Privacy Policy

Oshi Free-Dom VPN (app.diopta.vpn) · Last updated 11 September 2026

Which app is this? Oshi Free-Dom VPN and OSHI Mesh messenger are two different apps. This page is the privacy policy of the VPN. The messenger has its own, separate policy at oshi-messenger.com/privacy. What the VPN is, and how it differs from the messenger, is described on the Oshi Free-Dom VPN reference page.

Oshi Free-Dom is operated by Hugo Moriceau. Contact: contact@oshi-messenger.com.

This policy describes what the app and the VPN service behind it handle. It is written to be checkable: every statement below corresponds to something in the running system, and the technical notes at the end explain how.

We do not sell, use, or disclose to third parties any user data for any purpose.
We do not log your browsing. We do not know your name. There is no account. We hold the minimum required to route a packet to your device and to apply the free plan's limit, and nothing else.

1. What we do not collect

Browsing history	Our DNS resolvers answer queries and keep no query log. Logging is disabled at the resolver, and the systemd journal is configured not to persist.
Traffic contents	Your traffic is encrypted between your device and the exit node using WireGuard (ChaCha20-Poly1305). We cannot read it.
Identity	No name, email, phone number or account. The app has no sign-up.
Location	The app never requests a location permission. It reads your device's country setting only, to comply with regional law.
Advertising or analytics identifiers	The app contains no analytics, advertising or attribution SDKs. None.

2. What we do hold, and why

A random device identifier. Generated on your device the first time you open the app. It is not derived from your Google account, your hardware, or any identifier shared with other apps. It exists so a node can recognise the same device returning, and nothing more.

Your device's public key and its tunnel address. Required to route packets to you. Your device generates its own key pair and sends only the public half — the private key never leaves your device, so no server of ours can hold it, disclose it, or have it seized.

A monthly byte total. A single running number, used to apply the free plan's data limit. It is not a history: we do not store when you connected, for how long, or which location you used.

Google Play's purchase token, if you subscribe. It is sent to our server so the subscription can be verified with Google, and it is not a payment detail: we never see your card, your payment method, or your Google account. Google is the merchant of record.

2b. What your phone keeps, that we never see

The app stores a list of your own sessions on the device — when each started, which location it used, and how many bytes it carried — so you can see your own usage. This list is never transmitted. It is visible under Settings › Usage and can be deleted there at any time.

We mention it because a VPN that shows you a usage history is exactly the sort of thing that usually means a server is keeping one. Ours is not: the node holds a single running byte total for the free plan's limit and no record of when or where you connected. The history is yours, on your phone, and it is the only record of that kind that exists.

3. What we cannot promise

A VPN is not anonymity, and we would rather say so than let you assume it:

A website you sign in to still knows who you are.
Content scanned on your device before encryption is outside the tunnel.
Using Oshi Free-Dom moves trust from your network provider to us. This policy exists so you can judge whether that trade is worth making.

4. Where your traffic exits

Every exit node is ours — the machine, the configuration, the resolver, the keys. Nothing is resold capacity on somebody else's VPN. The machines sit in independent data centres across the United States, the United Kingdom, Switzerland and France; those facilities provide racks, power and a network connection, receive no user data from us, and have no access to it.

Switzerland is a special case, stated because it affects you: the revision of Swiss law on provider obligations (BÜPF / VÜPF) would impose IP logging for six months, user identification and decryption assistance on VPN operators above a low user threshold. It is not in force — the revision was paused after opposition and a second consultation is expected — but the app marks that location accordingly, on Android and on Apple platforms, and prints the reason when you select it. If those obligations come into force in a way we cannot meet consistently with this policy, we will remove the location rather than quietly change what we do.

France is the case that is live today, and we would rather you read it here than discover it. Décret n° 2025-980 of 15 October 2025, in force since 21 October 2025, issues a one-year injunction to retain traffic and location data, addressed to electronic communications operators and to the providers named in article 6 of the LCEN. Whether it binds an independent VPN operator of this size is not settled, and we will not claim otherwise in either direction. What we can tell you is what the machines do: they hold what section 2 lists and nothing else, and no DNS query log exists on them to produce. An order can require that records start being kept; it cannot produce records that were never made. If that lands on us in a way this policy cannot survive, we will remove the affected locations and say so.

The United Kingdom imposes retention only when a notice is served under the Investigatory Powers Act 2016, and such notices are confidential — which is why no operator, us included, can prove to you that none exists. The United States has no general retention mandate; its exposure is compelled disclosure of whatever happens to exist, which is an argument for holding little rather than for trusting a jurisdiction. A fuller account, with each instrument named, is on the VPN reference page.

5. Legal basis and your rights (GDPR)

We process the data in §2 on the basis of performance of a contract (Art. 6(1)(b)) — it is what makes the service function.

You may request access, correction, deletion, portability, or restriction of processing, and you may object to processing. Write to contact@oshi-messenger.com.

Because we hold no identifying information, we can act on a request only if you supply your device identifier, which the app shows in Settings. We cannot find "your" data from an email address, because we never had one.

You may lodge a complaint with the CNIL (France) or your local supervisory authority.

6. Retention

Device identifier, public key, tunnel address: kept while the device is in use, and deleted automatically after 30 days without a connection.
Monthly byte total: reset each calendar month, never archived.
No backups of either are retained.

7. Children

Oshi Free-Dom is not directed at children under 13, and we knowingly collect no data from them. Since we collect no identifying data at all, we cannot determine a user's age.

8. Permissions this app requests, and why

`INTERNET`	To reach the exit node.
`ACCESS_NETWORK_STATE`	To notice when you move between Wi-Fi and mobile data, so the tunnel can be put back.
`FOREGROUND_SERVICE`, `FOREGROUND_SERVICE_SPECIAL_USE`	A VPN must run as a foreground service on Android, with a persistent notification, so it is always visible that it is on.
`POST_NOTIFICATIONS`	To show that notification and to tell you if the tunnel drops.
`RECEIVE_BOOT_COMPLETED`	To restore the tunnel after a restart, if you have asked it to reconnect automatically.

Android additionally asks for your explicit consent, in a system dialog, before any VPN can be established. That consent is granted to the app by you, and can be revoked at any time in Android's settings.

9. Changes

Material changes will be announced in the app before they take effect. The "last updated" date above always reflects the current version.

Technical notes

For readers who want to verify rather than trust:

Each device generates an X25519 key pair locally; only the public key is transmitted. There is no server-side key escrow because there is no server-side private key.
Every session additionally wraps its WireGuard pre-shared key with ML-KEM-768 (FIPS 203). On Android the client refuses the classical form outright, so there is no downgrade path.
Resolvers run dnsmasq bound solely to the tunnel interface, with query logging off and the journal set to volatile storage.
The control-plane agent suppresses its own access log, which would otherwise record client IP addresses.
Byte accounting reads a kernel counter and stores a single integer. There is no time series to reconstruct.
Peers idle for 30 days are removed automatically, which deletes the association between a device identifier and a tunnel address.

What the filter does not block, and why

The blocklist is a third-party feed (StevenBlack's unified hosts file), so what it covers is not our editorial choice. What we override is, and an override that weakens the product's own promise should be stated rather than discovered.

One domain is deliberately allowed through: googletagmanager.com. It is a script loader as much as a tracker — sites route consent banners, checkout steps and form handlers through it, so blocking it leaves banners that will not dismiss and checkouts that stop halfway. This is a real trade and worth being plain about: allowing it lets a Google script run on pages that ask for it. The analytics endpoints it commonly reports to — google-analytics.com, app-measurement.com, doubleclick.net, googleadservices.com — remain blocked, so the measurement it tries to send still has nowhere to go.

Deliberately left blocked, because blocking them is inconvenient rather than breaking: app-measurement.com (Firebase Analytics), crashlytics.com, and mixpanel / appsflyer / adjust.

No domain required for the device to function is filtered — Android's connectivity checks, certificate revocation endpoints, Google push, and the common CDN and font hosts were all checked against a public resolver.