Privacy Policy
1. Who we are and what this Policy covers
EvilFox is a local Windows client for protected network connectivity (proxy mode and full-protection / TUN mode, modern protocols). You add your own configurations and connection URLs. The Microsoft Store build has no in-app purchases.
This Privacy Policy explains what data may be processed when you use the App, for what purposes, how long it is kept, what rights you have, and how to contact us. We aim to meet Microsoft Store transparency expectations and the expectations of users in the United States and the European Union / EEA / United Kingdom.
In short: most data stays on your device. We do not sell personal data and do not build an advertising profile from the contents of your traffic.
2. Scope and roles
2.1. What is covered
- the EvilFox application (Windows, including MSIX / Microsoft Store);
- policy and terms pages on evilfox.win;
- support requests sent to the contacts listed below.
2.2. Roles
- EvilFox (client publisher) — controller for data the App stores and processes locally on your device to run the client.
- Server operator / configuration provider — a separate party (you or your provider). When traffic goes through servers you choose, processing on those servers is governed by their policies. EvilFox as client publisher is not necessarily the operator of those servers.
- Microsoft — if you install or update from the Microsoft Store, Microsoft’s policies apply to Store distribution, Microsoft accounts, and Store payments (where applicable).
3. What data is processed
3.1. Data on your device (local)
The App may store on your device (config files, app data folders, WebView2 localStorage and similar OS storage):
| Category | Examples | Why |
|---|---|---|
| Connection configurations | Configuration URLs, server profiles, protocol parameters you enter or import | Connecting and choosing a server |
| App settings | Theme (light/dark), language (RU/EN), proxy or full-protection mode, Kill Switch, auto best server | Remembering your preferences |
| Session technical data | Connection status, selected profile, ping, local session/traffic stats (when available) | Status and statistics UI |
| OS / WebView2 service data | WebView2 cache, on-device error logs | Stable UI operation |
3.2. Data during network use
- With servers you choose: technical parameters needed by the protocol are exchanged (addresses, keys/tokens from your configuration, tunnel control traffic). Your user traffic is processed along the path through the selected server — see Section 6.
- Update checks (non-Store builds or when you initiate a check): a request to an update feed (e.g. hosting on git.de4ima.uk) may include standard HTTP request metadata (IP address as seen by the host, User-Agent, time).
- When you open external links: the browser or OS sends data to that site/messenger under their rules.
3.3. Data you may send to support
If you contact us (email / Telegram / website), you may voluntarily provide an address, problem description, or screenshots. We use them only to respond and improve the product.
4. What we do not collect centrally
As the client publisher, EvilFox does not operate a mandatory central collection and does not sell:
- a cloud account registry of EvilFox client users for ordinary app operation;
- payment cards or in-app purchase details (the Store build has no in-app purchases; Store purchases, if any, are handled by Microsoft);
- browsing history, contacts, microphone/camera by default;
- the contents of your internet traffic for advertising or data resale.
We do not sell personal data.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR / equivalents) |
|---|---|
| Providing client features (connect, settings, UI) | Performance of a contract / user request for the client service |
| Security and stability (local logs, preventing failures) | Legitimate interests / necessity to operate the product |
| Update checks (user-initiated or build policy) | Legitimate interests / user action |
| Responding to support requests | Legitimate interests / responding to the data subject |
| Legal compliance and protecting rights | Legal obligation / legitimate interests |
6. Network traffic and third-party servers
After you connect, traffic is routed according to your configuration. The node operator may process IP addresses, session metadata, and (depending on protocol and settings) traffic contents. EvilFox does not control every third-party server’s privacy practice.
Recommendation: use only trusted configurations; read your server provider’s privacy policy and terms.
Full-protection (TUN) mode and Kill Switch: these features change on-device network routing to protect the connection and reduce leaks if the tunnel drops. They operate locally on your system.
7. App updates
- Microsoft Store: updates are normally delivered by the Store; in-app self-update in the MSIX build is disabled or limited.
- Other channels (sideload): when you choose, the client may fetch an update manifest from a publisher URL (including on git.de4ima.uk). The hosting server may see IP and technical request headers.
8. External links and third-party services
The App may open, after you choose to click:
- https://evilfox.win/ — publisher website;
- https://t.me/evilfox100Bot — Telegram support (Telegram’s policies apply).
The device also uses OS components and Microsoft Edge WebView2 — Microsoft’s policies apply to those components.
9. Retention, deletion, and security
9.1. Retention
Local data remains while you use the App, or until you delete profiles, clear app data, or uninstall EvilFox. Support correspondence is kept as long as needed to resolve the request (typically no longer than needed for the conversation and basic support records).
9.2. How to delete data
- delete configurations/profiles in the App;
- uninstall EvilFox in Windows;
- if needed, manually clear remaining app data folders.
There is no central EvilFox cloud account for restoring local profiles — we cannot restore device-deleted data from our servers.
9.3. Security
We apply reasonable organizational and technical measures within the client and OS. No method is perfectly secure. You are responsible for keeping configuration URLs/keys confidential on the device and for physical access to the computer.
10. Transfers and international aspects
The client runs locally. Data may be processed in other countries when:
- you connect to servers abroad (via your configuration);
- you open foreign websites/services;
- an update request is handled by hosting infrastructure outside your country.
For users in the EU/EEA/UK: such transfers result from your choice of configuration and services. Where required, server operators should provide appropriate safeguards (e.g. Standard Contractual Clauses) — ask your configuration provider.
11. Your rights (EU / GDPR and equivalents)
Depending on applicable law, you may have rights to:
- access and obtain a copy of data;
- rectify inaccurate data;
- erasure (“right to be forgotten”) — including by uninstalling and clearing local data;
- restriction of processing and objection to processing based on legitimate interests;
- data portability — to the extent data is stored in a structured form on the device (export configurations if available);
- lodge a complaint with a supervisory authority where you live or work in the EU/EEA/UK.
Because most processing is on-device, most rights are exercised locally. For questions about this Policy, contact us below. We will respond within a reasonable time.
12. California (CCPA/CPRA) and US users
We do not sell and do not “share” personal information for cross-context behavioral advertising under CCPA/CPRA. Categories of data are described in Section 3. Sources are mainly you (configuration input) and the device. We do not use sensitive personal information to infer consumer characteristics for advertising.
Rights to know, delete, and correct regarding local client data are exercised on the device (uninstall / clear data). Requests related to support correspondence can be sent via Section 16.
We do not discriminate against you for exercising privacy rights.
13. Children
The App is not directed to children under 13. In the EU/EEA, where local law sets a higher digital consent age (often up to 16), do not use the App below that age without parental/guardian consent where required. We do not knowingly collect children’s data centrally. If you believe a child sent us data via support, contact us — we will delete the request where appropriate.
14. Microsoft Store
When distributed through the Microsoft Store, Microsoft may process install, update, review, and (for paid products) payment data under its own policies. Capabilities such as runFullTrust / classic desktop may require Store disclosure and approval of restricted capabilities.
15. Changes to this Policy
We may update this Policy. The current version is published on the website (this page) and/or in the App Help section. Material changes are reflected by the date at the top where practical. Continued use of the App after an update means you have an opportunity to review the new text.
16. Contact
EvilFox
Website: https://evilfox.win/
Primary email: animegold3@gmail.com
Backup email: admin@evilfox.win
Telegram: https://t.me/evilfox100Bot
Terms of Use: terms-en.html