X-VPN

Is X-VPN safe?

It is safer than most free VPNs of its kind, but still a weak choice if privacy is the reason you want one. X-VPN encrypts your traffic and, unlike many rivals in app-store charts, has had its no-logs claim checked by an outside firm. Against that, the free version is paid for by four ad networks, researchers found a key hard-coded in its Android app in 2025, and the company behind it is less than two years old. We score it 53/100.

That puts it just above VPN Potato (49), the app researchers tied to it, and well below paid services such as Proton VPN (88). Our confidence is low because the audit report and the owners are not public.

Who runs X-VPN?

Every current document points to LIGHTNINGLINK NETWORKS PTE. LTD., with an address in Asia Square Tower 1 on Marina View in Singapore. The terms put disputes under Singapore law and in Singapore's courts. Singapore's company register, published as open data, shows the company was registered on 11 July 2025, although X-VPN says it has served users since 2017.

The earlier history comes from "Hidden Links", a study presented at the FOCI 2025 workshop by researchers from Arizona State University and Citizen Lab. They listed the publisher of X-VPN as Free Connected Limited, a Hong Kong company with business records. By October 2025, X-VPN's own press release described it as owned by the Singapore company. Neither register shows who the owners are, and the change of name and country has not been explained.

Is X-VPN connected to VPN Potato?

The Hidden Links authors put X-VPN and VPN Potato in one family, which they called Family C. Both Android apps used the same custom tunnelling protocol on port 53, the port normally used for DNS, carrying obfuscated data that was not real DNS. Both shipped the same hard-coded pre-shared key, in a variable with the same name, and the same anti-analysis code. Both were also open to a "blind in/on-path" attack, which lets someone on your network infer which sites you are connecting to.

The study did not analyse the encryption itself, so it does not say whether the key lets anyone decrypt traffic, as the authors showed for Turbo VPN. In its October 2025 statement X-VPN said its own tests traced the inference flaw to how Android handles network traffic, patched its Linux app, and said Android users should turn on the kill switch. The statement did not mention the hard-coded key.

A separate flaw, CVE-2026-2638, was published in June 2026. In X-VPN for macOS versions 77.0 to 77.5, a local attacker could exploit the quarantine and restore feature to corrupt privileged files. It is rated high (7.3) but needs access to the Mac.

What data does X-VPN collect?

The September 2026 privacy policy is short and specific. You can use the app without an account. If you sign up, X-VPN keeps an email address, which can be a throwaway one, a hashed password and your order history. Card details stay with Stripe or PayPal, and crypto payment is possible. The policy says it never logs your IP address, sites visited, DNS queries, the servers you use or connection times, and that aggregated performance figures are deleted within 48 hours.

The ad networks are the weak point. They run their own code inside the free app, and Apple's label confirms that location and usage data go to third-party advertising. Google Play's statement that nothing is shared does not reflect this, so we scored privacy on the broader disclosures.

Can you trust the no-logs audit?

Partly. In June 2026 X-VPN said "one of the Big Four accounting firms in Singapore" had checked its privacy policy statements under ISAE 3000, through interviews and a review of system configuration. It does not name the firm, and the report is only shown to logged-in users, so a buyer cannot read the scope or any exceptions. Surfshark keeps its Deloitte reports behind a login too, but at least names the auditor.

Its transparency report lists 16 law-enforcement requests and 64,396 copyright notices in 2025, and says no data was handed over in any year since 2017. That is the company's own count, not an outside check.

How to use X-VPN more safely

1. Use it for public Wi-Fi or a blocked site, not for banking, health or work logins.
2. On Android, turn on the kill switch, which the company recommends against the traffic inference flaw.
3. Update the macOS app past version 77.5.
4. If you pay, check which store or payment service holds the renewal. Only the first purchase has a 30-day refund, and crypto payments are not refundable.
5. Do not let children install it: the terms require users to be 18 even though the App Store shows 4+.

How we scored it

Privacy and security (both 45) are the weakest factors: ad networks in the free app, a hard-coded key found in 2025, and an audit whose report and auditor are not public. Transparency and control (52) gains from a clear policy and no required account but loses for the unexplained change of operator. The regulatory record (85) is its best factor, because no regulator has examined it.