Hotspot Shield

Is Hotspot Shield safe?

The paid version is reasonably safe; the free version trades your privacy for ads. Hotspot Shield encrypts your traffic and had its no-logs claims checked by Aon in 2023. But its App Store label admits that identifiers are used to track you, the free app carries eight ad and attribution networks, and its own Hydra protocol has never had a published security audit. We score it 62/100.

That puts it well above free VPNs with unknown owners such as X-VPN (53) and Turbo VPN (42), and well below audited paid services such as CyberGhost (79).

Who is behind Hotspot Shield?

Hotspot Shield is one of the oldest consumer VPNs and was built by AnchorFree, whose name is still on the App Store listing. The privacy policy now says it is provided by AnchorFree LLC in Boston or Pango GmbH in Stans, Switzerland, both part of Pango Group. The same notice covers Pango's other VPN apps, Betternet, VPN360 and Ultra VPN. Pango says it is backed by the investors behind Aura, the identity-protection company: WndrCo, Warburg Pincus and General Catalyst.

What does Hotspot Shield track?

More than most VPNs. Apple's privacy label has a "Data Used to Track You" section listing identifiers, which means they can be linked with data from other companies' apps and sites for ads. The label also lists precise and coarse location, purchase history, email address, product interaction and advertising data, used for analytics, personalisation and Hotspot Shield's own marketing.

For the free version, the October 2024 privacy policy names Unity Ads, ironSource, Digital Turbine, InMobi, Kochava, Mintegral, Meta and AppsFlyer. Their code runs inside the app and can collect your advertising ID, IP address and device details. The policy says none of them can see the sites you visit through the tunnel.

Google Play's data safety section tells a different story: it says the app collects no user data and shares only crash logs. That does not match the policy, so we scored privacy on the policy and the Apple label.

Does Hotspot Shield keep logs?

The VPN notice, last changed in September 2022, makes a narrow promise. Your real IP address is encrypted when you connect and deleted when the session ends, and nothing records which user visited which site. It does log how long sessions last, how much data you use, a device hash used for analytics and marketing, and the domains visited by all users, stripped of who visited them and aggregated about monthly.

In August 2023 Aon, the risk consultancy, reviewed those claims on the free and paid tiers. It looked at server logs, client behaviour and a 2022 transparency report, and browsed through a development VPN node. It found no sign that browsing could be tied to a user and no plaintext IP logging. Aon's summary is public, which is more than some rivals offer, but it states that the security of Pango's systems was outside the scope.

How secure is it?

Hotspot Shield uses its own protocol, Hydra, alongside IPSec and OpenVPN. Hydra is closed and no independent security audit of it has been published, so its encryption cannot be checked from outside. The National Vulnerability Database lists a 2018 flaw in which the app ran a local web server that exposed configuration data (CVE-2018-6460), a 2020 Windows privilege-escalation bug in versions up to 10.3.0, a 2025 host header injection flaw, and an unquoted service path in the old Windows version 6.0.3 that was only added to the database in 2026. We found no public bug bounty and no reported breach of user data.

What was the 2017 FTC complaint?

In August 2017 the Center for Democracy and Technology, a digital rights group, asked the FTC to investigate AnchorFree. It alleged that the free app injected JavaScript into pages through iframes for ads and tracking, used more than five third-party tracking libraries, and collected location data for ads, contrary to its privacy promises. These remained allegations: the FTC never announced an investigation, and under our rules an NGO complaint with no opened case does not lower the regulatory record. The policy has changed since, but the free app still runs on advertising.

Touch VPN, Pango's other free VPN

Touch VPN is a second free, ad-funded VPN from the same group. Its privacy policy, last updated on 31 October 2024, says it is provided by VPN Proxy Pro, LLC, "a Pango Group company". Like Hotspot Shield's, the policy says the sites you visit during a VPN session are not tied to you, while the free app serves ads through third-party networks. On Google Play it has more than 50 million downloads under the developer name CF Newco, Inc. Apple's label for the iPhone app lists a device ID, advertising data and performance data as used to track you, and the App Store rates it 4+. Check the developer before you install: "Touch VPN-Stable & Secure" is a different app, which the 2025 Hidden Links study grouped with another family of VPN apps. We do not score Touch VPN separately.

How to use Hotspot Shield more safely

1. Pay for it if you use it often. The paid version has no ads, which removes the third-party ad code.
2. On iPhone, refuse the "Allow apps to request to track" prompt. On Android, delete or reset your advertising ID.
3. Do not give the app location permission; it needs only your network to pick a nearby server.
4. Keep the desktop apps updated, since past flaws were in old Windows versions.
5. Do not let children install it: the policy bars anyone under 16 even though the App Store shows 4+.

How we scored it

Privacy (52) is the weakest factor because of tracking and eight ad networks in the free version, even though Aon found no browsing logs. Security (62) loses for a closed protocol with no published audit and no bug bounty. The regulatory record (86) is the strongest, with no fines or orders found.