Privacy Policy

1. Who we are

This policy is published by Piko (“we”, “us”), the developer of the Piko apps and the operator of pikonet.io. We are the controller of the personal data that we process ourselves, described in sections 8 and 10 to 12.

• Privacy contact: privacy@pikonet.io
• Support: support@pikonet.io

2. What Piko is

Piko is an app that connects your device to VPN or proxy servers that you add, usually with a subscription link from a VPN provider. We run no VPN servers, sell no VPN service and have no user accounts. Your provider runs the servers and is responsible for its service; its own privacy policy applies to it.

3. What we never receive

The app sends nothing to us. In particular, we never receive:

• your internet traffic, the websites you visit or your DNS queries;
• your subscription links, server settings or passwords;
• the device ID that the app sends to your provider;
• your IP address or your location from the app;
• payment details (Piko has no payments).

The app contains no analytics, advertising or crash-reporting code and no third-party tracking. We do not track you across apps or websites.

4. What your VPN provider receives

When the app downloads or updates a subscription, it sends a request to the address you added, which is your provider's server. With every such request the app sends:

• a device ID made for that provider only. It is a SHA‑256 hash of a secret kept on your device and the provider's domain name, so two providers see two different IDs. On Android the secret is the Android ID that the system gives the app, or a random value if the Android ID is unavailable; on iOS it is a random value stored in the Keychain on this device;
• your device model and operating system with its version (for example “Pixel 9” and “Android 16”);
• the app's name and version (for example Piko/0.1.0/Android/36);
• your IP address, as with any internet connection (or the VPN server's address, if the request goes through an active VPN connection).

Providers use this to apply their limit on the number of devices per subscription. In the current version of the app you cannot switch this off. The ID stays the same when you reinstall the app. On Android it changes after a factory reset; on iOS the Keychain value survives deleting the app and changes only when the device is erased. You can copy the ID of each subscription in the app.

The same details are also sent to backup addresses that your provider names for its subscription (the fallback-url, new-url and new-domain headers). If you accept an unencrypted http:// subscription link after the app's warning, the request, including these details, travels unencrypted.

Your provider decides what it does with this information, under its own privacy policy. To have it deleted, contact your provider.

5. Your internet traffic

While you are connected, your traffic goes to the server you chose, which your provider runs. Your provider's server sees your IP address and when and how much you connect. Whether the connection to that server is encrypted depends on the server's protocol and settings, which your provider controls. Piko does not log your traffic: the logging of visited addresses in the VPN engine is switched off. We cannot see what happens on your provider's servers.

6. Services the app contacts

To work, the app also contacts a few other services, most of them through the VPN server. Like any server, they receive the request and the IP address it comes from.

The country used to choose the DNS for server names comes from your SIM card or mobile network (Android) or your region setting (iOS). It is used only on your device and never sent.

These services handle data under their own policies: Google, Cloudflare and its 1.1.1.1 resolver, Quad9, AdGuard DNS, Yandex and GitHub. ipify states that it logs no visitor information.

7. Data stored on your device

The app keeps on your device: your subscriptions and their links, server settings (which contain access credentials from your provider), your settings (including the apps you chose for split tunneling on Android), latency results (deleted after 24 hours), a short local log of app exits and crashes (at most 20 entries per app process) and small state files.

• None of it is sent to us.
• It is excluded from Android cloud backup and device-to-device transfer, and from iOS backups.
• You can delete it by deleting a subscription or a server, by clearing the app's data or by uninstalling the app. On iOS, the device secret used for the device ID stays in the Keychain after you delete the app.

8. Diagnostics

For troubleshooting, the app keeps a list of recent events in memory and the local exit log on your device. Keys, IDs, IP addresses and links are removed from it; the host names of web addresses can remain in some lines. The diagnostics report leaves your device only if you tap Share diagnostics and choose where to send it. It also contains your device model and system version. If you send it to us, we use it only to answer you and delete it within 30 days.

9. Permissions and device features

• VPN: to route your traffic through the server you choose. You allow it once in the system dialog.
• Camera: only to scan QR codes, only while you scan. Nothing is recorded or sent.
• Pictures and files: only the image or file you pick, to read a QR code or a configuration from it.
• Notifications: connection status, problems and, on Android, reminders before your subscription expires. Reminders are calculated on your device.
• Installed apps (Android): read on your device only, so you can choose apps for split tunneling. The list is never sent; only your choice is stored on the device.
• Clipboard: read only when you tap Paste; written only when you copy something.
• Network state: to follow network changes and reconnect.

10. This website

pikonet.io sets no cookies, uses no analytics and loads nothing from other websites. To deliver the pages, our hosting provider Hetzner (Germany) and our network provider Cloudflare (USA) process your IP address, the page you request and your browser's details. Our own server keeps no access logs. Its technical log (errors and certificates) contains no visitors' IP addresses and is deleted after at most 7 days. The same applies to pikovpn.net, which serves files and link pages for the app.

11. Email and support

If you write to us, we use your address, your message and any attachments only to answer you. We keep the conversation for up to 24 months after the last message, and diagnostics files for up to 30 days. Our email provider processes these messages on our behalf.

12. App stores

When you download Piko from Google Play or the App Store, Google or Apple processes data under their own privacy policies. They may give us aggregated statistics, such as the number of installs, and crash reports from users who chose to share them with developers. We use these only to improve Piko. For app review we run a test VPN server that only Apple's and Google's reviewers use; it keeps no traffic logs, and its error log is deleted after at most 7 days. Its subscription address receives the device details described in section 4 from the reviewers' devices and stores none of them.

13. No selling, use or disclosure

We do not sell, use or disclose to third parties, for any purpose, any data about your use of the VPN or any data from the app. We never receive data from the app, so we have nothing to sell or share. The only personal data we handle is what you send us (sections 8 and 11) and what the website and the app stores give us (sections 10 and 12), and we use it only as described there. The app itself sends data only as described in sections 4 to 6, to do what you asked it to do: to the provider whose subscription you added, and to the services needed for the connection to work.

14. Legal bases

Where data protection laws such as the GDPR apply, we process the small amount of personal data described in sections 10 to 12 on the basis of our legitimate interest in running and protecting the website and the apps and in answering messages (Article 6(1)(f) GDPR). When you ask us for help with the app, we also process your message to respond to your request (Article 6(1)(b) GDPR).

15. International transfers

Hetzner hosts the website in Germany. Cloudflare and our email provider may process data in other countries, including the United States, under standard contractual clauses or other safeguards required by law.

16. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to its processing, to receive it in a portable form and to complain to a data protection authority. We hold no app data about you: to remove data from your device, delete the subscription or uninstall the app. For data your provider received, contact your provider. For anything else, write to privacy@pikonet.io. We answer within one month. We make no automated decisions about you and do no profiling.

17. How we protect data

• On your device, the app keeps its data in its own private storage, which other apps cannot read, and excludes it from backups. On iOS the device secret is kept only in this device's Keychain.
• Subscriptions are downloaded over HTTPS. Before it uses an unencrypted http:// link, the app warns you.
• Before you can share a diagnostics report, keys, IDs, IP addresses and links are removed from it. The app never shows the address inside an encrypted piko:// link.
• Messages you send us are kept in a mailbox protected by two-step sign-in, which only the people who answer support can open.
• Our servers accept administrator logins only with keys, are protected by a firewall, install security updates automatically and keep no access logs.

18. Children

Piko is not directed at children, and we do not knowingly collect data from children.

19. Changes

If we change this policy, we will publish the new version on this page with a new effective date. Earlier versions are available on request.

20. Language

This policy is published in several languages. The English version is the authoritative one.

21. Contact