SOURCE RECORD · D02

D02 · VPN TP

Local review-note document not proof of submission

公开摘录 · 截取原件于 2026-09-12 / Captured 2026-09-12

Project key: vpn
Original relative path: AppStore/AppReviewNotes_en.md
Captured: 2026-09-12T18:57:15+08:00
Original full-file SHA256: 96e04d5ad07d26c776e1e9ee8c55d808d90ba9e7bfccd973488b4ae25501bc3e
Evidence level: pre-existing local document; submission not verified
Build correspondence: not yet established with an Apple-received binary.
Line numbers refer to the captured original file. Gaps are explicitly marked. No source code was changed.

Original lines 1 to 39

0001  # App Review Information — Notes (English)
0002  
0003  IMPORTANT CLARIFICATION — VPN TP DOES NOT OFFER VPN FUNCTIONALITY.
0004  
0005  VPN TP is an on-device parser, editor, validator, sanitizer, and converter for user-owned network configuration text. The word “VPN” in the product name and the names of supported configuration formats describe the documents the app can inspect; they do not describe a connection service.
0006  
0007  ## Answers regarding VPN data
0008  
0009  1. What user information is the app collecting using VPN?
0010  
0011  None. The app does not establish, manage, or provide a VPN connection. It does not use NetworkExtension, NEVPNManager, NETunnelProviderManager, a Packet Tunnel Provider, a Personal VPN entitlement, or a system VPN profile. It cannot intercept, monitor, route, proxy, or log the user's device traffic, browsing history, or DNS traffic.
0012  
0013  2. For what purposes is this information collected?
0014  
0015  Not applicable because no information is collected using VPN. Configuration text, files, QR images, and subscription URLs deliberately supplied by the user are used only for the import, parsing, validation, sanitization, comparison, conversion, and storage actions they select. The app has no account system or developer-operated backend.
0016  
0017  Version 1.0.2 of the iOS/iPadOS app includes Google Mobile Ads SDK and Google User Messaging Platform solely to display and measure ads and manage privacy consent. Depending on the user's consent and App Tracking Transparency choice, Google may process IP-derived coarse location, device identifiers, advertising data, product interactions, performance data, and diagnostics. This advertising processing is unrelated to VPN functionality. Imported configurations, credentials, browsing history, and diagnostic targets/results are never provided to Google. The native macOS app does not include AdMob.
0018  
0019  There are two user-initiated direct network operations. First, under Import > Import Subscription URL, the app downloads configuration text directly from a public HTTPS URL only after the user enters it and taps Import and Group or Preview Only. That third-party provider may receive the full URL, the user's IP address, and ordinary HTTP request metadata. Second, under Tools > Network Check, the app performs a DNS lookup, TCP reachability check, or TLS certificate handshake only after the user enters a target and taps Run. Neither operation passes through a developer server, creates a tunnel, proxies or forwards device traffic, or runs in the background. Subscriptions are not refreshed automatically; downloaded content is parsed and stored only on the device.
0020  
0021  3. Is data shared with third parties, and where is it stored?
0022  
0023  The developer does not receive configuration data. Ordinary configuration metadata is stored locally in Core Data. A subscription source is stored locally with its group and nodes only as a one-way fingerprint and masked URL; the complete subscription URL is not retained. Passwords, tokens, UUIDs, private keys, PSKs, certificates, and original configuration content are stored locally in Apple Keychain. User-created backups are AES-GCM encrypted and saved only to a location selected by the user. Exports and shares occur only after an explicit user action through Apple's system UI; sharing complete credentials also requires device-owner authentication and a second confirmation. There is no developer-controlled server or cloud storage. A subscription provider selected by the user receives the direct request information described above under its own privacy policy, but neither the developer nor Google receives the subscription URL, downloaded content, or configuration credentials. On iOS/iPadOS only, Google receives the advertising-related data described above under the user's consent choices and processes it under its own terms. No data is collected or shared through VPN because the app has no VPN feature.
0024  
0025  Version 1.0.2 features keep the same boundary: subscription update history is AES-GCM encrypted on device with a random master key in Keychain, and secure QR frames contain a password-encrypted payload. The widget App Group contains aggregate configuration, source, healthy, and attention counts only, never names, endpoints, URLs, credentials, or raw content. Health scoring, smart repair, structure views, anomaly decisions, local notifications, App Shortcuts, and Finder Quick Look are processed locally. An anomaly alert can be created only after a user-triggered update and never causes a background subscription request.
0026  
0027  ## Review access
0028  
0029  No account, purchase, paid subscription, or demo login is required. Open Settings > Demo Dataset > Add Safe Samples to load 11 local examples that use only reserved example domains, documentation IP ranges, and invalid credentials. A reviewer may deliberately enter an HTTPS subscription URL they are authorized to access and tap Import and Group to save recognized nodes directly. The app then opens Library and expands that source group, showing its masked source, node count, and every node; Preview Only remains available for item selection. The app does not include, recommend, sell, or provide subscriptions, servers, public nodes, or usable routes.
0030  
0031  DNS, TCP, and TLS checks are optional diagnostics only. They do not create a proxy or forward traffic. Camera, Photos, device-owner authentication, and local notification permissions are requested only when the reviewer deliberately uses the related feature, not at first launch.
0032  
0033  Settings > About > Technical Support & Feedback opens the system mail app with `[REDACTED: contact email]` as the fixed recipient and pre-fills the app and OS versions. The app does not automatically attach configurations, credentials, or diagnostics, and a message is sent only after the user confirms it.
0034  
0035  On first iOS/iPadOS launch, the Google consent flow may appear, followed by Apple's App Tracking Transparency prompt when applicable. The app waits for the ATT result before starting the ads SDK or requesting ads. When the user permits both the applicable UMP personalization purposes and ATT, eligible requests may deliver personalized ads. If ATT or personalization consent is denied, the app can still request non-personalized, limited, or technical-delivery ads without IDFA as allowed by UMP, and no configuration feature is restricted. On an eligible cold launch, the app requests app-open inventory while its branded loading screen is visible, presents the ad before the main interface when ready, and enters the app after dismissal. If there is no fill, the network fails, or the 10-second deadline expires, the app enters its content without blocking; a late response is never presented over content already in use. Settings > Advertising & Privacy provides the Google privacy-options entry point when required; after a change, previously loaded ads are discarded and new requests use the latest choice. Debug builds use Google's official demo ad units; Release 1.0.2 uses the production units configured for VPN TP.
0036  
0037  Bundle ID: com.vpntp
0038  Apple App ID: 6806803997
0039  Support: [REDACTED: contact email]