Privacy Policy

1. Information we collect

a. Information you provide to us

• Signup details. When you join our waitlist or register for the service, we collect your name, email address, preferred username and mobile number. The username is checked for uniqueness and becomes your name on the network if your signup is approved. We use these to create and manage your account and to contact you about the service.
• Access code. The access code you enter in the app links your device to your dedicated exit node. It identifies your subscription; it is not a password to any external account.
• Correspondence. If you contact us for support, we keep the messages you send us so we can respond and improve the service.

b. Information collected automatically to operate the VPN

To establish and maintain the encrypted tunnel, our coordination server needs a small amount of technical metadata about your device. This is connection metadata — not a record of what you do online.

• Device and node information. A device-generated public key, an internal mesh network address assigned to your device (e.g. a 100.x address used only inside the private network), a device name/model and operating-system version, so we can register your device and route it to your exit node.
• Connection metadata. Whether your device is currently online, the exit node it is assigned to, and connection timestamps, so the service can show you your connection status and keep the tunnel healthy.
• Public exit IP address (shown to you). While connected, the app requests the public IP address and approximate city/country of your exit node from third-party lookup services so it can display them to you on the home screen (for example, “Chennai, India”). See Third-party services.

c. Website information

• When you submit the waitlist form, we store the name, email address, preferred username and mobile number you enter, plus the timestamp and which form it came from. Your name, email, username and mobile number are encrypted at rest; we keep a one-way cryptographic fingerprint of the email, username and mobile number so we can tell that a signup is a duplicate without holding those values in readable form. We no longer store the IP address of waitlist submissions.
• Our web server keeps standard access logs (IP address, timestamp, requested page, user agent) for security and diagnostics.

d. Information we do not collect

Because oorlinq is a privacy tool, it is important to be explicit about what we do not record. We do not log, monitor, store, or sell:

• The websites, apps, or services you access through the VPN;
• Your DNS queries;
• The contents of your network traffic;
• Bandwidth-usage histories tied to your browsing;
• Your real-world location beyond what is inherent in an IP address you voluntarily use.

2. How we use information

• To create your account, activate your subscription, and connect your device to its dedicated exit node;
• To operate, maintain, secure, and troubleshoot the VPN service;
• To display your connection status and exit location inside the app;
• To communicate with you about your account, service updates, and support requests;
• To prevent fraud, abuse, and violations of our terms;
• To comply with applicable legal obligations.

We rely on the following legal bases (where the GDPR applies): performance of our contract with you (to provide the service), our legitimate interests (to secure and improve the service), your consent (for the waitlist and optional communications), and compliance with legal obligations.

3. Third-party services

We keep third parties to a minimum. The services below may process limited data on our behalf:

These providers are bound by their own privacy policies. We do not authorise them to use your data for their own advertising.

4. How we share information

We do not sell your personal information and we do not share it with advertisers or data brokers. We only disclose information:

• to the service providers listed above, strictly to operate oorlinq;
• when required by valid legal process — and only the limited data we actually hold (which, by design, does not include your browsing activity or traffic contents);
• to protect the rights, safety, and security of oorlinq, our users, or the public;
• in connection with a merger, acquisition, or sale of assets, in which case we will notify you and this policy will continue to apply to your information.

5. Data retention

We keep personal data only as long as necessary for the purposes described in this policy. Account and signup information (name, email, username, mobile number and access code) is retained while your subscription is active and for a reasonable period afterward to meet legal and accounting obligations. Operational connection metadata is retained only as long as needed to run and secure the service and is then deleted or aggregated. When you ask us to delete your account, we remove your personal data except where we are legally required to retain it.

6. Security

Your traffic travels through an encrypted tunnel built on WireGuard. We apply administrative and technical safeguards to protect the limited data we hold, including access controls, encryption in transit, and hardened servers.

Signup details (name, email address, username and mobile number) are additionally encrypted at rest with AES-256-GCM, so those fields are not readable in the database itself or in its backups. They are decrypted only when an administrator views the signup queue in order to act on it.

No method of transmission or storage is completely secure, but we work to protect your information and to limit how much of it exists in the first place.

7. Your rights and choices

Depending on where you live (including under the EU/UK GDPR and the California Consumer Privacy Act), you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data;
• object to or restrict certain processing;
• request a portable copy of your data;
• withdraw consent (for example, unsubscribe from the waitlist) at any time.

To exercise any of these rights, email admin@oorlinq.com. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.

8. International data transfers

oorlinq’s exit nodes and coordination servers are located in India. If you use oorlinq from the European Economic Area, the UK, Switzerland, or another jurisdiction with its own data-transfer rules, your information will be transferred to and processed in India, which has not received an adequacy decision from the European Commission. Where this applies, we rely on the EU Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK International Data Transfer Addendum, where applicable) as the legal basis for the transfer, together with the technical safeguards described in Section 6 (Security). You can request a copy of the applicable safeguards by emailing admin@oorlinq.com.

9. Children’s privacy

oorlinq is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Trial, returns and refunds

This section covers the terms of sale rather than privacy, and is published here so the offer is written down in one place.

• 15 day free trial. You buy the device, and the trial runs for 15 days from the date you start using the service.
• Full refund if it is not right for you. If the service is not satisfactory within those 15 days, return the device and we will refund what you paid for it in full.
• How to start a return. Email hello@oorlinq.com within the 15 day window and we will confirm the return arrangements with you.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, notify you. Your continued use of oorlinq after an update means you accept the revised policy.

12. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

oorlinq
Email: admin@oorlinq.com

Data protection contact. For requests relating specifically to your rights under GDPR, UK GDPR, or similar laws (access, correction, deletion, portability, objection), email admin@oorlinq.com with the subject line “Data Rights Request.” We aim to respond within 30 days, as required by applicable law.