Privacy Policy

Effective: July 2026 · Responsible party: overflow.biz

The short version

ArxRoute is a self-hosted, on-device proxy. We do not collect, receive, transmit, or store your personal data. The app makes zero outbound network calls except the egress you configure. There is no analytics, no crash reporting, no advertising, and no account. Everything the app knows stays on your phone.

What runs on your device

• The proxy engine forwards traffic you route through it, to the egress you choose. That traffic is yours; it passes through your phone and out your chosen network or tunnel. It is not copied, logged to disk, or sent anywhere else.
• Your configuration — proxy credentials, WireGuard/OpenVPN/Tor profiles, upstream-proxy lists, the operator API token — is stored on-device in Android's EncryptedSharedPreferences (AES-256-GCM at rest, keys wrapped by the Android Keystore). It never leaves the device except when you explicitly export a backup.
• Optional statistics (bytes transferred, active-connection counts, per-egress exit-IP probes) are computed locally and shown on your dashboard. They are not transmitted off-device.

What we do not do

• No analytics or telemetry of any kind.
• No crash reporting (e.g. Firebase Crashlytics, Sentry) — the dependency tree is open and verifiable.
• No advertising or ad SDKs — and none is planned. An ad network inside a proxy app would break the trust this product is built on.
• No accounts, no sign-in, no device fingerprinting, no identifier sent to us.
• No resale or sharing of data — because we never collect it.

Operator API

The optional Operator API is an HTTP control plane that runs locally on your phone (loopback or your own LAN). Requests are authenticated with a token you generate and keep. The API lets you (or a scraper/process on your own network) control the proxy — rotate, select egress, read stats. It does not transmit any data to overflow.biz or any third party.

Permissions the app requests

Eight permissions, all standard, none "dangerous" (no location, contacts, camera, microphone, SMS, or storage access):

• INTERNET, ACCESS_NETWORK_STATE, CHANGE_NETWORK_STATE — to open sockets and bind flows to the cellular network.
• FOREGROUND_SERVICE + FOREGROUND_SERVICE_SPECIAL_USE — to keep the proxy and VPN tunnels alive in the background.
• POST_NOTIFICATIONS — for the required foreground-service notification.
• WAKE_LOCK — so the proxy keeps running with the screen off.
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS — so OEM battery killers don't freeze the proxy (optional; you grant it).

Third-party components

ArxRoute embeds open-source networking libraries that run entirely on your device: openvpn3 (MPL-2.0), the Guardian TorService (BSD, Tor), wireguard-go (MIT), and Go's standard networking libraries. None of these report to us. The openvpn3-incorporating source is published at github.com/rorph/arxroute-vpnclient.

Verify it yourself

You do not have to take this policy on faith. Run aapt dump permissions on the APK and read the open dependency list. With reproducible builds (planned), you can rebuild a bit-identical APK and confirm nothing phones home.

Children

ArxRoute is a network-engineering tool, not directed to children, and we do not knowingly collect any data from anyone.

Changes

If this policy ever changes in a way that matters, we will update this page and the version date. We will never quietly begin collecting data — the no-telemetry posture is a product feature, not a setting.

Contact

overflow.biz. For data or privacy questions, open an issue on the source repository or contact us through the app's listing.