The app store will happily hand you a VPN that spies on you. These five checks take two minutes and catch almost every trap: publisher, audits, logging evidence, limits and download source.
A VPN sits between you and the entire internet. It can see every site you visit - which means choosing one is a trust decision, not a feature decision. Trap VPNs win installs with the words free, unlimited and fast and hide the cost in permissions and policy text. The good news: a safe free VPN leaves evidence lying around in public - a real company, audit reports, open-source code, and honestly printed limits. This page is the checklist, in the order a technician runs it.
Open the app listing and find the publisher name, then search for that company's own website. A real provider has one: with a plans page, a support channel, a privacy policy with a company name and country, and usually a paid product. Proton is a Swiss company built around Proton Mail; Windscribe is a named Canadian company selling a Pro plan. A trap app typically has a generic developer name, a free website builder page or no site at all, and an email address as its only identity. If you cannot find who runs it, do not route your life through it.
Claims are cheap; audits are not. Trustworthy providers pay independent security firms to examine their apps and publish the results, and several - including Proton - make their apps open source, so any researcher can read the code. A trap app offers neither: closed code, no audit, and a privacy policy written to permit exactly the behaviour the marketing denies. When a provider says its no-logs policy is audited, that single word separates evidence from advertising. Look for it, by name, on the provider's own site.
You do not need to read the whole privacy policy. Search it for log, share and third party. A safe policy says activity is not logged and data is not sold, and then explains the minimum technical data it does keep, such as the email you signed up with. A trap policy is full of phrases like we may collect usage data to improve our services and share with our partners. Also check where the company is based: privacy-respecting jurisdictions exist, but treat jurisdiction as a supporting detail - an audit beats a flag every time.
This feels backwards, so read it carefully: clear limits mean a real business. Windscribe printing 10 GB per month and 10 countries on its own store listing, and Proton printing one device and automatic server selection on its plan page, are signs of model-one funding - subscribers pay, free users get a defined slice. The trap is the opposite pattern: unlimited data, all countries, no account, no paid plan, no company. Unlimited everything from nobody is not a deal; it is a data-collection operation with a VPN icon.
Even a safe VPN becomes unsafe from the wrong source. Download the Windows app only from the provider's official website, and the Android app only from the official Play Store listing under the provider's name. APK download sites and mod sites repackage popular free apps with extra trackers or worse, and a VPN's deep system access makes a tampered copy especially dangerous. After installing, open Settings and turn on the kill switch and, on Android, the always-on VPN option - that is the setup step that keeps a dropped connection from leaking your real traffic.
The free VPNs from this guide are shown and set up live in the video - watch it before you install anything.
▶️ Watch Full VideoA VPN app legitimately needs network access to create the tunnel. It does not need your contacts, SMS, call log or precise location to work. Permission greed is a trap signature - deny anything unrelated, and prefer providers whose apps ask for the minimum.
No. Store text is written by the developer. Proof looks like published independent audits, open-source apps and a real company with a paid business to lose. Proton, for example, points to audits and open-source code on its own site - that checkable evidence is what you are looking for.
Not necessarily. Download counts measure marketing, not honesty - data-harvesting free VPNs have reached millions of installs before being exposed. Run the five checks anyway; they take two minutes and do not care how popular the app is.