Back to Veil
Privacy Policy
The app never asks who you are. This page lists everything the app sends, everything our servers keep, and everything they never see.
1. Who we are
Veil is made by BLACK LAYERS CORP. (blacklayers.ca), an independent software company in Calgary, Alberta, Canada. We are the controller of the information described here. No parent company, no outside data partners, no advertising business. This policy is the full description of how the Veil iOS app and our servers handle information. Apple's standard privacy policies do not govern your use of the VPN. This policy does. Contact: info@blacklayers.ca · BLACK LAYERS CORP. · 5 Mitchell Rd NW, Calgary, AB T3R 2G3, Canada
2. There is no account
The app never asks for an email, a name, a phone number or a password. On first launch it generates a cryptographic key pair on your iPhone or iPad. The public half of that key is your identity to our servers; the private half never leaves your device. Registration proves possession of that key with a challenge; nothing else is asked. Veil+ is sold only in the App Store. Apple takes the payment and does not share your name, email or card with us; we receive only the signed transaction described in section 3. (Until 28 September 2026 we also sold Veil+ on this website; see section 6.)
3. What the app sends
• Your device public key, the platform (iOS) and the app version. • Your plan (free or Veil+), as a signed App Store transaction that we verify. • The location you choose to connect to, and your Shield settings (which of trackers, ads and malware to block). • A two-letter country hint, worked out from your device's time zone, used once to suggest a nearby server and never stored. That is the complete list. The three daily Shield counts (tracker, ad and malware domains stopped) travel the other way: the server makes them and the app receives them. The app contains no analytics, advertising or crash-reporting SDKs of any kind.
4. What our servers keep
Durably, in one record per device: your public key, the platform, the app version, a one-way hash of the device's sign-in token (never the token itself), the date the key was first registered, and your plan (a tier, an expiry date, and Apple's original transaction identifier). This is stored on Google Cloud Firestore in Canada. While you are connected: a peer entry on the server you chose (your public key and the private tunnel address assigned to you) and today's three Shield counts. These live in memory only. When you disconnect, when the lease expires, or when the server restarts, they are gone. One more thing, because "no logs" is a claim people should be able to check: the DNS filter on each server writes a query log of what it blocked — the private tunnel address (10.66.x.x, not your real IP) and a reason such as "BLOCKED (ads)". It lives in the server's memory, never on disk, is erased as it is counted, and is kept for at most one day. It never contains the name you looked up. Lookups that are not blocked are forwarded to Cloudflare and Quad9 over encrypted DNS from the server's address, not yours.
5. What we never see or keep
• The websites, apps or services you use through the tunnel. • The domains your device looks up. Shield's filtering resolver records only that a request was blocked and to which of the three categories it belonged, never the name that was asked for. • A record of your IP address. Our API uses the address your request comes from, in memory, to limit how often it can be called and stop abuse: the counters are keyed by a hash of the address and last about a minute. It is never logged or stored. Request logging is switched off on the API, and its logs contain no IP addresses, device identifiers or keys. The exit server you connect to holds your IP address in memory only while you are connected, because the tunnel needs it to send traffic back to you. Exit servers keep no connection logs and are configured so that system logs live only in memory. • Timestamps of when you connected, from where, or for how long.
6. Service providers
• Google Cloud (Cloud Run and Firestore, Canada): runs the API and stores the records described in section 4. • No content delivery or edge network sits in front of the API. Your app talks to Google Cloud directly. To pick a nearby server the app sends a two-letter country it works out from your device's time zone; it is used for that one choice and never stored. • Exit servers are rented virtual machines that we configure ourselves: OVHcloud in Beauharnois, Canada (Montréal) and Strasbourg, France; and Google Cloud Compute Engine in South Carolina, USA (US East). Each provider can see that traffic flows to and from its machine, not what is inside the encrypted tunnel. We list every provider and location here before it goes live, and we name none before it is ordered and paid for. • Cloudflare (1.1.1.1) and Quad9 (9.9.9.9): the upstream resolvers our own filtering resolver asks when a lookup is neither blocked nor already cached. The question is sent over DNS-over-TLS and arrives from the exit server's own IP address, never from yours, and carries nothing that identifies your device. • Apple: in-app subscriptions are handled by the App Store. Apple processes the payment; we only learn whether a subscription is active. We never see your payment details. • Stripe: until 28 September 2026 we sold Veil+ on this website and Stripe processed those payments, collecting the buyer's email, card and billing country under its own privacy policy. We no longer sell on the web, and the app has never sent an email address to our API. We do not sell, share, rent or use your data for any purpose other than running the VPN and its subscriptions, and we commit to that in this policy as required by App Store guideline 5.4.
7. Shield and its limits
Shield blocks tracker, ad and malware domains at the DNS level inside the tunnel, for every app on your phone. It cannot block advertising served from a site's own domain or by apps that use their own encrypted DNS. The counts shown in the app are honest but approximate.
8. Why we use it, and for how long
Lawful basis. We use your device record and plan to provide the VPN and the subscription you asked for (performance of a contract). We use your IP address briefly in memory to rate-limit the API and prevent abuse (our legitimate interest in keeping the service available and safe). Retention. • Device record: for as long as the key is in use. We do not delete it on a timer today. You can have it deleted at any time by request (section 10). • Sessions, tunnel address leases and Shield counts: in memory only, gone on disconnect, lease expiry or restart. Shield counts are for the current day. • Rate-limit counters: in memory, about a minute. • Stripe keeps payment records under its own policy and legal obligations.
9. Where your data is
Our records are stored in Canada. The European Commission and the United Kingdom both recognise Canada as providing adequate protection for commercial organisations covered by PIPEDA, which includes us, so transfers from the EU and UK rely on those adequacy decisions. Stripe may process payment data in other countries under its own safeguards. When you connect to a server outside Canada, that server holds your IP address in memory only while you are connected; nothing is written to disk.
10. Your rights, and how to use them
You can ask to access, correct, delete, restrict or object to the use of your information, and to receive it in a portable format. Email info@blacklayers.ca. We answer within 30 days. Because the app has no account, the device key is the only thing that identifies your record. Open Settings ▸ Diagnostics in the app and send us the device key prefix shown there. We will send you the record it matches, or delete it. You can also choose Settings ▸ Reset identity. The app asks our servers to delete the old device record — its key, its token hash and its purchase binding — and then generates a new key. If the app cannot reach us at that moment the old record remains; email us the device key prefix shown in Settings ▸ Diagnostics and we will delete it. Deleting the app removes the key from your device. In-app subscriptions are managed by Apple and can be cancelled in your Apple Account settings. If you are unhappy with our answer, you can complain to your data protection authority. In Canada that is the Office of the Privacy Commissioner of Canada (priv.gc.ca), and in Québec the Commission d'accès à l'information (cai.gouv.qc.ca). In the EU or UK, it is the supervisory authority where you live or work, such as the UK Information Commissioner's Office.
11. Legal requests and transparency
We publish every legal request we receive and what we were able to provide at https://www.blacklayers.ca/veil/transparency, unless we are legally barred from doing so. Because we hold no logs of activity, the answer to a request for a person's activity is: nothing.
12. Children
Veil is rated 4+ on the App Store. The app collects no personal information from anyone, including children. Web subscriptions require a payment card and are meant for adults or with a parent's permission.
13. Privacy officer
The person responsible for protecting personal information at BLACK LAYERS CORP., including under Québec's Law 25, is the Privacy Officer, BLACK LAYERS CORP.. Contact: info@blacklayers.ca, or by mail at 5 Mitchell Rd NW, Calgary, AB T3R 2G3, Canada.
14. Changes to this policy
If the app ever changes what it sends or what our servers keep, this page changes first and the app's disclosure screen will match it. The effective date above is updated whenever this page is updated.
15. Contact
Email: info@blacklayers.ca Website: blacklayers.ca BLACK LAYERS CORP. · 5 Mitchell Rd NW, Calgary, AB T3R 2G3, Canada
BLACK LAYERS CORP. · 5 Mitchell Rd NW, Calgary, AB T3R 2G3, Canada · info@blacklayers.ca