How to Recognise a Risky VPN App

A VPN works at system level: it receives the traffic of every program on the device, including the ones running in the background without your knowledge. An ordinary app can leak what it collected itself; a VPN can leak everything you do on that device. The bar for choosing one has to be far higher.

“Nothing happened” is not evidence of safety. Logging, reporting and injection happen on the server or in the background where the user feels nothing; the consequences often arrive months later and cannot be traced to a specific app.

• Unknown origin: the installer arrives through a chat group, a file-sharing link or a QR code, with no official site or store page. A legitimate client comes from an app store, the developer’s site, or a release page whose signature can be checked.
• It asks you to install a root certificate: “trust this certificate”, “install this profile”, trust a CA. With a root certificate installed it can decrypt all your HTTPS traffic, banking and email included. A normal VPN never needs this.
• Excessive permissions: a VPN that wants contacts, SMS, call logs, precise location or your photo library. A VPN needs only the permission to build a tunnel.
• Identity checks: registration requires an ID card, a face scan or a Chinese phone number. That is exactly how a “compliant” VPN ties your identity to your traffic records; a legitimate service needs an email address.
• Proprietary protocol and a closed client: usable only through its own app, with no support for any standard protocol (AnyConnect, OpenVPN, WireGuard, sing-box), so you cannot verify with an open-source client what it actually sends.
• Free with no visible income: no paid tier, no ads, no business customers, yet running for years. Mainland exit bandwidth is metered; a service that charges nothing collects elsewhere.
• No company, no support, no history: no operating entity to be found, nobody to contact, a domain registered less than a year ago, frequent renames.
• Abnormal background traffic: the device keeps uploading while idle, battery and data drain fast. It may be using your device as someone else’s exit, or syncing your data.
• Marketing that stresses “official”, “registered” and “legal and compliant” while implying everything else is illegal: the classic pitch of the regulatory-backed apps, whose compliance consists of logging and reporting.
• Store ratings that are uniformly glowing, reviews that read alike, and download counts out of proportion to review counts: bought.

1. Check the protocol: does the site say which protocols it uses and whether third-party clients work? A service reachable with OpenVPN, AnyConnect, sing-box or Tailscale lets you capture and inspect what is sent.
2. Check permissions: after installing, open the system settings, revoke everything except the VPN permission, and see whether it still works. If not, uninstall.
3. Check certificates: iOS Settings → General → VPN & Device Management; Android Settings → Security → Encryption & credentials → Trusted credentials → User; Windows certificate manager → Trusted Root Certification Authorities. Anything it installed: delete it and uninstall the app.
4. Check for leaks: while connected, open a DNS-leak test and an IPv6 test page to confirm resolution and addresses go through its servers; then open an HTTPS site and confirm the certificate issuer is the site’s real CA.
5. Check the operator: does the site name a company or team, say how long it has operated and where support is; is there a refund policy; does the privacy policy state specifically what is logged?

1. Uninstall it, then check the locations above and remove any certificate or profile it installed.
2. Change passwords — banking, email, everyday accounts — especially any you logged into while using it.
3. On accounts with two-factor authentication, review the login history and remove unfamiliar devices.
4. If it went on a router, factory-reset and reflash official or verifiable firmware.

RoyalShield does not ship its own app: clients come only from the official upstreams — Cisco, OpenVPN, sing-box/Hiddify, Tailscale — mirrored unmodified, and you can replace our download with the official or open-source build at any time. Every protocol is standard and can be inspected with a packet capture.

Registration needs an email address only — no phone number, no ID. What we log is on the About page: email, plan, expiry, and the duration and volume of each connection, for billing; no content, no ad injection, no data sales.

No certificates, no contacts, no location. If a client claiming to be ours ever asks you to install a root certificate, it is not ours.