SuperVPN Free VPN Client Review

On the Google Play Store it has fairly positive reviews, and a legitimate-looking publisher: at first glance it looks like a free VPN you could trust.

But if you dig a little further, things start to get worrying.

There is no SuperSoftTech, the app’s ‘developer’ on the Google Play Store, registered in Singapore, where the developer claimed to be located. It didn’t have a website, either.

Despite a huge number of reviews on the Google Play Store, there is also almost no talk of the app elsewhere online.

Invasive logging policy

SuperVPN’s logging policy, which is set out within the service’s privacy policy, is far too sparse for our liking.

The most important section of the policy is the following:

While the VPN doesn’t monitor traffic, it does monitor IP addresses against an IP blacklist. This isn’t standard practice, or a standard part of VPN logging policies. It feels like an excuse for recording IP addresses, rather than a necessary procedure.

Also, and perhaps in an attempt to appear legitimate, the policy refers to the Data Protection Act 1998, an outdated UK law which was replaced in 2018.

Another concerning detail is a reference to where SuperVPN stores user data:

This is the kind of thing which sets off alarm bells. What data does SuperVPN collect? And why is it storing such data in the privacy-unfriendly US and UK?

You don’t need an email address or an account to use SuperVPN, so it is hard to imagine any amount of information about users being necessary to run the service.

This discrepancy is deeply suspicious. A proper privacy policy – like this one from Private Internet Access – could resolve it, but SuperVPN does not have a proper privacy policy.

Even more worrying, when you first install SuperVPN it asks for permission to access your phone and your stored files and media.

There is no reason for a VPN to request this kind of information; coupled with the privacy policy’s reference to storing data it implies SuperVPN might be collecting personal data.

Even with the best encryption, when you use a VPN you entrust your service with your personal information and data. It is really important that you can trust your VPN, and SuperVPN has done absolutely nothing to earn our trust.

SuperVPN could excel in all our other criteria (it doesn’t) and we would still not recommend it.

Its shady behaviour and vague, overreaching privacy policy are both huge red flags which should be absolute deal breakers when choosing a VPN.

Concerning links to China

SuperVPN FreeVPN Client is one of many free VPNs which look too good to be true. It isn’t even the only SuperVPN on the Google Play Store.

There is also “Super VPN – Best Free Proxy”, “SuperVPN 2018 – Secure, Unlimited VPN Proxy” and “SuperVPN Free VPN for Countries – Secure Proxy” among countless others.

From this point on we’re going to refer to SuperVPN FreeVPN Client as just SuperVPN to keep things simple – but be sure not to confuse it for any of those alternatives.

For an app that has over 50 million downloads, there is a concerning lack of information available about SuperSoftTech – the supposed developer of SuperVPN.

The privacy policy is hosted on a server in California and doesn’t even have a domain name. This and the Google Play Store listing are the extent of SuperSoftTech’s online presence.

Given the lack of transparency from SuperVPN, we weren’t surprised to find this privacy policy sparse and lacking proper detail, or even coherent English.

A Google search for the support email, goanalyticsapp@gmail.com, reveals the actual developer to be a man named Jinrong Zheng, who is also responsible for (the now removed) LinkVPN on iOS.

LinkVPN features the exact same privacy policy – complete with the same spelling mistakes – this time hosted in Germany.

Some more exploring reveals multiple addresses for Zheng, including one in Beijing, China.

This is a very opaque setup. It means we have no concrete idea which jurisdiction SuperVPN is operating out of, and which governments or companies could be trawling through your data.

There’s no denying it – SuperVPN performs very well in our speed tests, especially for a free VPN.

Since SuperVPN is only available on Android, we carried out our speed tests on mobile and are not directly comparable to the bulk of our standard 100Mbps tests. Nevertheless, the app still performs well.

We’ve also tested SuperVPN’s global connection speeds (from our office in the UK), here’s an idea of what you can expect:

• USA: 38Mbps (download) & 45Mbps (upload)
• Germany: 33Mbps (download) & 40Mbps (upload)
• Singapore: 6Mbps (download) & 10Mbps (upload)

Over long distance connections download speeds drop significantly. The two Asian server locations – Japan and Singapore – both achieved 6Mbps.

Upload speeds remained strong, though, up in the high 30Mbps range for both server locations.

We were very surprised to find that SuperVPN unblocks BBC iPlayer on its UK server. Many VPNs, including premium paid ones, struggle to do this.

The VPN’s speeds are also fast enough to stream the BBC’s video content in HD quality.

However, you can’t stream Netflix on any server. To do that, try using one of these top free Netflix VPNs to access geo-blocked Netflix content.

SuperVPN’s FAQ says nothing about torrenting but, regardless, we can’t recommend using the VPN for any P2P activity due to the absence of a proper privacy policy.

One of the few things the privacy policy does mention is servers storing data in the US and UK – two of the least privacy friendly countries in the world.

The iOS VPN app from SuperVPN’s developer, LinkVPN, has a strict no P2P rule, so we would have expected SuperVPN to block P2P traffic. However, when we tested the VPN for torrenting, we found that it worked quickly, with around a 4% speed drop.

Regardless, SuperVPN is not safe to use and therefore is not recommended for torrent activity.

Luckily, there are selected fast and secure free torrenting VPNs we recommend you use, instead.

We’ve seen some reviews on the Google Play Store which claim SuperVPN works in China, but these are highly doubtful as there is no obfuscation technology in place.

We’ve seen lots of complaints that the app doesn’t work in Iran, too.

If you’re travelling to or living in a high-censorship country, read our review of PrivateVPN, one of the best anti-censorship VPNs.

Neither the SuperVPN app, nor its Google Play Store listing, ever mention what form of encryption or VPN protocol are being used. This is a big concern.

After thorough investigation, we discovered the app uses a version of the open-source strongSwan VPN client and the IKEv2 protocol.

Running strongSwan has served SuperVPN well. The VPN passed our IP and DNS leak tests, and our encryption tests too.

However, we can’t be certain which kind of encryption is in use. Nevertheless, we can confirm SuperVPN is not just a proxy masquerading as a VPN.

If you want to keep some applications inside and others outside the VPN encrypted tunnel, SuperVPN offers ‘Smart Proxy’ – a fully functional VPN split tunneling solution.

But even with a secure tunnel, the VPN potentially has access to all your data. In other words, you are only secure if you can trust SuperVPN Free VPN Client.

Additional APKs are a privacy vulnerability

The flipside to the open-source power of strongSwan is that it has enabled SuperVPN to add in additional APKs, essentially turning the app into adware.

They aren’t just annoying – the integrated Google ads represent a privacy vulnerability and undermine one of the key purposes of a VPN, by giving the tech giant an insight into your activity.

Google’s privacy policy clearly states that it monitors your IP address and activity. Even if Google cannot identify you when the VPN is turned on, the ads appear as soon as you start the app.

Excessive permissions

There is another, even more worrying area of vulnerability: the unnecessary permissions which SuperVPN has permission to access.

As we previously mentioned, you can refuse some of the worst of these permissions and still use the app. Despite this, SuperVPN is likely gathering data from users which goes far beyond what is necessary.

The full list of permissions the app has access to is particularly disturbing. They include:

• Precise location (GPS and network-based)
• The ability to read, modify or delete files on USB storage
• Permission to view WiFi connections
• Permission to read phone status and identity
• Permission to change network connectivity
• The ability to prevent your device from sleeping

Whether or not you accept the requests for access to your phone and media, when you use the app you are giving SuperVPN access to pretty much everything on your phone, including personal information, your location, and your interests.

You are handing this information to a company with a minimal privacy policy that is written in plain text on a web page without a proper domain name.

The company has also gone to considerable effort to hide the identity and location of its operation.

Don’t expect any customer support from SuperVPN.

There is a Gmail account on its Google Play Store listing, but we received no response when we emailed it.

Within the app itself there is an FAQ, which gives some basic troubleshooting guidance, but it’s nowhere near comprehensive enough to make up for the lack of actual customer service.