Privacy Policy

4. Optional VPN Service

4.1 Operation

AIO Studio builds and operates the optional VPN service using Android’s VpnService API and WireGuard, OpenVPN, or Outline technology, depending on the connection method and configuration. Covered traffic is routed through our VPN server using an encrypted connection between the device and the VPN endpoint.

The server processes the originating IP address and necessary routing information while forwarding traffic. Transient processing to deliver traffic is different from retaining logs. Encryption to a VPN endpoint does not itself guarantee encryption between that endpoint and every destination or complete anonymity.

4.2 VPN Records and Android ID

We retain connection-time information and bandwidth usage linked to Android ID. Android ID is used to authenticate and recognize the device, coordinate VPN service, manage plan or bandwidth limits, and support operational statistics, troubleshooting, and abuse prevention. No App account or login is required.

Connection-time and bandwidth logs are deleted after 30 days. Within our VPN authentication system, Android ID is retained while the VPN is used and deleted after 30 days without VPN activity.

This does not automatically delete the RevenueCat App User ID or purchase records, which follow the separate purchase-data handling described in Section 8. These are separate retention rules: deletion of an older session log does not immediately delete an Android ID that remains active.

Our VPN activity logs do not retain originating or destination IP addresses, DNS queries, browsing history, or traffic content. This statement concerns our VPN activity logs and does not mean that the entire App or its independent advertising and analytics components process no information.

4.3 Infrastructure

AIO Studio operates the VPN service on hosted infrastructure. Hosting and network infrastructure providers may process information as necessary to supply their services. We do not publish server addresses, credentials, or security-sensitive infrastructure details in this policy.

4.4 Consent and Control

Before connecting, the App requests Android VPN authorization. Where required, it also presents a separate in-app disclosure describing relevant personal or sensitive data processing and requests affirmative consent before that processing starts. Accepting this policy or buying a subscription does not replace a required separate consent.

You can disconnect using the VPN controls or revoke authorization through Android settings. Disconnecting ends the active connection but does not itself delete retained records. Supported reconnect or background behavior follows the applicable VPN settings.

4.5 Separation from Advertising and Analytics

We do not send VPN traffic, VPN connection-time records, or VPN bandwidth records to advertising or analytics SDKs. We do not provide the Android ID used for VPN authentication to advertising SDKs or Google Analytics through that VPN authentication flow.

Separately, Android ID is supplied to RevenueCat as the App User ID for purchase management, as disclosed in Sections 2, 6, and 8. Advertising and analytics SDKs have their own processing described in Section 6.

5. Permissions and Special Access

The App requests access relevant to its security and network tools:

• All files access (MANAGE_EXTERNAL_STORAGE): access to files for the App’s file scanning, management, cleanup, and protection features when those features are used. File Locker handling is described in Section 2.
• Installed-app visibility (QUERY_ALL_PACKAGES): identification of installed apps for virus scanning and app security analysis. Relevant fields are transmitted to Vincent SDK as explained in Section 3.
• Usage Access: recognition of the app currently in use so that App Lock can display the lock screen for an app you have chosen to protect.
• Approximate location: access only while using the App for the locally processed use described in Section 2. Device coordinates are not supplied to advertising SDKs.
• VPN authorization: permission to establish the optional VPN connection described in Section 4.

You can review or revoke permissions and special access through Android settings. Disabling access may prevent the corresponding feature from working. Revoking access does not automatically delete information already transmitted or retained. VPN authorization is separate from consent for advertising or analytics.

6. Advertising, Firebase, Google Analytics, and Other Providers

We integrate the following components. Advertising providers can receive information such as IP addresses, device and advertising identifiers, app and SDK information, ad impressions, clicks, interactions, diagnostics, and consent signals. Their exact processing depends on the SDK version, configuration, region, and privacy choices. IP addresses may be used to infer approximate location.

6.1 Firebase Services in Use

• Remote Config: delivery of App configuration and feature settings, using installation and App information as needed for configuration requests and targeting.
• Crashlytics: crash reports, stack traces, installation identifiers, and relevant device or App information to diagnose stability problems.
• Cloud Messaging: registration tokens and installation or device information necessary to deliver push notifications.
• Performance Monitoring: App performance traces, network performance measurements, and relevant device or installation information to investigate performance issues.
• Google Analytics: events, App interactions, device or App characteristics, and app-instance identifiers for usage measurement.

These services process information under the applicable service configuration, retention settings, and provider practices linked above. Contact our privacy email for information about the retention settings applicable to your data.

6.2 Advertising Consent

The App integrates Google’s User Messaging Platform (UMP) to present applicable advertising privacy messages and record choices. The current release does not yet provide a dedicated in-app button to reopen the privacy options form. You can contact our privacy email about your choices; this contact route does not replace any in-app privacy options control required by the applicable UMP configuration.

Android advertising-ID controls and providers’ privacy choices may also be available. Declining personalized advertising does not necessarily eliminate processing for non-personalized ads, diagnostics, security, or fraud prevention.

We do not provide device coordinates to advertising SDKs. Providers may infer approximate location from IP addresses. Their policies supplement our disclosures and do not replace our responsibility for the integrated components.

7. Purposes and Disclosure

We use information to deliver the selected security and VPN features, analyze potential threats, validate paid access, provide support, diagnose problems, improve App functionality, and perform the advertising and analytics activities described above.

Information is disclosed to the providers identified in this policy when their services process that information. We may also disclose information where required by law or valid legal process, or where necessary and lawful to investigate fraud, respond to security incidents, or protect rights and safety. A merger or acquisition involving information is subject to applicable legal requirements and appropriate notice.

These descriptions do not authorize unrelated uses or replace a required separate consent. The VPN service’s retained logs and other SDK data are described separately so that the limited VPN logging statement is not mistaken for a claim that the entire App collects no data.

8. Retention and Deletion

Contact our privacy email to request access to or deletion of personal information we hold, subject to applicable law. We may request proportionate verification and explain any lawful retention exception. Uninstalling the App does not automatically delete server or provider records.

The App does not require registration or login, so there is no App account to delete. Rights over personal information can still apply. Data deletion and cancellation of a Google Play subscription are separate actions. Unlock or restore protected files before uninstalling the App to avoid losing the decryption key.

9. International Processing

Information may be processed outside your country through our VPN servers, cloud scanning, advertising, Firebase, Google Analytics, RevenueCat, and their supporting infrastructure. Processing locations depend on the actual servers and providers involved.

International handling is subject to applicable data protection requirements. The providers’ linked policies describe their processing locations and transfer practices. Contact us to request information about recipients, relevant processing countries, and any applicable transfer safeguards for information we control. Merely using the App is not treated as blanket consent to otherwise unlawful transfers.

10. Privacy Rights and Legal Bases

Where a legal basis is required, processing must be supported by the basis applicable to its purpose. Providing a requested paid service may involve contractual necessity; mandatory disclosures may involve legal obligations; optional advertising or analytics may require consent; and legitimate interests may apply only where permitted and after considering your rights. Consent-dependent processing is not authorized merely by publishing this policy.

Depending on applicable law, you may request access, correction, deletion, a copy of information, restriction, or objection to processing. You may withdraw consent without affecting processing lawfully performed before withdrawal and complain to a competent data protection authority. Contact our privacy email to exercise applicable rights. We respond within applicable legal time limits and may request proportionate verification.

11. Security

The VPN encrypts covered traffic between the device and VPN endpoint. File Locker encrypts protected files on the device. Authentication data for App Lock and protected files are not uploaded or backed up to cloud services by the App.

Uninstalling the App removes the File Locker encryption key and may leave encrypted files that can no longer be opened. Restore protected files before uninstalling. No system guarantees absolute security. Contact our privacy email to report a suspected privacy or security issue.

12. Children

The App is intended for users aged 13 and older and is not directed to children under 13. A higher minimum age may apply under local law. If you believe personal information has been collected from a child in circumstances requiring parental authorization without that authorization, contact us so we can investigate and take the steps required by applicable law.

13. Changes to This Policy

We may update this policy when features, providers, data practices, or legal requirements change. We publish the revised policy with an updated effective date and provide additional notice or request fresh consent where required. Continued use does not replace consent when consent is required.

14. Contact Us

For questions or requests concerning this policy or the information handled by Antivirus & Applock:

AIO Studio
Email: allinonestudio.sp@gmail.com