Many of the most downloaded free VPN apps are run by companies that do not say who ultimately owns them. Investigators at the Tech Transparency Project traced 20 of the top 100 free VPN apps in Apple’s US App Store in 2024 to undisclosed Chinese owners, and a 2025 academic study linked supposedly separate Android VPN brands with more than 700 million downloads to shared code and servers. Ownership matters because a VPN operator can see all the traffic it carries, so the company behind the app is the entity you are trusting.
Why VPN ownership matters more than for most apps
A VPN app routes your entire connection through servers its operator controls. That operator can, in principle, see which sites and services you reach, when, and from which IP address. A no-logs promise is only as good as the company making it, and the legal system that company answers to.
That is why hidden ownership is a red flag even before any wrongdoing is proven. If a developer goes to the trouble of disguising its parent company, users lose the one piece of information they need to judge the risk. The researchers behind the 2025 “Hidden Links” study made the same point: they treated concealed relationships between VPN brands as an indirect sign of deceptive behavior, and then went looking for security flaws (Mixon-Baca et al., 2025).
What the 2025 Tech Transparency Project investigation found
In April 2025 the Tech Transparency Project (TTP), a US watchdog research group, reported that one in five of the top 100 free VPN apps in Apple’s US App Store during 2024 had Chinese ownership that was not clearly disclosed. TTP pieced the links together from corporate filings in Singapore, Hong Kong, the Cayman Islands and mainland China. According to AppMagic download estimates cited by TTP, those 20 apps had been downloaded more than 70 million times in the US (TTP, 2025).
The main thread ran through a Singapore company, Innovative Connecting Pte. Ltd., listed developer of Turbo VPN. Singapore records show its sole shareholder is Lemon Seed Technology Ltd. in the Cayman Islands. Qihoo 360, a Chinese cybersecurity company, stated in a 2019 annual report filed in Shanghai that it had acquired Lemon Seed and two related firms, Lemon Clove and Autumn Breeze. The US Commerce Department added Qihoo 360 to its Entity List in June 2020. Qihoo’s 2020 annual report says it sold an unnamed “Project L” to outside parties; TTP argues this appears to cover those companies but found evidence suggesting the connection persists. Qihoo did not respond to TTP.
Other apps led elsewhere. X-VPN listed a Hong Kong developer, Free Connected Limited, whose annual filings, TTP reported, show it is owned by Chengdu Zhuozhuo Technology in mainland China. VPNIFY’s developer, a Hong Kong company, listed a mainland Chinese citizen as its sole shareholder on a 2024 incorporation form.
What happened after publication
When TTP checked again in May 2025, Apple had removed three Qihoo-linked apps (Thunder VPN, Snap VPN and Signal Secure VPN). But 13 Chinese-owned VPNs from the report were still in Apple’s US store, and 11 were still on Google Play, including Turbo VPN and VPN Proxy Master on both. One developer, Autumn Breeze, told TTP it operates independently and has no affiliation with Qihoo 360 (TTP, 2025).
Documented ownership links in popular VPN apps
Each ownership link listed here is documented by a cited source. A listing does not mean an app is currently malicious, and some companies dispute the findings.
| App or brand | Listed developer | Ownership link documented | Source |
|---|---|---|---|
| Turbo VPN | Innovative Connecting Pte. Ltd. (Singapore) | Sole shareholder Lemon Seed Technology (Cayman), which Qihoo 360 reported acquiring in 2019 | TTP, 2025 |
| VPN Proxy Master | Lemon Clove (per Google Play) | Part of the same Innovative Connecting network; shares servers and credentials with Turbo VPN | Mixon-Baca et al., 2025 |
| Snap VPN | Autumn Breeze Pte. Ltd. | Linked to Qihoo 360 by TTP; developer denies any affiliation | TTP, 2025 |
| X-VPN | Free Connected Limited (Hong Kong) | Hong Kong filings show owner Chengdu Zhuozhuo Technology | TTP, 2025 |
| Ostrich VPN | GeWare Technology Limited (Hong Kong, dissolved) | Sole shareholder was a Chinese citizen with a mainland address | TTP, 2025 |
| Luna VPN, Free and Unlimited VPN | Not disclosed as Sensor Tower | Owned by analytics firm Sensor Tower, which used the apps to gather usage data | TechCrunch, 2020 |
| Onavo Protect | Onavo Inc. | Meta subsidiary; Australian court found users were misled about how data was used | TechCrunch, 2023 |
Hidden families of VPN apps
The “Hidden Links” paper, presented at the FOCI 2025 workshop by researchers from Arizona State University and the Citizen Lab, started from the 100 most downloaded VPN apps, filtered to 50 non-US providers and analyzed 21 apps from 13 providers. Together those apps had more than 972 million Google Play downloads (Mixon-Baca et al., 2025).
The team clustered the apps into three families:
- Family A: Innovative Connecting, Autumn Breeze and Lemon Clove, operating eight apps including Turbo VPN, VPN Proxy Master and Snap VPN.
- Family B: five providers including MATRIX MOBILE (XY VPN, Global VPN) and ForeRaya (Super Z VPN), whose privacy policies referenced Innovative Connecting.
- Family C: Fast Potato and Free Connected Limited, the X-VPN developer.
The shared ownership came with shared weaknesses. In two families, apps contained hard-coded Shadowsocks passwords, meaning anyone who extracted the password could decrypt the traffic of every user of those apps. Family A apps used a deprecated cipher, and the researchers observed them sending users’ approximate location (a ZIP code derived from their IP address) to a Firebase endpoint even though their privacy policies said they did not collect addresses. In business records, 10 of the 13 providers listed addresses in China while presenting as Singapore-based.
Consolidation among paid brands is mostly public
Concentration is also common among mainstream paid VPNs, but there it is usually disclosed:
- Kape Technologies bought CyberGhost in 2017 for $10.3 million and ZenMate in 2018 for $5.6 million (Calcalist, 2019), then Private Internet Access’s parent at an enterprise value of about $127.6 million in 2019. In September 2021 it agreed to buy ExpressVPN for about $936 million (Kape RNS, 2021). Its largest shareholder, Unikmind, took the company private in 2023 (TheBusinessDesk, 2023).
- Nord Security and Surfshark announced a merger in February 2022, saying both would keep operating autonomously (PR Newswire, 2022).
- Pango Group, whose brands include Hotspot Shield, Betternet, Touch VPN, VPN 360 and Ultra VPN, split from Aura in September 2024 (Aura, 2024) and merged with TotalAV maker Total Security in December 2024 under the name Point Wild (Willkie, 2024).
- Ziff Davis, a publicly listed media company, names IPVanish in its cybersecurity segment (Ziff Davis 10-K, 2026).
Disclosed consolidation is a different issue from concealment, but it still matters, because several “competing” brands may share one owner’s policies, infrastructure and legal obligations.
What the app stores check, and what they do not
Apple requires VPN apps to be offered by developers enrolled as an organization, and bars them from selling, using or disclosing user data to third parties (Apple, 2026). Google requires organization accounts to supply a D-U-N-S number, which it uses to verify identity (Google, 2026).
Neither rule requires a developer to name its ultimate parent company. A Singapore or Hong Kong subsidiary satisfies the paperwork. Store security badges have a similar limit, because a security audit checks code and not who owns the company. An app listed as vpnify was among those holding a valid independent security assessment certificate in 2023 (BleepingComputer, 2023), while TTP later reported that VPNIFY’s developer was solely owned by a mainland Chinese citizen.
How to check who runs a VPN app
- Look past the developer name. On the store listing, open the developer page and the linked privacy policy. A generic company name with an address in another jurisdiction is worth a closer look.
- Search the company registry. OpenCorporates, Singapore’s ACRA and Hong Kong’s Companies Registry let you look up shareholders; the Hidden Links researchers relied on OpenCorporates.
- Check for sibling apps. If one developer publishes many near-identical VPNs, or a privacy policy names a different company, treat that as a warning sign.
- Prefer providers that name their owners and publish audits. Disclosure does not guarantee safety, but concealment removes your ability to judge.
- Be wary of “free forever.” Running servers costs money, so if there is no subscription, ask how the app pays for itself.
Methodology and limitations
Sources are primary investigations (TTP’s two 2025 reports), a peer-reviewed workshop paper (FOCI 2025), company announcements and regulatory filings (Kape RNS, Ziff Davis 10-K, press releases from Nord Security, Surfshark, Aura and law firm Willkie), and reporting on enforcement actions. Rankings and ownership lists compiled by VPN review sites are excluded.
The limits are significant. Corporate records show ownership at a point in time, and several companies named here have changed hands or deny the links described. App availability changes constantly, so an app removed in 2025 may return under a new developer name. Download figures come from third-party estimators (AppMagic) and Google Play’s install ranges and are not audited numbers. Finally, documented ownership does not prove that a given app shares data with any government. It shows legal exposure and concealment, which are risks in their own right.