A VPN app sits between your device and the internet. While it is on, your traffic passes through servers run by the company behind the app. That makes a VPN different from most apps: you are not just trusting it with a few permissions, you are trusting it with your connection.

So the usual question, "free or paid?", is only half of the story. The more useful question is: who runs this service, how does it make money, and what has it committed to? This guide explains why that matters, what one investigation of free VPN apps found, and gives you a checklist you can use on any VPN app, including ours.

Why the owner matters

A VPN hides your traffic from your local network and internet provider, but the VPN provider itself is in a position to see a lot: when you connect, from which IP address, and, depending on the protocol and the sites you visit, the destinations of your traffic. HTTPS still protects the content of most websites, but the metadata alone can be revealing. (For the basics, see What is a VPN.)

That is why the identity of the company, the country it is based in and the laws it is subject to are part of your privacy, not a detail in the fine print.

What an investigation of free VPN apps found

On 1 April 2025 the Tech Transparency Project (TTP), a research group, published an investigation of free VPN apps in Apple's US App Store. It found that in 2024, 20 of the top 100 free VPN apps, about one in five, were owned by companies or individuals based in mainland China or Hong Kong. According to estimates from the analytics firm AppMagic cited in the report, those 20 apps had been downloaded more than 70 million times in the US.

TTP reported that none of the 20 clearly disclosed its Chinese ownership, and that several hid their structure behind offshore shell companies. Several apps traced back to a Chinese cybersecurity company that the US Defense Department had designated a "Chinese military company" and that the US Commerce Department sanctioned in June 2020. The report pointed to China's 2017 National Intelligence Law, which requires organisations to cooperate with state intelligence work, as the reason ownership matters for a service that handles your traffic.

The broader lesson is not about one country. It is that the name on a store listing can tell you very little about who actually controls an app, and a free price can make people less careful about checking.

How free VPNs are paid for

Running servers and bandwidth costs money, so every free VPN is funded somehow. Common models include:

  • Freemium: a free plan with fewer features, paid for by users who upgrade.
  • Advertising: ads shown inside the app.
  • Data: collecting and selling information about users. This is the model to avoid, and app store rules forbid it for VPNs (see below).
  • A larger company's budget: the VPN supports another product or business.

A paid plan does not automatically make a service trustworthy, and a free plan does not automatically make it dangerous. What matters is whether the business model is clear and whether the company's commitments are believable.

What the app stores require

Both major app stores have rules specific to VPN apps.

Apple. Section 5.4 of Apple's App Review Guidelines says VPN apps must use Apple's NEVPNManager framework and may only be offered by developers enrolled as an organisation. They must clearly declare what user data will be collected and how it will be used before you buy or use the service, and they "may not sell, use, or disclose to third parties any data for any purpose", a commitment that must also appear in the privacy policy.

Google. In a post on 28 January 2025, Google announced a "Verified" badge for VPN apps on Google Play. To earn it, an app must complete a Mobile Application Security Assessment (MASA) Level 2 validation, come from an organisation developer account, meet Google Play's target API level requirements, have at least 10,000 installs and 250 reviews, have been on Google Play for at least 90 days, and opt in to an independent security review and encryption in transit in its Data Safety section. The badge appears on the app's page and in search results.

These rules raise the floor, but they don't replace your own judgement. TTP's findings came from inside an official store.

A checklist for judging any VPN app

Before you install, spend five minutes on these questions:

  1. Who is the owner? Look for a real company name, a country and a physical address on the website and store listing. Be wary if you can't find out who is behind the app.
  2. How does it make money? If there is a free plan, can you see how it is funded? A clear paid tier is a good sign. No explanation at all is not.
  3. Read the privacy policy. Look for what is collected (IP addresses, connection times, device identifiers), how long it is kept, and whether it is shared. Vague wording such as "we may share data with partners" deserves caution.
  4. Check store disclosures. Compare the store's data safety or privacy labels with the privacy policy. On Google Play, look for the Verified badge on VPN apps.
  5. Look for independent checks. Has the app passed a security assessment or published an independent audit? Check the date and who did it.
  6. Review permissions. A VPN needs permission to set up a VPN connection. It rarely needs your contacts, SMS messages, precise location or microphone.
  7. Install from official sources. Use the official store or the developer's own website, and avoid modified or "premium unlocked" copies.
  8. Watch the behaviour. Aggressive ads, pressure to install other apps or unexplained battery and data use are warning signs.

Where VPNRice fits

We think you should apply the same checklist to us. For the record: VPNRice offers a Free plan alongside an optional Premium in-app purchase, and no account is needed to use the Free plan; what the apps collect is described in our privacy policy. You can find the apps on our download pages for Android and iPhone and iPad, and read our privacy policy before you decide.

Key takeaways

  • With a VPN, you are trusting the provider with your connection, so who runs it matters more than the price.
  • A 2025 investigation found that about one in five top free VPN apps in Apple's US store had undisclosed Chinese ownership.
  • Apple and Google have VPN-specific rules, including Apple's ban on selling or sharing data and Google's Verified badge.
  • Check the owner, business model, privacy policy, store disclosures, audits and permissions before installing any VPN.