Privacy Policy

1. Who we are and what this covers

This Privacy Policy explains how CloudPath Network Technology Limited (“CloudPath,” “we,” “us”) handles personal information in connection with our website at cloudpathnetwork.com, the Obsidian VPN Android app, and related support. The app is listed on Google Play under the developer display name SANDIAMOND DIGITAL PAYMENT, package ai.sandiamond.free.stealth.

CloudPath is responsible for the processing described in this policy. Google and other providers may also process information under their own policies when providing their services. Our privacy contact is dev@cloudpathnetwork.com.

2. VPN processing and Android permission

Obsidian VPN uses Android’s VpnService to create an encrypted tunnel between your device and a VPN endpoint. Establishing and operating that connection necessarily involves processing your network address and routing the traffic you choose to send through the tunnel. These operations are transient; our VPN service does not retain IP address logs, connection timestamps, or traffic logs.

Android asks you to approve a VPN connection before it is established. You can decline, disconnect in the app, or revoke the connection in Android’s VPN settings. The VPN cannot provide its core connection function without that permission. If we seek access to additional personal or sensitive data, we will explain the data, purpose, and recipients in a separate in-app disclosure and request your affirmative consent before that access where required.

VPN traffic is not redirected or manipulated to replace or inject advertising. Ads in the free app are separate from traffic passing through the VPN tunnel. Encryption protects the device-to-VPN-endpoint portion of a connection; it does not make all internet activity anonymous or replace secure websites, safe browsing habits, or device security.

3. Information processed and why

The categories below cover app functionality, the disclosed AdMob and Firebase integrations, purchases, and direct contact with us. Data practices can depend on app version, device settings, consent, and the Google services enabled.

Do not send passwords, complete payment card information, or unrelated sensitive information to support. The website does not require an account and has no message-submission form. Email links open your email application; a message is sent only when you send it there.

4. AdMob, Firebase, and other recipients

Google AdMob

The free version uses Google AdMob to display and measure ads. Google’s Mobile Ads SDK can process IP addresses, device or advertising identifiers, product interactions, and diagnostic information for advertising, measurement, and fraud prevention. Google may infer approximate location from an IP address. These SDK activities are separate from our VPN service’s policy of not storing connection logs. Premium removes in-app ads during an active subscription; it does not remove processing necessary for purchases, security, or diagnostics.

Read Google’s Privacy Policy, how Google uses information from apps that use its services, and the Mobile Ads SDK data disclosure.

Firebase

We use Google Firebase for app analytics and technical diagnostics. Depending on the Firebase products and settings enabled, processing can include app-instance identifiers, app events, device and app information, approximate location, and crash or performance data. See Firebase’s privacy and security information for product-specific processing and retention. Firebase data is not a VPN traffic log.

Other limited disclosures

Google Play handles purchases and subscription management. Hosting, infrastructure, and email providers process information needed to operate the website, VPN, and support. We may disclose relevant information where legally required, to address fraud or security incidents, to protect rights, or in a business transfer subject to appropriate safeguards. We do not sell VPN traffic or use the VPN tunnel for advertising monetization.

5. Your choices and consent

For advertising or analytics processing that requires your consent, we request your choice in the app before that processing begins. You can decline or withdraw consent through the privacy choices presented to you, or contact our privacy team for assistance. Reading this policy or accepting the Terms of Service does not, by itself, authorize sensitive data access or personalized advertising.

• VPN permission: decline the Android request, disconnect, or remove the VPN configuration through Android settings.
• Advertising: review any privacy or advertising choices presented by the app. Android’s advertising controls let you reset or delete your advertising ID, where supported. The controls available depend on your Android version. Resetting or deleting an advertising ID does not stop all diagnostic, security, or service processing.
• Google settings: use Google’s ad controls and Google Account settings to manage relevant Google-service preferences.
• App data: clear local app data through Android settings or uninstall the app. This does not itself erase provider-held records or cancel a subscription.
• Requests to us: ask for access, correction, deletion, restriction, or an explanation of processing using the contact details below.

Declining optional processing may affect features that depend on it. Buying Premium removes in-app ads; it is not a requirement for making a privacy request.

6. Retention and deletion

Our VPN service retains no IP address, connection timestamp, or traffic logs. Other information is retained only for the purpose for which it was collected and for applicable legal, accounting, security, and dispute-resolution needs. We assess the category, sensitivity, purpose, and legal requirements when determining retention.

• Purchase and entitlement records: kept while needed to administer subscriptions, resolve payment issues, prevent fraud, and meet applicable financial-record requirements.
• Support correspondence: kept while needed to respond, handle follow-up issues, and maintain necessary business or legal records.
• AdMob and Firebase information: retained according to the relevant Google product, its configured retention settings, and Google’s applicable policies. These periods differ by product.
• Website delivery and security records: handled under the hosting provider’s operational and security retention policies.

When information is no longer needed, it is deleted or irreversibly anonymized. You can request deletion of personal information, including related app account information if an account exists. We may need proportionate verification to locate the correct records. We explain any information that must be retained and why. Irreversibly anonymized data cannot be associated with you and may not be recoverable for deletion.

Google may separately retain records it controls, including Google Play payment records. You can exercise relevant rights directly with Google as well. Deleting app data does not cancel a Google Play subscription.

7. Security and international processing

We use encrypted transport and reasonable technical and organizational measures to protect personal information, including access restrictions appropriate to the service. No method of transmission or storage is completely secure.

CloudPath is based in Hong Kong. Our infrastructure and providers, including Google, may process information in other countries. Where applicable law requires transfer safeguards, we use the relevant contractual or other lawful protections. Provider-specific information is available through the privacy links above.

8. Legal grounds and your rights

Where a legal basis is required, we rely on performance of our service agreement for core VPN and subscription functions; legitimate interests for proportionate security, troubleshooting, and support; legal obligations for required records and disclosures; and consent for processing that requires it, including applicable advertising or analytics activities. You may withdraw consent for future processing without affecting processing that was lawful before withdrawal.

Depending on your location, you may have rights of access, correction, deletion, portability, objection, or restriction, and the right to complain to a relevant privacy regulator. Hong Kong residents may contact the Office of the Privacy Commissioner for Personal Data. Contact dev@cloudpathnetwork.com to make a request. We respond within the time required by applicable law and explain any lawful limitation.

9. Children’s privacy

Obsidian VPN is not directed to children under 13, or under a higher age where local law requires it. We do not knowingly collect personal information from children below the applicable age. If you believe a child has provided personal information, contact dev@cloudpathnetwork.com so we can investigate and take appropriate steps, including deletion where required.

Users who are not legally able to enter a contract must use the service with the involvement and permission of a parent or legal guardian. Google Play account, purchase, and parental-control requirements also apply.

10. Website cookies and external links

This website does not run advertising or analytics SDKs, set tracking cookies, or use local storage. AdMob and Firebase disclosures in this policy concern the Android app. Cloudflare delivers and protects this website and may process ordinary technical request information for those purposes. Cloudflare’s security-related processing is separate from the Android app and its VPN connection.

Following a link to Google Play or another external service takes you to a service with its own privacy practices. Opening an email link does not send a message automatically, and the website does not store your message.

11. Changes and contact

We update this policy when our services, providers, or practices change. The latest version and update date appear here. Material changes are brought to your attention in the app or through another appropriate channel, and renewed consent is requested where required.

Questions or privacy requests can be sent to our privacy contact:

Request data deletion · Get support · Terms of Service