Kilpi has no servers of its own: nothing about your browsing is ever sent to Stationify. Stationify does not sell, share, or use your data for advertising or any other purpose.
Kilpi is developed by Stationify Oy (Business ID 3608699-3, Helsinki, Finland). Kilpi has no account system and contains no advertising, analytics, cross-app tracking, crash-reporting or telemetry SDK.
Kilpi Shield (VPN)
Kilpi Shield uses iOS's VPN feature, but the VPN runs entirely on your device — there is no VPN server, and your traffic is not routed through Stationify.
- What it processes. While the shield is on it acts as your device's DNS resolver: it receives the name of each website or service an app looks up and checks it against the protection lists stored on your device.
- Blocked names are answered on the device ("no such domain") and never leave it.
- Other names are sent, encrypted over HTTPS (DNS-over-HTTPS), to the DNS provider you choose — Cloudflare or Quad9 — so your device can connect. That provider receives the name, your public IP address and the time of the request, and handles it under its own privacy policy. Stationify does not receive these lookups. Cloudflare commits not to sell or share resolver users' personal data or use it for advertising, and deletes its resolver logs within 25 hours; Quad9 says it does not collect or record users' IP addresses and does not share, sell or rent information that could identify you.
- What is kept on your device. A short list of recently blocked names (up to 100 entries, replaced as new blocks happen) and daily totals of blocks (counts only, no names, kept for 31 days), so you can see what was stopped. Expert mode's live activity list holds recent lookups (up to 500) in the VPN's memory only; it is never written to storage and is cleared whenever the shield stops.
- Commitment. Stationify does not collect, sell, use, or disclose to third parties any information processed by Kilpi Shield, for any purpose.
Deep inspection (optional, Expert mode)
If you turn on deep inspection, your connections also pass through Kilpi's on-device forwarder so it can apply IP-address, port and server-name rules. Kilpi then stores connection records on your device — destination names and addresses, ports, timing and data amounts — for seven days. To apply server-name rules it reads the server name an app sends when it opens a connection (in the TLS ClientHello, or in a QUIC Initial packet, whose keys are public under RFC 9001); it never installs certificates or decrypts the content of any connection. Packet capture, which you start and stop yourself, records raw network packets on your device; unencrypted content can be readable in a capture, while encrypted traffic stays encrypted. Captures leave your device only if you export them.
Encrypted DNS configuration (optional)
Separately from Kilpi Shield, you can install an iOS encrypted-DNS configuration that sends lookups to Cloudflare or Quad9 over HTTPS without a VPN. The provider receives the same information described above. iOS sets this configuration aside while a VPN, including Kilpi Shield, provides DNS.
Safari content blocker (optional)
When you enable Kilpi in Safari settings, Safari applies Kilpi's prepared rules itself. The content blocker does not report your browsing history, the pages you visit, or individual blocked requests to Kilpi.
Protection lists and optional services
Kilpi downloads the lists you enable over HTTPS from StevenBlack and Phishing.Database (hosted on GitHub) and Peter Lowe's list (pgl.yoyo.org). These hosts receive your public IP address and ordinary request information needed to deliver the download. Your browsing history and local check queries are never included.
- Custom feeds contact the HTTPS address you add; its operator receives ordinary request information.
- DNS diagnostics (Expert) sends one test lookup for example.com to your chosen provider when you run it.
- URLhaus (abuse.ch), AbuseIPDB and AlienVault OTX are contacted only if you enable them and supply your own API key (for URLhaus, your abuse.ch Auth-Key), which is sent to that service to authenticate the download. API keys are stored in the iOS Keychain.
Data kept on your device
Settings, downloaded lists, the compiled blocklist the VPN reads, custom feed addresses, your allow and block rules, block history and totals, and local check results stay on your device and are not uploaded to Stationify.
Diagnostics and sharing
A diagnostic file is created only when you ask for one. The basic file contains app and device information, list status and the VPN's status; more sensitive details (domains, timestamps, rules, connection records) are included only if you opt in. The file is compressed, not encrypted or anonymous, and leaves your device only when you choose a destination in the iOS share sheet; the recipient's policies then apply.
Retention and deletion
Downloaded lists are replaced after each successful update. Block history, daily totals and connection records expire as described above. Settings › Local data & exports › Clear local lists and diagnostic data removes downloaded lists, custom sources, API keys, your rules and allowed sites, block history and totals, connection records and saved exports. Turn off Kilpi Shield and remove the DNS configuration in Kilpi or in iOS Settings, and disable the content blocker in Safari settings. Deleting the app removes all of Kilpi's data from your device. Clearing Kilpi does not delete files you have already shared or data held by the providers you used.
Your rights
Under the GDPR and similar laws you can ask what personal data we hold about you, and have it corrected or deleted. Stationify holds none from Kilpi: it has no account system and no servers that receive your data, and everything described above stays on your device, where you control it. You can also complain to your data protection authority; in Finland that is the Data Protection Ombudsman (tietosuoja.fi).
Children
Kilpi is not designed to collect personal information from children and has no account or profiling system.
Changes and contact
We update this policy and its effective date when Kilpi's data handling changes. Privacy questions: [email protected].
Security contact: [email protected] · Reporting a security problem