Is DuneVPN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 7.3/10 and security 3.2/10 (segment medians 2.7 and 2.1). No red flag in our data. Independent no-logs audit: ✓ Yes.
In 10 seconds
- Independent no-logs audit: ✓ Yes
- Kill switch
Privacy
- Jurisdiction
- Not stated
- Legal entity
- Soft Apex Technologies (contact page + Google Play developer)
- No-logs policy
- Yes
- Data retention
- limited period unspecified
- Shared with third parties
- Google AdMob (ad ID, approx location); RevenueCat; Google Play Billing; crash/analytics services
- Trackers on the website
- cookies for analytics
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- EmailNot stated
- IP at sign-upNot stated
- Connection IP✓ No
- Session times✓ No
- BandwidthNot stated
- Device info✕ Yes
- App analytics✕ Yes
- Crash reports✕ Yes
Security
- Kill switch
- Yes
- DNS leak protection
- Not stated
- Encryption
- AES-256
- Two-factor sign-in
- Not stated
According to its privacy policy, DuneVPN does not store connection IPs and does not link session times to users, and registration requires no email. The weak points lie elsewhere: the claims are hard to verify, and the free version shares data with an advertising network.
An audit without a named auditor
The site calls its no-logs policy "independently audited" but does not say who performed the audit. In our assessment, the point was credited based on the service's statement. Other services with an audit are listed in our ranking of VPNs with an audited no-logs policy. DuneVPN collects device model, Android version, language, connection statistics and crash reports. The retention period is described as a "limited period" with no number attached.
Ads in the free version
The free plan shows Google AdMob ads, and under the policy AdMob receives the advertising identifier and an approximate location. Data also goes to RevenueCat, Google Play Billing and crash analytics services. Meanwhile, the Google Play listing says the app collects no data. The Pro plan has no ads, so the data sent to AdMob concerns only those who use the service for free.
Who is behind the service
The developer is listed in Google Play and on the contacts page as Soft Apex Technologies, with an address in Abha, Saudi Arabia, in the terms of use. The country is not part of the 5/9/14 Eyes alliances. The service does not name its jurisdiction separately, and for contact, besides support@dunevpn.com, it gives a Gmail address.
Connection protection
There is a kill switch, WireGuard, OpenVPN and AES-256 encryption, and Double VPN is claimed. The service does not say whether it protects against DNS leaks, whether the apps are open source, or whether anyone has tested their security. Hence the low security score of 3.2 out of 10. For comparison, see our ranking of secure VPNs.