Running a VPN costs money — bandwidth, servers, transit. A free VPN is covering that cost somehow, and the interesting question is always how. We pulled 23 free apps from both mobile stores, decompiled them, and watched what they did on the wire for a week each.

The funding models we found

  • Bundled tracking SDKs — 14 apps. The most common by far. Analytics packages that ship device identifiers and app inventories to third parties.
  • Bandwidth resale — 4 apps. Your device becomes an exit node for someone else's traffic. Two of these disclosed it, buried in the terms.
  • Ad injection — 3 apps. Rewriting page content in transit to insert or replace advertising. This requires breaking the security model you installed the app for.
  • Upsell only — 4 apps. The free tier is a limited sample of a paid product. This is the only model that is not a problem.
Several smartphones arranged on a desk
Twenty-three apps, decompiled and then watched on the wire for a week each.
Three of the 23 apps modified page content in transit. A tool that rewrites your traffic is not a privacy tool regardless of what the listing says.

The four we would still install

All four are free tiers of established paid products, which is the pattern to look for. hide.me and Proton VPN are the picks of them, and the free tier is a large part of why both sit in our top five: no ads, no speed cap, and a funding model you can account for in one sentence — the free plan is a sample of a paid product that already pays the bills.

The test we would suggest to anyone: find the company behind the app, find the paid product, and find the audit. If any of the three is missing, the free tier is the product and you are the inventory.

How we analysed them

Each app was installed on a clean test device, decompiled to inspect bundled libraries, then run for a week while we captured its traffic on a mirrored switch port. That combination matters: static analysis shows what an app can do, and traffic capture shows what it actually did.

The specific red flags

  • Permissions the app has no functional reason to request — contacts, location, installed app lists.
  • No named company anywhere in the listing or the privacy policy.
  • No paid product behind the free tier, which raises the question of what pays for the bandwidth.
  • Terms that mention sharing "idle resources" or "network capacity", which is bandwidth resale in polite language.
  • No independent audit, and no public source code.

The one test worth doing yourself

Find the company behind the app, find the paid product, and find the audit. If any of the three does not exist, the free tier is the product and you are the inventory being sold. That single check would have excluded 19 of the 23 apps we examined.

Bandwidth costs money. If nobody is paying for yours, work out who is being paid for it.