LAMPA Connect Privacy Policy

LAMPA Connect connects your iPhone to VPN servers using your own profiles: a subscription link, a configuration file, a QR code or a server link from any provider. This page describes what the app stores, what it sends and where, and what it does not do, as well as what the page that opens the app from ad links and support links collects.

In short

Your profiles

The subscription links, configurations, server keys and passwords you add are stored in the iOS keychain on this device. They are not synced through iCloud and are not sent to us. You can delete a profile in the app.

The app reads the clipboard when you tap the button to paste from it. It looks there once more after installation if a link is there: that is how it finds the link the link page copied when you tapped “Download on the App Store” (see below). Both times iOS asks for your permission first.

The app recognises a QR code on the iPhone itself: the camera is used only for that, and the image is neither saved nor sent off the device. If you pick a photo from your library, the app receives only the photo you chose, not access to your whole library. A link read from a QR code is then handled exactly like one pasted by hand.

To keep the server list current, the app periodically requests your subscription address. The request goes directly to the provider: the provider sees your IP address and a standard client name (sing-box), and no cookies are kept. We do not see this request.

When the VPN is on

Traffic goes through the server in your profile. Our servers take no part in it, so we cannot know which sites you open, and we record nothing about it. What the provider's server records is governed by the provider's own rules.

With the VPN on, domain name lookups (DNS) also go through that server, to Cloudflare's public DNS service (1.1.1.1). The app does not record them.

To show that the server really carries traffic, the app opens a short encrypted connection through it to the test address set in your subscription or, if the subscription sets none, to www.gstatic.com (Google). Nothing beyond the connection itself is sent there.

If connecting fails on a Wi-Fi network, the app may send, directly over Wi-Fi and not through the VPN, the same check request to captive.apple.com that iOS itself sends when it joins a Wi-Fi network. This is how it tells a network sign-in page (in a café, a hotel, the metro) from a failure. The request carries no information about you.

What the app sends to us

Service settings. At launch and whenever you return to the app, it downloads from our server a signed document with the app's settings, the same for everyone. The request carries no device identifier, none of your profiles and nothing else about you. Like any website, the server sees the network address the request came from. We do not record it.

Install record. At first launch the app tells our server about a new install: a random install identifier, facts about the app itself (version, build, App Store or TestFlight) and which variants of screens and offers this install received. We use it to count installs and to compare those variants. It contains no name, e-mail, phone number or advertising identifier, and we do not record the network address it came from. The app creates the install identifier itself, and our server keeps only its hash. If you get access in the app, this record is linked to it.

Notifications. If you allow notifications, the app sends our server your Apple push token together with the same install identifier, facts about the app itself (version, build, App Store or TestFlight), your language, your offset from UTC (the offset only, no city or time zone) and which kinds of notifications you allowed. The server receives the token only after you allow notifications. The token lets us tell you that your access is ending, your subscription did not refresh or the connection dropped, and sometimes about offers, in your language and at a suitable time. You can turn offers off in the app's settings; the other notifications stay. The token is not used to count installs or for analytics. If you turn notifications off, the app asks the server to delete the token. Notifications are delivered by Apple's push service.

What the app does not have

No accounts, no advertising, no third-party analytics or crash-reporting services, no advertising identifier (IDFA) and no cross-app tracking. Apple may share usage statistics and crash reports with us only if you have turned on “Share With App Developers” in iPhone Settings: Privacy & Security → Analytics & Improvements.

Support

The Support button opens the bot @lampasupport_bot in Telegram. The link is not tied to your install. Telegram passes the bot your profile name, username, numeric ID and messages. Telegram itself processes the chat under its own rules. How support requests are kept is described in the “Support through Telegram” section of the LAMPA privacy policy: https://lampa.mankrik.com/privacy

The app's link page

Ad links to LAMPA Connect and support links open a short page with the buttons “Open in the app” and “Download on the App Store”. Its address ends in /ct/. The page asks for no name or e-mail and keeps no visit statistics of its own. Like any website, the server that delivers it receives the IP address and the browser string.

The data for the app sits in the address after the # sign. The browser sends this part of the address neither to the server nor to ad networks. When you tap “Download on the App Store”, the page copies the link to the clipboard so that the app can find it after installation.

AppLovin. When ad measurement is on, the page loads the AppLovin pixel in a separate, isolated frame. The pixel tells AppLovin that the page was opened, that the visit came from an AppLovin ad, together with AppLovin’s click identifiers, and that “Download on the App Store” was tapped. AppLovin also receives the IP address, the browser string, the language, the screen size and the technical browser details its script collects, and it exchanges a browser identifier with Google to match ads. The frame cannot see the page’s address or the data for the app, and it cannot set cookies on our site. AppLovin and Google may set cookies on their own domains where the browser allows it.

Bidease. If you came from a Bidease ad and the page address carries its click identifier, the page itself, without any Bidease script, tells Bidease that the page was opened and that “Download on the App Store” was tapped. Bidease receives that identifier, our internal label and the page’s domain, and with the request the IP address and the browser string. No cookies are set.

Support links. If the link came from our support, the page loads no pixel and tells ad networks nothing.

How to opt out. Until you make a choice, a bar about cookies and the AppLovin pixel is shown at the bottom of the page. “Opt out” removes the AppLovin pixel from the open page at once, and a tap on “Download on the App Store” is then reported to neither AppLovin nor Bidease. The choice is kept in your browser for a year, and on later visits the page loads no pixel and tells ad networks nothing. “Got it” only hides the bar. Bidease’s report that the page was opened is sent on load, before any choice, and if only Bidease runs on the page there is no bar.

The networks’ policies. For more information about AppLovin’s collection and use of your information visit: https://legal.applovin.com/privacy. Bidease processes the data it receives under its own privacy policy.

Who receives data and where it is stored

We do not sell personal data. Recipients: Apple delivers notifications, Telegram carries support requests, and AppLovin and Bidease receive what the link page reports, as described above. Our servers are in the European Union: in Sweden, Germany and Lithuania. Encrypted backups are stored in the Netherlands.

Legal bases and your rights

We deliver the service settings on the basis of legitimate interest: the app does not work without them (Art. 6(1)(f) GDPR). We measure ads on the link page on the basis of legitimate interest: it is how we learn which ads lead to installs of the app (Art. 6(1)(f) GDPR). We process the push token with your consent: allowing notifications gives it, and you can withdraw it at any time (Art. 6(1)(a) GDPR). We process the install record on the basis of legitimate interest: it is how we count installs and improve the app (Art. 6(1)(f) GDPR).

If you are in the EEA, the United Kingdom or Switzerland, you may request access to your data, its correction or erasure, restrict its processing, object to it, withdraw consent and lodge a complaint with a supervisory authority. Write to info@mankrik.com, and we will reply within one month. We cannot provide a history of visited sites, DNS queries or connection logs, because we neither receive nor keep them.

Children

LAMPA Connect is not intended for children under 13. If you believe a child under 13 has given us data, write to us and we will delete it.

Changes

If the app gains features that handle data differently, we will update this page and its date.

Who is responsible for the app and the data

DRUSTVO SA OGRANICENOM ODGOVORNOSCU MANKRIK DOO BUDVA - OGRANAK BEOGRAD, BULEVAR MIHAJLA PUPINA 115A, Beograd (Novi Beograd) - 11070, Serbia (RS).

Contact: info@mankrik.com

Last updated: November 3, 2026.