Privacy policy

World by SOBE is operated by SOBE OÜ (trading as Sobe Invest), registry code 16119708, Paldiski mnt 161-1, 13518 Tallinn, Estonia ("we"), which is the data controller. A VPN carries everything you send, so we built ours to keep as little as possible. This policy says what the app and our servers keep, and what they never keep.

What we keep

• Your email address. It is your account. We use it to send sign-in codes and service messages about your subscription (for example, when the store could not charge a renewal; never advertising), to know whether your account has access, and to give you the same account on a new device. We also keep the language you use in the app, so these emails come in your language.
• Your purchase. If you subscribe in the app, the store you got it from (Google Play or Samsung Galaxy Store) gives the app a purchase token and the app sends it to our server. The server asks Google or Samsung whether the subscription is active and keeps the token, the product, the expiry date and the account it belongs to, so that your access works on all your devices and ends when the subscription ends; it asks again when the period runs out. To tie the purchase to your account, the app gives the store a code calculated from your email (a one-way hash, not the address itself). We never see your card, your Google or Samsung account address or your name. For a Google Play subscription it also keeps whether a renewal failed (grace period or on hold) and the plan (monthly or yearly), to tell you in the app and to offer the yearly plan.
• Signing in with Google (app from Google Play). If you tap "Continue with Google", Google gives the app a signed token with your Google email address, which our server checks and then forgets; the email becomes your account as above. We receive nothing else from your Google account: no name, photo, contacts or other data. Only Gmail addresses and addresses of domains run on Google Workspace are accepted this way; any other address signs in with the emailed code.
• An account number instead of an email. If you choose “Stay anonymous — no email”, your account has no email at all: it is opened by a 16-digit number that you hold. Instead of an email, our server keeps a keyed one-way fingerprint of the number (never the number itself) and a random account identifier with two random codes that tie your store purchases to it, besides the records of the time you buy for it (30 days or a year, one-time purchases in Google Play or, from version 1.3, the Galaxy Store, with no free trial or free hour). Sign-in sessions, devices and VPN keys are kept as for any account. The app keeps the number on your device (from version 1.7 sealed with the Android Keystore) and, in the app from Google Play, in Block Store as described below. We cannot look the number up or send it to you, so if you lose it we cannot give the account back. Such accounts that never bought anything and never connected are deleted after 30 days. To limit guessing, our account service counts wrong numbers per IP address in memory for one day; this is never written to disk.
• The free hour. To give each device one free hour, our server keeps the random install number of the device (see below) and a protected fingerprint of the account that used it, with the time it started.
• Sign-in sessions. A random token is kept in the app's private storage on your device and, in hashed form, on our server, together with the time it was created and last used, until you sign out or delete your account. A session stops working after 180 days. Sign-in codes are kept hashed for 10 minutes.
• VPN keys. Each device of your account gets its own keys on each of our servers (versions before 1.1 use one key per account). We create them on the server and keep your connection profile there in a file only the server administrator account can read, so that you can sign in on a new device and connect at once. On your device the profile is kept in the app's private storage and is left out of Android backups. Deleting your account erases the keys on every server.
• Your devices. An account can be used on up to 3 devices. For that the app sends a random install number (made on the device, not linked to your Google or Samsung account or any advertising identifier) and the device type with its Android version, for example "Pixel 9 Android 16". We keep them with the times the device first and last asked for access, so you can see and disconnect your devices in Settings → Devices. A device's record goes when you disconnect it (once every server has withdrawn its key; a server that is down does it when it is back), when World has not been opened on it for 60 days, or when you delete the account. The times of disconnections are kept for 30 days (at most 3 per 30 days).
• Connection counters. While you are connected, the VPN server holds in memory your current IP address and port (needed to send traffic back to you), the time of your last connection and the amount of data transferred. They are never written to disk and disappear on restart.

What we never keep

• The websites, apps or services you use through the VPN.
• Your DNS queries.
• Your IP address. Our account service sees it while answering a request and holds it in memory to limit abuse until the service restarts; it is never written to disk.
• The content of your traffic.

Access logs are switched off on the VPN servers and on the account service. The system journal of our servers lives in memory only, for at most three days, and is emptied on every restart. The app contains no analytics, advertising, crash-reporting or other third-party tracking code; the only third-party libraries in it are the store's own, to sell the subscription (Google Play Billing in the app from Google Play, Samsung In-App Purchase in the app from Galaxy Store), and, in the app from Google Play only, Google's sign-in (Credential Manager), used only when you tap "Continue with Google".

What stays on your device

Your theme, language and settings stay on the device. A background photo you choose is copied into the app and never uploaded. If Android backup is on, Google keeps a copy of these settings (not your session, keys or photo) in your own Google account backup so they return after a reinstall; we have no access to it. The Quick Settings tile reads the connection state from the app on the device. While the VPN is on, Android shows a notification, as it requires for every VPN. Your session, account number and VPN profile are kept encrypted with a key held in the phone's secure hardware (Android Keystore). In the app from Google Play, Google Play services keep the random install number and, for an account without email, the account number in Block Store, so that after a reinstall the same phone takes its place again and the account is found; this copy goes into your Google backup only when that backup is end-to-end encrypted, and we have no access to it. Reminders before a free trial or the paid time ends are set on the device and shown by Android; nothing about them is sent to us.

Where our servers are

We rent our servers from hosting providers and run all software on them ourselves: Amsterdam, the Netherlands, and Stockholm, Sweden (HostHatch), Helsinki, Finland (HOSTKEY), and Tel Aviv, Israel (Kamatera; Israel is recognised by the European Commission as providing adequate data protection). Your account and the purchase record are stored on the Amsterdam server; the other servers hold only your VPN keys. If the main address of our account service is unreachable, the app uses a backup address on the Stockholm server, which passes the request on without logging it.

Others involved

• Google distributes the app through Google Play and, for a subscription bought there, processes your payment and tells our server, when it asks, whether your subscription is active, under its own privacy policy. We receive no card or payment details. If you allow Android to share usage and diagnostics, Google may show us anonymous crash reports. Google may also show its own rating sheet once in the app (In-App Review); we see only a rating you choose to publish.
• Samsung distributes the app through Galaxy Store and, for a subscription bought there, processes your payment and tells our server, when it asks, whether your subscription is active, under its own privacy policy. We receive no card or payment details.
• Hosting providers supply the machines and the network, not the software, and have no access to your account.
• Google Workspace delivers the emails with sign-in codes and service messages.
• Domain names are looked up by our own resolver on each VPN server, which asks the domains' own name servers directly (not Cloudflare or another public resolver), from our server's address, never yours; "Block ads and trackers" uses our own filter list there from version 1.7 of the app (earlier versions, and the Galaxy Store version for now, ask AdGuard DNS, also from our server's address). On the Moscow servers public resolvers look up the names (Cloudflare or Yandex DNS; AdGuard DNS when "Block ads and trackers" is on).

We do not sell or share your data with anyone else, and we do not use it for advertising or tracking.

Your choices and rights

• Sign out removes the session and the VPN keys from your device.
• Delete your account in Settings → Delete account. Your email, sessions and keys are removed from all our servers at once; if one of them is down at that moment, it deletes your key as soon as it is back, usually within a day. Deleting your account does not cancel a subscription: cancel it in Google Play → Payments and subscriptions → Subscriptions, or in Galaxy Store → Menu → Subscriptions. The record of your purchase, with the email it belongs to, is kept, so that you do not lose what you paid for if you come back; write to world@sobeinvest.com from that email and we will erase it too.
• Under the GDPR you may access, correct, export and erase your data and object to its use. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the authority where you live.

We process your email and the purchase record to provide the service you bought (GDPR Art. 6(1)(b)) and to keep records of sales required by law (Art. 6(1)(c)).

Children

World by SOBE is not directed at children under 16, and we do not knowingly hold their data.

This website

world.sobeinvest.com counts page views with GoatCounter, which runs on our own server. It sets no cookies and stores no IP addresses: we see only which pages are opened, from which site visitors came, the browser type, screen size and country. Nothing is shared with anyone.

Changes

If this policy changes, the new version appears here with a new date.

Contact

SOBE OÜ · registry code 16119708 · Paldiski mnt 161-1, 13518 Tallinn, Estonia
world@sobeinvest.com

If you write to us from "Not connecting?" in the app, the email your mail app opens already contains the app version, the phone model, the protocol, the server and the error, so that we can help; you can remove any of it before sending.