ExpressVPN: VPN Fast & Secure

"ExpressVPN collects limited technical and engagement data—including country code (derived from a hashed IP address), operating system version, device language, app version, device model, and randomized identifiers such as an Installation ID or XV User ID—to measure the effectiveness of our marketing campaigns and analyze conversion attribution. This information is shared with third-party analytics platforms like AppsFlyer strictly for these marketing and attribution purposes."

Device-level identifiers and engagement data are shared with AppsFlyer and other third-party platforms for marketing attribution, which may allow cross-service profiling even if names aren't included.

"This data may also include advertising identifiers (such as IDFA or Android Advertising ID) only when you have provided explicit consent, and it is used solely to understand which channels drive app installs and subscriptions. While this data does not include your name, email, browsing activity, or precise location, it may be linked to your device or app installation for measurement purposes and can be treated as personal data under applicable privacy laws."

ExpressVPN collects advertising identifiers (IDFA, Android Ad ID) and device-level data that can be linked to a device or app installation, enabling cross-service tracking for marketing attribution purposes.

"We may change our Privacy Policy from time to time, with or without notice to you, consistent with applicable privacy laws and principles. Your continued use of the Services and/or access to the Site constitutes your acceptance of our Privacy Policy."

ExpressVPN reserves the right to change its privacy policy without notifying users, and treats continued use as acceptance of any new terms.

"We may send you limited transactional communications related to your account and transactions with us. These communications include, but are not limited to, order confirmations, renewal notifications, and price increase notices. We retain the data associated with these communications for a period of ten (10) years to ensure compliance with legal requirements and to protect our interests."

Transaction-related personal data is retained for 10 years, which is an unusually long retention period for a privacy-focused VPN service.

"ExpressVPN uses device information (including device type, operating system/language, or user agent, as well as mobile identifiers provided by Android or iOS devices) to generate statistics related to the marketing channels and advertising partners through which users learned about and signed up for ExpressVPN Apps."

Device-level data including mobile identifiers, device model, and OS details are collected for marketing analytics purposes beyond what is strictly necessary for VPN functionality.