Is a free VPN safe? How to tell in five minutes

A free VPN is safe when three things are true: you can see how it is paid for, its Play Store listing and privacy policy say plainly what it collects, and it asks for no permission beyond what a VPN needs. If any of the three is missing, treat it as unsafe until you find out why. The checks below take about five minutes and need nothing but the Play listing and the app's own privacy page.

Why "free" is the question, not the answer

Running a VPN costs money continuously. Servers, bandwidth, the people who keep them patched: none of that is free to the provider, so a free app is being paid for somehow. The safe versions are obvious about it: a paid tier that funds the free one, a company that sells something else and offers the VPN as a way in, or a non-profit with a stated backer. The unsafe versions are quiet about it, and the money usually comes from you in a form you did not agree to: advertising injected into pages, your browsing history sold on, or your phone's connection rented out as an exit point for other people's traffic. The post on how free VPNs make money goes through each model.

Ask that question first, because the answer decides how you should read everything else.

Minute one: the Data safety section

Every Android app on Google Play has a Data safety section, filled in by the developer. Open it and read the three headings: what data is shared with third parties, what data is collected, and whether you can request deletion.

A VPN needs very little. It has to know your device connected, and it has to route your traffic. "Location" under collected data is a warning unless the app explains why, because a VPN already learns your rough location from your IP address and has no need for the GPS. "Browsing history" or "web browsing" under shared data is the clearest single sign to stop reading and move on.

The section is self-reported, so an honest developer can be caught out by a mistake and a dishonest one can lie. It is still the quickest read you have, and a listing that says "no data collected" for a service that plainly must see your traffic is telling you something about the developer's care.

Minute two: permissions

A VPN app on Android needs exactly one special permission, the system's VPN permission, and you grant it through the "connection request" prompt the first time you connect. That prompt is not the app's own; it comes from Android, and it is the same dialog for every VPN. Beyond that, a VPN needs network access and, from Android 13 on, permission to show notifications so its running status stays visible.

It does not need your contacts, your SMS, your call log, your photos or storage, your microphone, or your precise location. A free VPN that asks for any of those is doing something other than running a VPN, and the extra permission is where that something lives. Which permissions a VPN app actually needs has the full list with reasons.

Minute three: the privacy policy

Skip the introduction and find two sentences: what is recorded about your connection, and how long it is kept. A useful policy names the specific things (connection times, the client's IP address, bandwidth totals) and gives a retention period in days. A policy that only says "we take your privacy seriously" and never lists a data item is not a policy; it is a mood.

Be suspicious of absolutes in either direction. A provider that says it keeps nothing at all is either not handling abuse complaints (someone will eventually use a free VPN to do something ugly, and the provider needs some way to respond) or is not describing its systems accurately. What you want is a short, specific list and a stated limit.

Minute four: who made it

Scroll to the developer section of the listing. There should be a website, an email address on that website's domain, and a postal address. Check that the website exists and mentions the app. A developer whose contact is a free webmail address and whose "website" is the Play listing itself has made it impossible to hold anyone responsible, which is a strange choice for a company asking to sit between you and the internet.

Look at how many other apps the same developer publishes. A studio with forty unrelated apps (a flashlight, a QR scanner, three wallpaper packs and a VPN) is usually an advertising business, and the VPN is inventory.

Minute five: what happens in the app

Install it and connect once. Three things tell you most of what you need.

Does it show you an exit IP, and where did it get it? An app that verifies its own exit address through the tunnel is showing you evidence. An app that shows nothing, or a signal-bar glyph, is asking you to trust it.

Are there ads inside the app, and do pages you visit gain ads they did not have before? Ads on the app's own screens are a funding model you can live with. New ads appearing on websites mean the VPN is rewriting the pages you load, which means it is reading them.

Does it push a subscription with a countdown timer? Pressure is not a security problem in itself, but it correlates with the rest.

If the app passes all five minutes, it is as safe as any free service can be shown to be from the outside. That is not the same as proven, and the red-flags checklist is worth keeping for the next one you consider.

What a safe free VPN still cannot do

Even a well-run free VPN does not make you anonymous, does not stop a site you are logged into from knowing who you are, and does not protect you from a phishing page. It hides your traffic from the local network and your address from the sites you visit, and the free tier usually limits where you can connect and for how long. Those limits are the honest price. See why free VPNs limit data or time for what they mean in practice.

Culvert VPN's free tier is funded by its Premium tier and shows no ads in the tunnel; it does not log the sites you visit, your DNS queries or your traffic contents, its servers see only an opaque connection id, it keeps your IP address for up to 30 days for abuse handling as described in its privacy policy, and it is on Google Play.