This Privacy Policy explains how CCLL Digital Limited, a company incorporated in Hong Kong (“CCLL,” “we,” “our,” or “us”), collects, uses, and shares information when you use the Baguette VPN mobile application, our websites, and related VPN and subscription services (collectively, the “Services”).
Our Terms of Service are incorporated by reference. This policy describes what we actually process to run a WireGuard VPN. It is not a promise that we keep zero operational records.
We do not monitor, record, or store:
We do not sell a record of your browsing history, DNS queries, or traffic content, and we do not use the tunnel to build a profile of the sites you visit.
To authenticate sessions, route WireGuard peers, enforce the free-tier allowance, rate-limit abuse, and confirm Premium purchases, we process limited technical data, including:
This operational data may be held in memory, Redis, or similar caches on our servers for as long as needed for those purposes. That is not the same as a browsing or DNS log.
We may retain information longer if required by law or to defend legal claims.
Free is an ad-supported product. To use Free VPN you must allow ads (via the in-app consent form where required). If ads cannot be shown, Free connect is blocked; Premium has no in-app ads. The Google Mobile Ads SDK may collect device and advertising identifiers, coarse location derived from IP, diagnostics, and ad interaction data under Google’s policies. Where required we use Google’s User Messaging Platform for consent. You can change ad privacy options in Settings when available, and use system Limit Ad Tracking controls. Declining personalized ads may still allow non-personalized ads; declining all ads means Free is unavailable.
We use information to provide, secure, and improve the Services; register WireGuard peers; authenticate subscriptions; enforce acceptable use, rate limits, and fair-use caps; ban abusive IPs or devices; show ads on Free; comply with law; and communicate with you about the Services when you contact us. The numeric Free and Premium data, speed, and session limits are in the Terms of Service (including Premium fair use), not in this Privacy Policy.
Where GDPR or similar laws apply, we rely on: contract (providing the VPN you requested, including Free as an ad-supported service); legitimate interests (security, abuse prevention, product diagnostics when enabled); and consent (ads personalization / UMP where required). You may withdraw consent for ads personalization; Free may then use non-personalized ads or become unavailable if ads cannot be requested at all.
We do not sell your personal information and we do not sell browsing logs. We may share information with service providers who assist us (hosting, Apple or Google for in-app payments, Stripe for website payments, Google for ads on Free), when required by law or lawful process, or to protect rights, property, and safety. Hosting providers necessarily see network-level traffic to and from the VPN servers; they are not given a browsing history from us because we do not keep one.
If you visit our websites, we may use cookies or similar technologies as described in notices on those sites. You can control cookies through your browser where supported.
The VPN hop uses WireGuard. We use reasonable administrative and technical safeguards for the API and session store. No method of transmission or storage is completely secure.
You can stop using the Services at any time, delete the app, and cancel Apple subscriptions in your Apple ID settings. In the app you can hide IP addresses on screen, turn off product diagnostics, change content filters, and (where required) open ad privacy options. Depending on where you live, you may have rights to access, correct, or delete personal data we hold, or to object to certain processing. To request deletion of operational data tied to your device identifier, email contact@ccll-digital.com and include the device id shown in Settings if available (or describe your Apple account / purchase). We may need to verify the request. Hong Kong’s Personal Data (Privacy) Ordinance may also apply. We have not appointed an EU Article 27 representative; if that changes, we will say so here.
The Services are not directed at children under 13 (or the minimum age required in your jurisdiction). Do not use the Services if you are not old enough to consent where required.
We are based in Hong Kong. Servers and subprocessors may be in other countries (for example the region of the VPN exit you connect to). Your information may be processed outside your country.
We comply with lawful process we receive that validly requires us to act. We cannot produce browsing history, DNS query logs, or traffic content because we do not keep them. We may produce operational records that still exist (for example that a device identifier had an active session, region, or monthly byte totals) if legally required. Our hosting provider may separately receive requests about network-level metadata at the VPS. We do not claim that any jurisdiction cannot reach us, and we do not market “zero logs” or “cannot be compelled.”
The Services may be used to reach third-party websites and apps. Their practices are governed by their own policies. We do not guarantee that any third party will accept traffic from a VPN address.
We may update this Privacy Policy. We will post the updated policy on this page and update the effective date when we do.
Privacy and data requests: contact@ccll-digital.com
CCLL Digital Limited, Hong Kong.
The same text is bundled in the iOS app so you can read it offline, and hosted at baguettevpn.com/privacy/BaguetteVPN.html.