Review how Vylos handles locally stored VPN data, device permissions, managed configuration, and third-party services.

Vylos — Privacy Policy Addendum

Table of Contents

Effective Date: April 10, 2026

This Privacy Policy Addendum ("Addendum") supplements the CBN Ventures Privacy Policy available at cbnventures.io/privacy (the "General Policy"). This Addendum applies specifically to the Vylos application ("App").

Where this Addendum is silent, the General Policy governs.

By downloading, installing, or using Vylos, you agree to both the General Policy and this Addendum.

---

1. Overview

Vylos does not collect, transmit, or store personal information on any server. All data created or imported within the App remains on your device.

The App does not maintain user accounts, communicate with CBN Ventures servers, or include analytics, telemetry, or crash reporting.

Vylos does not operate VPN servers. The App configures your device's built-in VPN capabilities using the WireGuard protocol.

CBN Ventures has no visibility into your VPN traffic, browsing activity, or network connections.

2. Data Stored on Your Device

The following data is stored locally on your device and is never transmitted to CBN Ventures or any third party:

3. Data Not Collected by CBN Ventures

Vylos does not collect any of the following:

• Browsing history or website visits
• DNS queries or resolutions
• VPN traffic content or metadata
• Your public IP address or VPN server address as analytics or telemetry; server endpoints you provide remain in the local tunnel configuration
• Device identifiers, advertising IDs, or hardware fingerprints
• Location data (beyond the momentary WiFi network name used during on-demand rule setup, which is not stored or transmitted)
• Personal information submitted to CBN Ventures, such as names, email addresses, or phone numbers
• Usage analytics, session data, or behavioral patterns

4. Device Permissions

The App may request the following device permissions. Each is used for a single, specific purpose:

Camera — Requested only when you choose to import a tunnel configuration via QR code. The camera feed is used to read the QR code content.

No images or video are captured, stored, or transmitted.

Location — Requested only when you set up an On-Demand activation rule that references a specific Wi-Fi network. The App reads the current Wi-Fi network name (SSID) to assist with configuration.

The network name is not stored beyond the On-Demand rule you create and is never transmitted.

System authentication — When app protection uses Face ID, Touch ID, Optic ID, or the device passcode, the App asks Apple's authentication system to verify your identity. The App receives only a success or failure result.

No biometric data, including fingerprints, facial geometry, or iris scans, is collected, accessed, processed, or stored by the App. All biometric processing is handled by Apple's operating system and supported device security hardware.

Notifications — The App uses local notifications only to inform you of VPN state changes, such as connection failures or network changes. No remote push notification services are used.

Notification content is generated on your device and is not transmitted anywhere.

5. Third-Party Services and SDKs

Vylos uses only Apple-provided system frameworks and the open-source WireGuardKit library (licensed under MIT).

The App does not integrate any third-party analytics, advertising, tracking, or data collection SDKs. The App does not sell, share, rent, or disclose any data to third parties for any purpose.

6. Data Import and Export

You may import VPN configurations into the App using .conf files (WireGuard standard), .vylos files (Vylos format with extended settings), .zip archives containing any combination of these formats, or QR codes.

You may export tunnel configurations as .zip archives and application logs as text files. All import and export operations occur locally on your device.

When you use the system share sheet to send exported data, the destination is determined by your choice. CBN Ventures does not receive or intercept exported data.

7. MDM and Managed Configuration

Organizations that deploy Vylos through Mobile Device Management (MDM) may apply restriction keys to control feature availability within the App. These keys affect whether users can create manual tunnels, access settings, or use the App on jailbroken devices.

An organization may also supply Vylos preference overrides and its company name, email address, phone number, or postal address. These values are delivered by the operating system and displayed locally in the Managed Configuration pane.

MDM configuration is a read-only input to the App. Vylos does not send device status, usage patterns, tunnel details, or other data back to the MDM server or deploying organization.

8. Data Retention and Deletion

Uninstalling Vylos removes its app-container preferences, shared storage files, and cached data. Apple platforms may retain Keychain items after an app is removed, so delete tunnels and reset the TOTP secret inside Vylos before uninstalling when complete local removal is required.

VPN configuration profiles installed by an organization or from a .mobileconfig file are managed separately by the operating system and must be removed through MDM or the device's profile-management settings.

9. Children's Privacy

Vylos does not knowingly collect personal information from children under the age of 13, as defined by the Children's Online Privacy Protection Act (COPPA), or from users under the age of 18, as defined by the New York Child Data Protection Act.

Since the App does not collect personal information from any user regardless of age, no age verification or parental consent mechanism is required. If you believe a child has provided personal information through the App, please contact CBN Ventures using the contact information in the General Policy.

Upon verification, any such information will be promptly deleted.

10. International Users

Vylos is available worldwide through the Apple App Store. Regardless of your location, all data created or imported within the App remains on your device.

No data is transmitted to CBN Ventures or any third party, and no cross-border data transfers occur.

Since the App does not collect, process, or store personal data on any server, the obligations that typically arise under international privacy frameworks — such as the European Union General Data Protection Regulation (GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the Brazilian General Data Protection Law (LGPD), or other applicable data protection laws — are addressed inherently by the App's local-only architecture.

Users in all jurisdictions retain the rights afforded to them under their local privacy laws, including the right to access, delete, and export their data. These rights are exercisable directly on your device through the App's built-in features, as described in Section 13 (Your Rights).

No request to CBN Ventures is necessary because no data is held externally.

If your jurisdiction imposes specific requirements regarding the use of VPN software or encryption technology, you are responsible for ensuring your use of the App complies with those requirements. CBN Ventures makes no representation that the App is lawful to use in all countries or regions.

11. Security

Vylos implements the following security measures to protect your data:

• Keychain encryption — VPN configurations and authentication secrets are stored in the device Keychain, which uses operating-system data protection and may use hardware-backed protections provided by the device.
• TOTP protection level — The TOTP authentication secret is stored with the highest applicable Keychain protection class, accessible only when the device is unlocked and restricted to the originating device.
• WireGuard encryption — All VPN traffic is encrypted using the WireGuard protocol, which employs modern cryptographic primitives including ChaCha20, Poly1305, Curve25519, and BLAKE2s.
• No external transmission — No sensitive data is transmitted to CBN Ventures or any third party. All data processing occurs on your device.

These measures are consistent with the security safeguard requirements of the New York SHIELD Act (General Business Law Section 899-bb), appropriate to the nature and scope of the App as a local-only application with no server-side data processing.

12. Data Breach Notification

In the unlikely event of a security incident that compromises private information of New York residents, CBN Ventures will provide notification in accordance with New York General Business Law Section 899-aa. This includes notification to affected individuals and to the New York Attorney General, the New York Division of State Police, and the Department of State's Division of Consumer Protection, within 30 days of discovery.

13. Your Rights

You have the right to:

• Delete your data — Remove any or all tunnel configurations, bandwidth statistics, application logs, and authentication secrets within the App at any time.
• Export your data — Export tunnel configurations and application logs using the App's built-in export features.
• Remove the App — Delete tunnels and reset app protection first when you want Keychain-backed data removed, then uninstall Vylos to remove its app-container data.

Since Vylos does not store data on any server, there is no server-side data to request access to or deletion of. All data management is performed directly on your device through the App.

14. Changes to This Addendum

CBN Ventures reserves the right to update or modify this Addendum at any time. Changes are effective upon posting.

Your continued use of the App after any changes constitutes acceptance of the revised Addendum. Material changes will be reflected by an updated effective date at the top of this document.