Is UFO VPN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 4.3/10 and security 2.5/10 (segment medians 2.7 and 1.2). No red flag in our data. Independent no-logs audit: ✕ No.
In 10 seconds
- Kill switch
Privacy
- Jurisdiction
- Hong Kong, outside 5/9/14 Eyes
- Legal entity
- Dreamfii HK Limited (reg. 75363257)
- No-logs policy
- Yes
- Data retention
- as long as needed
- Shared with third parties
- trusted service providers/partners for services, storage, analytics; no sale/rent
- Trackers on the website
- Google Analytics; pixels; cookies
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-upNot stated
- Connection IP✓ No
- Session times✓ No
- BandwidthNot stated
- Device infoNot stated
- App analyticsNot stated
- Crash reportsNot stated
Security
- Kill switch
- Yes
- DNS leak protection
- Not stated
- Encryption
- AES-256 (claim)
- Security audits
- No
- Two-factor sign-in
- Not stated
On privacy and security, UFO VPN scores above the median for free mobile VPNs, but almost everything rests on the service's own word. There are no red flags in our data, and no verified proof either.
What the policy promises
The company is registered in Hong Kong, outside the "eyes" alliances. A no-logs policy is declared: the service says it does not store the connection IP address or session times. There is no independent audit, no transparency report and no warrant canary, so there is nothing to verify these promises with. The same policy states that data is kept for as long as needed, passed to contractors for storage and analytics, and may be disclosed upon a lawful request. The service says it does not sell or rent that data. The policy is dated September 2018 and does not list third-party libraries in the apps, even though the website itself runs Google Analytics, pixels and cookies. Services with this kind of verification are collected in our roundup of VPNs with an audited no-logs policy.
Proprietary protocols
The main weakness is technical. WireGuard and OpenVPN are not listed in the apps; instead there are proprietary protocols A, B, C and D. The service claims AES-256 encryption, but there have been no security audits, and it does not say whether the app code is open, so the design of these protocols cannot be checked from the outside. A kill switch is available. The service does not say whether it protects against DNS leaks or offers two-factor sign-in.
Who it suits
For getting past school or work firewalls and unblocking video calls in the Middle East, which is what the service promotes its protocols for, this may be enough. For payment details and work correspondence, it is better to pick a service from our roundup of secure VPNs. A premium account requires an email address; anonymous sign-up is not available.