NITRONET
Get the app
Menu
Get the app

Security

What the tunnel protects — and what it does not.

Encryption is only useful if you know its boundaries. This page describes the cryptography, the DNS path, the leak behaviour, and the limitations of version 1.

Transport and cryptography

Nitronet uses a custom transport designed to resemble ordinary DNS traffic. Inside it, your traffic is protected with modern, well-established VPN encryption: vetted primitives and a proven handshake, not a home-grown cipher.

Our services and this website use encrypted connections. The app does not accept cleartext connections.

One limitation you should know

In version 1, connection control messages are authenticated but not encrypted. An observer on the network path may see pseudonymous device IDs, public keys, assigned addresses, and connection IDs. Your internet traffic inside the tunnel remains encrypted. We do not claim that every byte on the wire is encrypted, and our Play Data Safety answers reflect this limitation.

DNS

DNS is resolved by a resolver that is bound only to the tunnel and is not reachable from the public internet. It forwards queries to upstream providers over an encrypted connection. The upstream provider sees the resolver's server IP, not your device IP.

Nitronet does not log DNS query names. The upstream resolver's own retention policy applies to queries it receives.

IP and DNS leak behaviour

Nitronet routes IP traffic and DNS through the tunnel, so a lookup cannot escape on another address family. If the tunnel drops, traffic fails closed where Android allows it, instead of falling back to the local network.

Some situations can weaken leak protection: tethering, apps that bind to another network, rooted devices, and aggressive OEM battery optimisers. For the strongest setup, enable Android's always-on VPN andlockdown for Nitronet.

What we log

We do not log browsing history, DNS query names, destination IPs or domains, or packet payloads. We keep limited connection metadata — device public keys and ID, lease details, client IP and network port for routing, short-lived request logs, and aggregate counters — for the periods listed in the Privacy Policy.

Ads and the VPN path

Ads are served by Google AdMob and sit outside the VPN packet path. They are never injected into websites, other apps, or your traffic. The app excludes its own ad and control traffic from the tunnel so ads never consume it.

On Android, the ads SDK shares the app process with the VPN service. We do not claim process isolation, and no ad data is sent to Nitronet's servers.

Responsible disclosure

If you find a vulnerability, email hello@nitronet.app. We aim to acknowledge within three business days and will agree a disclosure timeline with you. Please give us a reasonable period — typically 90 days — before publishing details.

Please do not access other users' data, disrupt the service, or run automated scans that degrade it. We currently do not operate a paid bug bounty, and we will not ask you to pay to report an issue.

The honest limits

  • A VPN is not anonymity. Sites you log into still know who you are.
  • A VPN does not protect a compromised device, malicious extensions, or malware you install.
  • Server-side compromise is always a risk in any VPN. We harden and isolate servers, but no service can promise perfect security.
  • Availability can be affected by network restrictions, capacity, and events outside our control.

Contact

hello@nitronet.app for vulnerabilities and everything else. See also the Privacy Policy andTerms of Use.