Last updated: October 2026
VPN Generator is developed, maintained, and operated by Institute for the Development of Public Digital Networks gGmbH (IEDN), a German non-profit limited liability company (gemeinnützige GmbH) registered in Berlin, Germany, with the Charlottenburg Local Court under registration number HRB 236015 B.
IEDN’s public-facing branding is currently transitioning to Freedom Forge. This change concerns the organization’s public identity and does not affect its legal structure. IEDN gGmbH remains the legal entity responsible for VPN Generator and acts as the data controller for the processing described in this Privacy Policy.
This Privacy Policy explains what information is processed when you use VPN Generator, why it is processed, how long it is retained, when it may be shared, and what rights you have under applicable data protection law.
This Privacy Policy covers the VPN Generator VPN service, its Telegram bots, and support provided in connection with the service.
Applications that may be used to connect to VPN Generator, including Gate19 and third-party VPN clients, are separate software products and are subject to their own privacy policies. This Privacy Policy does not describe data processing performed independently by those applications.
VPN Generator is designed according to the principle of data minimization. We process and retain only the information necessary to provide, operate, secure, maintain, and understand the use of the service.
Data controller:
Institute for the Development of Public Digital Networks gGmbH (IEDN)
Zähringerstraße 11/12
10707 Berlin, Germany
Registration number: HRB 236015 B
Privacy contact: feedback@vpngen.org
Support: Telegram bot @vgsup_bot; email vpngenerator@vpn.support
VPN Generator does not require end users receiving VPN access keys to provide their name, physical address, telephone number, or other directly identifying information in order to use the VPN service.
Depending on how you interact with VPN Generator, we process the limited categories of information described below.
VPN Generator uses cryptographic access keys to enable access to the service. Each key functions as a unique technical credential.
Access keys are issued in groups (“brigades”). Each group is linked to the Telegram account of the person who created it, so the keys belonging to a group are associated with that account. We do not otherwise attempt to link individual access keys to individuals.
A person may use more than one access key, including on different devices.
A user’s IP address is necessarily processed when establishing a network connection.
During statistical processing, VPN Generator also uses the IP address to determine approximate geographic information using the GeoLite2 database. The geographic information retained for statistical purposes consists of country, continent, and city. The IP address itself is not retained as part of the geographic statistics.
GeoIP information is approximate and may not always accurately represent a user’s physical location.
VPN Generator processes limited technical information necessary to understand whether access keys are active and to produce aggregate service usage statistics. These statistics allow us to understand the scale and geographic distribution of VPN Generator and to monitor the operation and availability of the service.
Central statistical records do not contain identifiers of individual access keys. Usage totals are recorded per group of keys.
VPN Generator servers do not collect device identifiers.
Our infrastructure records metadata about connections made through VPN Generator, as described in Section 3.
To obtain a Free brigade, a user sends the bot a photo of something real in their surroundings, such as an object or a scene or any other picture. The photo serves only as a minimal validation step: its content is not taken into account, and what matters is only that the same photo has not been submitted in the previous 90 days. The photo is not intended to show a person, and we ask users not to submit photos showing people, documents or other personal information.
The bot accepts images only when they are sent as photos, not as files. When a photo is sent this way, Telegram compresses it and removes its metadata, including EXIF data and location, so this information does not reach VPN Generator.
The bot processes the photo in memory and calculates a SHA-256 hash of the file (the “fingerprint”). This is a cryptographic hash: it cannot be used to reconstruct the photo and only allows us to check whether the same file has been submitted before. The bot does not store the photo on disk or in a database. A copy of the photo is sent to a restricted internal Telegram group of the VPN Generator team, where all messages are deleted automatically after 3 days.
While a request is being processed, for no longer than 48 hours, the fingerprint is stored together with the Telegram chat ID so that the bot can reply to the user. This record is deleted as soon as a decision is made. After that, only the fingerprint is kept, without any chat ID, and it is deleted automatically after 90 days. The fingerprint is never linked to a brigade.
VPN Generator uses Telegram bots to create and manage groups of access keys. For this purpose, VPN Generator stores a masked Telegram ID and a language category (Russian or English, where English covers all non-Russian users). The history of interactions with the bot is retained for 30 days.
Support is provided through Telegram and by email. If you contact us, we process the contact details and other information you choose to provide in order to respond to your request.
Certain technical information must be processed for VPN Generator to establish and maintain network connections and operate its infrastructure. This may include a user’s IP address during a connection, the relevant access key, connection status, and other technical information necessary for the VPN infrastructure to function.
A key is treated as active for statistical purposes when it has completed a successful handshake with a VPN Generator server. VPN Generator nodes periodically generate information about active access keys. Central statistical records do not contain identifiers of individual access keys; usage totals are recorded at group level.
Traffic volume. Traffic volume is measured per access key on the VPN server in order to enforce traffic limits. Only aggregate traffic totals are sent to central statistical systems, without a breakdown by individual access key.
DNS. DNS queries are not logged by VPN Generator.
Connection records. Our infrastructure records metadata about TCP connections, including which access key connected to which destination and when. These records do not include DNS queries. They are stored in encrypted form and are deleted after 10 weeks.
System logs. Operating-system logs on VPN nodes are not retained.
We process information only where necessary for defined purposes and where an appropriate legal basis exists under the General Data Protection Regulation (GDPR).
• We process connection and technical information where necessary to provide and operate VPN Generator, including establishing connections and enabling users to access the service.
• We process limited technical and aggregate usage information to maintain the reliability and security of VPN Generator, diagnose technical problems, understand service usage, measure the geographic distribution of the service, and improve its operation.
• We process information associated with Telegram-based group creation and management, including Free brigade validation, where necessary to operate the service and administer access-key groups.
• We retain connection records as described in Section 3.
• Where you contact us, we process the information you provide to respond to and manage your request.
The applicable legal bases may include Article 6(1)(b) GDPR, where processing is necessary to provide a service requested by the user, and Article 6(1)(f) GDPR, where processing is necessary for IEDN’s legitimate interests in operating, securing, maintaining, and improving VPN Generator. Where processing is required by applicable law, Article 6(1)(c) GDPR applies. Where we rely on consent for a specific processing activity, Article 6(1)(a) GDPR applies, and consent may be withdrawn at any time.
We retain information only for as long as necessary for the purposes for which it is processed, taking into account operational, security, and legal requirements. In particular:
• Connection records: deleted after 10 weeks.
• Telegram bot interaction history: retained for 30 days.
• Free brigade validation: the photo is not stored by the bot; the copy sent to the internal team group is deleted automatically after 3 days; the link between the fingerprint and the Telegram chat ID is deleted once the request is decided, and in any case within 48 hours; the fingerprint itself is deleted after 90 days.
• Active-key statistics: retained for as long as the relevant group exists and deleted together with it. These statistics have been collected since April 2023.
• Geographic statistics: no fixed retention period is currently defined. These statistics have been collected since June 2024 and do not contain IP addresses or identifiers of individual access keys.
• IP addresses used for GeoIP processing: not retained as part of the geographic statistics.
• Operating-system logs on VPN nodes: not retained.
• Information provided when contacting us: retained only for as long as reasonably necessary to handle the relevant communication or request.
Where applicable law requires certain information to be retained for a specific period, we may retain that information for the period required by law.
IEDN does not sell users’ personal data.
We use third-party service providers where this is necessary to operate, host, secure, maintain, or support VPN Generator. Such providers may process limited information on our behalf or in connection with providing their services, subject to applicable data protection requirements.
• Hosting providers supply the server infrastructure on which VPN Generator runs, in data centres located in the Netherlands, Finland, Spain, Switzerland, and Germany. We do not publish the names of individual providers, because this information could help those seeking to identify and block VPN Generator’s infrastructure.
• Telegram is used for VPN Generator’s bots and support. Telegram independently processes information associated with users’ Telegram accounts and communications in accordance with its own terms and privacy practices.
• Cloudflare is used as a DNS resolver. DNS queries are sent from the VPN server, so Cloudflare does not receive the originating VPN user’s IP address.
VPN Generator’s infrastructure is located in the European Economic Area and in Switzerland, which the European Commission recognises as providing an adequate level of data protection.
We disclose information only where we are required to do so by a valid and binding legal obligation. Apart from the connection records described in Section 3, we do not carry out any additional processing for law-enforcement purposes. Because VPN Generator is designed to minimize the collection and retention of user information, the amount of information available for disclosure is correspondingly limited.
Where the GDPR applies to the processing of your personal data, you may have the right to:
• request access to your personal data;
• request correction of inaccurate personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing based on legitimate interests;
• receive personal data you have provided to us in a portable format, where the right to data portability applies;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
Because VPN Generator deliberately limits the collection of information that directly identifies individual users, in some circumstances we may not be able to identify information as relating to a particular individual. We will not collect additional identifying information solely for the purpose of linking otherwise non-identifiable information to a person, except where required by applicable law.
To exercise your rights, please contact us at feedback@vpngen.org.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where you believe an infringement has occurred. The supervisory authority responsible for IEDN is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, https://www.datenschutz-berlin.de).
We may update this Privacy Policy where necessary to reflect changes to VPN Generator, our data processing practices, applicable law, or regulatory requirements.
The current version of this Privacy Policy is published at https://vpngen.org/privacy and is linked from the VPN Generator Telegram bot. It indicates the date on which it was last updated.
Where changes materially affect how personal data is processed, we will take reasonable steps to inform users through the channels available to us before or when the changes take effect, where required by applicable law.
Questions about this Privacy Policy or the processing of personal data by VPN Generator may be sent to:
Institute for the Development of Public Digital Networks gGmbH (IEDN)
Zähringerstraße 11/12
10707 Berlin, Germany
Email: feedback@vpngen.org
Website: https://iedn.net/en
Last Edited: 20th October 2026