Privacy Policy

Last updated: 1 October 2026 • Orbitex VPN for Chrome

No browsing logs. Orbitex VPN does not record the websites you visit, your traffic or your DNS lookups, and we do not store your IP address. The free VPN works without an account: we only have your name and email if you choose to sign in with Google or buy Premium. We never sell your data or use it for advertising.

1. What Orbitex VPN does

Orbitex VPN routes Google Chrome's web traffic through Orbitex proxy servers over an encrypted (TLS) connection, so websites see the server's IP address instead of yours. It only covers Chrome; other apps on your device are not affected.

2. What we do not collect

Browsing activity: the websites, pages or URLs you visit, and your searches.
Traffic content: forms, passwords, cookies or downloads.
DNS lookups.
Your IP address: our servers see it while handling a request, as every server does, but we do not store it.
Precise location: no GPS or similar.
Name, email or phone number, unless you choose to sign in with Google or buy Premium (see below).
Full card or bank details: Lemon Squeezy handles payments. It only tells us the card type and its last four digits, never the full card number.

3. What we collect and why

Data	Why	Where it is kept
Random device ID, created on install	Give this device its own proxy login, and let us revoke one device without affecting others.	Our servers
Session token and per-device proxy login	Connect you to our servers.	Your browser and our servers (password encrypted, token stored only as a hash)
Device label such as "Chrome on Windows"	Show your devices so you can remove one.	Our servers
Country (a two-letter code such as PK), looked up from your IP address with a database on our own server; the IP itself is not stored	Know where our users are and plan server locations.	Our servers
If you sign in with Google: email address, name and Google account ID	Identify your account and link your devices and purchases.	Our servers
Plan (free, Premium, trial), its end date and your devices	Unlock Premium locations and enforce the device limit.	Our servers
Codes you enter (Premium or pairing codes)	Activate Premium or add a device to your account.	Our servers
If you buy Premium: your email and the name on the order, plan, subscription status and dates; and for each payment its amount, currency, tax, any refund, the card type and its last four digits, and a link to the invoice (all from Lemon Squeezy)	Billing, receipts, refunds and support.	Our servers
Diagnostic events: install and update; connect, disconnect, connection verified, failed, dropped or recovered (with the VPN location, session length or error type); speed test (VPN location, rounded Mbps); plan changed; checkout opened (plan, and email if signed in with Google); code applied; Google sign-in or sign-out (email); daily free limit reached; proxy conflicts and rejected proxy logins; extension version	Find broken servers and fix connection problems.	Our servers, linked to the random device ID
Account history: account created, codes applied, Google sign-in, checkout opened, subscription changes, devices added or removed, and changes made by our support staff	Support, billing questions and abuse prevention.	Our servers
Background check about once a minute while connected, sending only your session token	Apply plan changes, announcements and server updates quickly.	Our servers
If you uninstall and choose to answer: your reason and comment, device ID, version and whether your last connection worked	Learn what went wrong.	Our servers

Kept only in your browser: your settings (location, favourites, kill switch, WebRTC protection, ad blocking, time-zone matching), site rules, server ping times, your last speed test, and your daily free-plan usage. If you signed in with Google, the usage counter is also saved in Chrome's own sync storage so it follows your Chrome profile; we don't receive it.

When you connect, the extension asks our endpoint vpn-ip.orbitexaio.com for your IP address through the Orbitex server, so it only ever sees the server's IP. The extension also sends your browser's language code so announcements appear in your language.

4. Our website

Our website (getvpn.orbitexaio.com) uses no advertising or analytics trackers and sets no cookies.

Find your plan: when you type an email on the pricing page, we look up the plan on that email and show its status. The page remembers that email (or the account ID the extension opened it with) in your browser's local storage so it can show your plan next time; "Not you?" clears it.
After paying: the thank-you page checks with the same email until your Premium is active.
Language: if you pick a language, the choice is kept in your browser's local storage. The checkout passes that language so you come back to the right page.
Fonts: pages load their fonts from Google Fonts, so Google receives your IP address under its privacy policy.

5. Google sign-in (Limited Use)

Signing in with Google is optional. We request only the openid, profile and email scopes, and use the result (your email address, name and Google account ID) only to identify your Orbitex account and link your devices and purchases to it. We do not access any other Google data.

Orbitex VPN's use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell this data, use or transfer it for advertising, use it to determine creditworthiness or for lending, or let people read it except for support you ask for, security, or to comply with the law.

6. How we use and share data

We use the data above only to run, secure, support and improve Orbitex VPN. We do not sell it and do not use it for advertising or profiling. We share it only with:

Lemon Squeezy, our merchant of record, when you buy Premium. It collects your email, payment details and billing country (for tax) under its own privacy policy.
Our hosting providers (Contabo in the EU, Oracle Cloud in the US), which run our servers and do not use the data for their own purposes.
Cloudflare, which sits in front of our website and API to protect them and deliver them quickly. It handles your IP address to pass your requests on, under its privacy policy. Your VPN traffic does not go through Cloudflare.
Authorities, only when required by law.

7. Ad & tracker blocking and time-zone matching

When you turn ad blocking on, it runs entirely inside Chrome with the built-in declarativeNetRequest engine and fixed lists shipped with the extension (EasyList and EasyPrivacy). Nothing about the pages you visit or what was blocked is sent to us.

When you turn time-zone matching on, a small script makes pages read the time zone of your VPN location. It doesn't read or send anything.

8. Our proxy servers

Our servers carry your connections to the sites you visit. They do not log the sites you visit or your traffic. For abuse prevention and capacity planning they may keep aggregate counters, such as connections or bytes per device per day, for up to 90 days.

9. How long we keep data

Account data (devices, plan, country, Google sign-in details, email): while your account exists.
Diagnostic events: 90 days.
Account history and uninstall feedback: 365 days.
Payment records: as long as tax and accounting law requires us to keep them.
Server backups: overwritten on a rolling basis (currently the last 14 copies).

10. Your choices and deleting your data

Use the free VPN without signing in: we then have no name or email for you.
Sign out of Google in the extension (Account) to unlink that browser from your account.
Email [email protected] to see, correct or delete your data. We delete your account, devices, email and history within 30 days, except payment records we must keep for tax or legal reasons (Lemon Squeezy also keeps its own).
Uninstalling the extension stops all data collection from that browser.

11. Security

Connections to our API and proxy servers use TLS. Each device has its own proxy login; proxy passwords are stored encrypted and session tokens only as hashes. Access to our admin tools is restricted and every admin change is recorded.

12. Permissions the extension uses

proxy: set Chrome's proxy to Orbitex servers while you are connected.
webRequest, webRequestAuthProvider: supply your proxy login to Orbitex servers only, and notice when a page fails to load because a server is down.
storage: keep your settings and session on this device.
alarms: refresh the server list and re-check the connection periodically.
identity: optional Google sign-in.
Access to all sites: required by Chrome for the proxy login above.
privacy (optional, asked when you turn it on): WebRTC leak protection.
declarativeNetRequestWithHostAccess: ad & tracker blocking, only when you turn it on.
scripting: the time-zone script, only when you turn time-zone matching on.

13. Children, changes and contact

Orbitex VPN is not directed at children under 13, and we do not knowingly collect their data. When our practices change we'll update this page and its date, and announce significant changes in the extension.

Questions or data requests: [email protected] (Orbitex AIO).