Privacy policy

World by SOBE is operated by SOBE OÜ (trading as Sobe Invest), registry code 16119708, Paldiski mnt 161-1, 13518 Tallinn, Estonia ("we"), which is the data controller. A VPN carries everything you send, so we built ours to keep as little as possible. This policy says what the app and our servers keep, and what they never keep.

What we keep

• Your email address. It is your account. We use it to send sign-in codes, to know whether your account has access, and to give you the same account on a new device.
• Sign-in sessions. A random token is kept in the iOS Keychain on your device and, in hashed form, on our server, together with the time it was created and last used, until you sign out or delete your account. A session stops working after 180 days. Sign-in codes are kept hashed for 10 minutes.
• Your purchases. If you subscribe or buy lifetime access in the app, Apple sends us a signed record of the purchase. We keep its transaction number, the product, the expiry date and the account it belongs to, so that your access works on all your devices and ends when the subscription ends. To tie the purchase to your account, the app gives Apple a code calculated from your email (a one-way hash, not the address itself). Apple also tells our server about renewals, cancellations and refunds. We never see your card, your Apple ID or your name.
• VPN keys. Each device of your account gets its own keys on each of our servers (the app before version 1.3 uses one key per account). We create them on the server and keep your connection profile there in a file only the server administrator account can read, so that you can sign in on a new device and connect at once. On your device the profile is kept in the iOS Keychain and in the iOS VPN settings. Deleting your account erases the keys on every server.
• Your devices. An account can be used on up to 3 devices. For that the app sends a random install number (made on the device, not linked to your Apple ID or any advertising identifier) and the device type with its iOS version, for example "iPhone iOS 26.1". We keep them with the times the device first and last asked for access, so you can see and disconnect your devices in Settings → Devices. A device's record goes when you disconnect it (once every server has withdrawn its key; a server that is down does it when it is back), when World has not been opened on it for 60 days, or when you delete the account. The times of disconnections are kept for 30 days (at most 3 per 30 days).
• Connection counters. While you are connected, the VPN server holds in memory your current IP address and port (needed to send traffic back to you), the time of your last connection and the amount of data transferred. They are never written to disk and disappear on restart.

What we never keep

• The websites, apps or services you use through the VPN.
• Your DNS queries.
• Your IP address. Our account service sees it while answering a request and holds it in memory to limit abuse until the service restarts; it is never written to disk.
• The content of your traffic.

Access logs are switched off on the VPN servers and on the account service. The system journal of our servers lives in memory only, for at most three days, and is emptied on every restart. The app contains no analytics, advertising, crash-reporting or other third-party tracking code.

What stays on your device

Your theme, app icon, language and settings stay on the device. A background photo you choose from your library is copied into the app and never uploaded. The widget and the Control Center button read the connection state and your theme from the app's own storage on the device. Sites you add to the Allowed list stay on your device; the base list is downloaded from our server without your account. Sites on the Allowed list open directly, not through the VPN: your internet provider sees which of them you visit, and they see your real IP address. With the VLESS protocol the app looks up the names of these sites directly with Yandex DNS (77.88.8.8), so Yandex sees those lookups together with your IP address. The Allowed list is not used on the Moscow server.

Where our servers are

We rent our servers from hosting providers and run all software on them ourselves: Amsterdam, the Netherlands, and Stockholm, Sweden (HostHatch), Helsinki, Finland (HOSTKEY), and Tel Aviv, Israel (Kamatera; Israel is recognised by the European Commission as providing adequate data protection). Your account is stored on the Amsterdam server; the other servers hold only your VPN keys. If the main address of our account service is unreachable, the app uses a backup address on the Stockholm server, which passes the request on without logging it.

Some accounts can also use a server in Moscow, Russia (RUVDS). It is shown in the app only to those accounts, marked "Traffic goes through Russia". Traffic through it goes out to the internet in Russia and is subject to Russian law, which can require providers to store traffic and give authorities access to it; the Moscow server holds only your VPN key, and your account stays in Amsterdam. Use it only for Russian sites and services.

Some accounts can also use a server in New York, USA (HOSTKEY). It too holds only your VPN key; traffic through it goes out to the internet in the USA and is subject to US law.

Others involved

• Hosting providers supply the machines and the network, not the software, and have no access to your account.
• Google Workspace delivers the emails with sign-in codes.
• Public DNS resolvers (Cloudflare and Quad9; AdGuard DNS when "Block ads and trackers" is on) look up domain names for you. The queries come from our server, never from your IP address (except the Allowed list lookups described above). On the Moscow server, Yandex DNS looks up the names, or AdGuard DNS when "Block ads and trackers" is on.
• Apple delivers the app through the App Store under its own privacy policy. If you allow sharing with app developers in iOS Settings, Apple may pass us anonymous crash reports. Apple processes the payment for purchases in the app; we receive no payment details.

We do not sell or share your data with anyone else, and we do not use it for advertising or tracking.

Your choices and rights

• Sign out removes the session and the VPN keys from your device. If the kill switch is on and our server ends the session (for example it expired), the VPN profile stays, so the kill switch keeps protecting you, until you sign in again or remove it.
• Delete your account in Settings → Delete account. Your email, sessions and keys are removed from all our servers at once; if one of them cannot be reached at that moment, it removes your key as soon as it is back, usually within a day. You can also write to world@sobeinvest.com from your account email. Deleting your account does not cancel a subscription: cancel it in iOS Settings → your name → Subscriptions. The record of your purchase, with the email it belongs to, is kept, so that you do not lose what you paid for if you come back; write to us from that email and we will erase it too.
• Under the GDPR you may access, correct, export and erase your data and object to its use. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the authority where you live.

We process your email and your purchase records to provide the service you asked for or bought (GDPR Art. 6(1)(b)). We keep your email until you delete your account; a kept purchase record keeps its email, as described above.

Children

World by SOBE is not directed at children under 16, and we do not knowingly hold their data.

This website

world.sobeinvest.com counts page views with GoatCounter, which runs on our own server. It sets no cookies and stores no IP addresses: we see only which pages are opened, from which site visitors came, the browser type, screen size and country. Nothing is shared with anyone.

Changes

If this policy changes, the new version appears here with a new date.

Contact

SOBE OÜ · registry code 16119708 · Paldiski mnt 161-1, 13518 Tallinn, Estonia
world@sobeinvest.com