Is Urban VPN safe? Logging policy, audits and jurisdiction
Privacy and jurisdiction 0.0/10 and security 4.3/10 (segment medians 2.7 and 1.2). Red flag: Public security incident. Independent no-logs audit: ✕ No.
In 10 seconds
- Kill switch
- Stores session times
- Public incident on record
- Jurisdiction in 5 Eyes
Privacy
- Jurisdiction
- USA, 5 Eyes
- Legal entity
- Urban Cyber Security Inc. (reg. 10158667)
- No-logs policy
- No
- Data retention
- IPs hashed daily; browsing/e-commerce data aggregated within 90 days; Panelist ID links <=90 days; account data for account life
- Shared with third parties
- Yes browsing-derived marketing insights/behavior segments sold to ad/analytics/brand clients; raw data to affiliates/parent (data broker); AI prompts collected
- Known incidents
- Dec 2025: Urban VPN Proxy extension reported harvesting users AI chatbot conversations (The Register, Infosecurity, CSO)
What the privacy policy says is collected
Red ✕: collected. Green ✓: not collected. Grey: the policy does not say.
- Email✕ Yes
- IP at sign-up✕ Yes
- Connection IP✕ Yes
- Session times✕ Yes
- BandwidthNot stated
- Device info✕ Yes
- App analytics✕ Yes
- Crash reports✕ Yes
Security
- Kill switch
- Yes (yes (manual toggle))
- DNS leak protection
- Yes (yes (DNS/IPv6 leak protection))
- Encryption
- AES-256
- Security audits
- none
- Open-source apps
- No
- Two-factor sign-in
- Not stated
Urban VPN is a poor fit for privacy protection, and the reason is written in its own privacy policy. The free plan is funded by data about the sites people visit. The policy calls the parent company a data broker: it sells behavioral segments to advertising and analytics clients, while raw data goes to affiliated companies. The collected data includes visited addresses and AI chatbot prompts with their responses.
The extension incident
In December 2025, The Register, Infosecurity and CSO reported that the Urban VPN Proxy extension was collecting users' conversations with AI chatbots. The service has no independent audits of its logs or security, and no transparency report or warrant canary either.
What is stored and where
There is no no-logs policy. IP addresses are hashed once a day, and browsing data is aggregated within 90 days. Session times and durations, device IDs, telemetry and crash reports are collected. Urban Cyber Security Inc. is registered in Delaware, the US is in the Five Eyes alliance, and the policy says data is disclosed to authorities as permitted or required by law. Our privacy score: 0 out of 10. If you need a service with verified no-logs, check the audited no-logs VPNs.
Connection protection
The technical side looks better: AES-256, OpenVPN, a manually enabled kill switch, and DNS and IPv6 leak protection. WireGuard and Double VPN are available only in Premium. The apps are not open source, and the service does not say whether it offers two-factor sign-in. Security score: 4.3 out of 10.
Can you use it without an account?
The free extensions and the Windows and Android apps work without registration, but the browsing data collection described in the policy still applies. Premium requires an email address or sign-in via Google or Apple.