic records on request. Emailing support or uninstalling the app does not automatically delete those records. You may still contact us about any rights available under applicable law; this limitation does not waive those rights.
Security and changes
Connection API and Firebase requests use HTTPS, and the VPN tunnel encrypts traffic between the device and the VPN endpoint. Traffic outside the tunnel, including bypassed apps and traffic forwarded to a destination website, depends on that connection’s own security. DNS used to establish the tunnel is not covered by a promise that all DNS requests are encrypted.
Sensitive local credentials are protected with encryption. No service can guarantee absolute security. We will update this page and its date when our practices change, and communicate material changes through an appropriate notice.
Contact the operator
KYTTARA, LLC
3225 McLeod Dr Ste 100, Las Vegas 89121-2257, United States
For privacy questions and data requests, email [email protected].
Provider policies
Email us
[email protected]