Panabit Privacy Policy

• Updated Date: April 8, 2026

• Effective Date: April 8, 2026

• Version: V1.0

Summary

Panabit fully recognizes the importance of your personal information to you. We will process your personal information in accordance with the provisions of laws and regulations, adhering to the principles of legality, legitimacy, necessity and good faith, and adopt corresponding security measures to protect the security of your information.

To help you quickly understand the core content of this Policy, a summary is provided as follows:

I. What Information We Process

II. How We Request Permissions

The current version mainly involves the following permissions or system authorizations:

1. VPN Authorization: Used to establish a VPN tunnel;

2. Update Package Installation Authorization: Used for users to actively install updated versions;

3. Network Access and Network Status Reading: Used for service communication and connection status judgment.

We will not enable non-essential permissions by default, and will only request them from you when you trigger the relevant functions.

III. Whether We Share with Third Parties

The current version does not integrate third-party SDKs (Software Development Kits) for advertising, statistics, push notifications, maps, or payments. Under the current default deployment model, authentication services, controller services, configuration synchronization services, and update services are usually built, deployed, or operated by us ourselves, which are proprietary service nodes used by us to provide this service and generally do not constitute sharing with external third parties. For details, please see the chapter "How We Share, Transfer, and Publicly Disclose Your Personal Information" in this Policy.

IV. What Rights You Enjoy

You have the right to inquire about, copy, correct, delete, withdraw consent to, cancel your account, etc., in accordance with the law. If you cannot achieve this through product functions, you may contact us via the contact information at the end of this Policy.

Introduction

Beijing Panabit Software Co., Ltd. (hereinafter referred to as "we") provides you with services such as enterprise domain name identification, account login, configuration synchronization, VPN connection, routing settings, log viewing, and version updates through the Panabit client. This Panabit Privacy Policy (hereinafter referred to as "this Policy") is intended to inform you of how we collect, use, store, share, and protect your personal information, as well as the rights you enjoy.

Please carefully read and fully understand the content of this Policy before using this software. For clauses involving your important rights and interests, we will prompt you to pay special attention to them in bold, list, or other reasonable ways.

Your click on "Agree and Continue" or continued use of this software indicates that you have read and understood this Policy and agree to our processing of your personal information in accordance with this Policy.

1. How We Collect and Use Your Personal Information

We will process your personal information in the following scenarios in accordance with the principles of legality, legitimacy, minimal necessity, and openness and transparency.

1.1 Account Login and Identity Authentication

When you log in to Panabit, we will process the following information:

• Enterprise domain name

• Username

• Password

• Authorization code, access token, or session information in the context of single sign-on

Purposes of processing:

• Verify your identity

• Confirm the affiliated enterprise and network access configuration

• Establish login sessions and access control

1.2 Device Identification and Configuration Synchronization

To implement domain name identification, authentication configuration pull, update check, incremental configuration synchronization, and security control, we will process the following device identification information:

• ANDROID_ID for Android devices

• identifierForVendor for iOS devices

• device_uuid generated locally by the application and persisted

Purposes of processing:

• Identify terminal devices

• Associate configuration versions

• Support encryption/decryption and local caching of configuration files

• Improve service security and stability

1.3 Network Access and VPN Connection

When you use functions such as VPN connection, routing settings, and status viewing, we will process the following information:

• Local network interface name

• Local IP address

• Request time, request results, access logs

• IP address recorded by the server

Purposes of processing:

• Establish and maintain VPN tunnels

• Perform local network exclusion and routing processing

• Locate connection abnormalities and conduct troubleshooting

1.4 Application Version and Configuration Version Management

When you use the configuration synchronization or update check function, we will process the following information:

• Platform type

• Application version

• Configuration version

Purposes of processing:

• Determine whether the configuration needs to be updated

• Determine whether a new version of the application exists

• Return configurations and update results adapted to the current terminal

1.5 Local Storage Information

To improve user experience and implement necessary functions, we may save the following on your local device:

• Enterprise domain name

• Username

• Encrypted passwords

• Routing settings

• Authentication session information

• Protocol consent status

Purposes of processing:

• Implement the function of remembering login information

• Save configurations and user preferences

• Support protocol version verification and re-consent

1.6 Processing Boundaries Before Initial Consent

On the Android platform, before you click "Agree" on the pop-up window on the home page, we will only read local static resources and protocol status configurations, and will not:

• Obtain device identification information;

• Initiate business requests;

• Automatically log in;

• Display the device ID.

2. How We Request and Use System Permissions

To implement specific functions, we may need to request or use relevant system permissions or system capabilities. The current version mainly involves the following content:

2.1 VPN Authorization

Notes:

• On Android, the request is made through the system VPN authorization process;

• On iOS, the request is made through the system VPN configuration authorization process;

• We will not forcibly initiate VPN authorization before you actively connect.

2.2 Update Package Installation Authorization

2.3 Network Access, Network Status, and Foreground Service

The following permissions are mainly used to implement network connections and service operation, and usually do not require separate pop-up confirmation like VPN authorization, but will take effect in the system installation and operation mechanism.

2.4 Permissions Not Used in the Current Version

Up to the current version, Panabit has not applied for or actually used the following capabilities:

• Camera

• Microphone

• Contacts

• Album/Photo reading

• Precise location

• Short messages

• Calendar

• Bluetooth scanning

• Complete list of installed applications

If relevant permissions or capabilities are added in future versions, we will:

1. Individually inform you of the purpose before the function is triggered;

2. Update this Policy again when necessary;

3. Re-obtain your consent in accordance with the requirements of laws and regulations.

Please note:

• Non-essential permissions will not be enabled by default;

• You may refuse or withdraw relevant authorizations;

• Refusing mandatory authorizations will result in the corresponding functions being unavailable, but will not affect your ability to view the content of the Agreement.

3. How We Store Your Personal Information

3.1 Storage Location

We process and store your personal information within the territory of the People's Republic of China. The current version does not have regular business scenarios involving the transmission of personal information overseas.

3.2 Storage Period

We will retain your personal information for the shortest period necessary to achieve the purposes of processing. After the retention period expires, we will delete or anonymize your personal information in accordance with the law, unless otherwise stipulated by laws and regulations.

The retention period of locally cached information depends on:

• Whether you actively delete or log out;

• Whether the protocol version has changed;

• Whether the configuration cache has expired;

• Requirements of laws, regulations or supervision.

4. How We Share, Transfer, and Publicly Disclose Your Personal Information

4.1 Sharing

We will not sell or rent your personal information to irrelevant third parties.

Under the current default deployment model, authentication services, controller services, configuration synchronization services, and update services are usually built, deployed, or operated by us ourselves. Therefore, the aforementioned business requests are usually sent to our proprietary or controlled service nodes, which does not constitute sharing with external third parties.

If external recipients such as the following are integrated in subsequent versions or specific deployment scenarios, we will disclose them separately according to the actual situation and obtain your consent when necessary:

1. Customer-built controllers or customer-designated controller services;

2. Customer-designated or external identity providers;

3. Other external update service recipients.

The current default deployment model is explained as follows:

4.2 Description of Third-Party SDKs and Basic Components in the Current Version

The current version uses several basic open-source components or system capability plugins to implement local authentication, system capability calls, local storage, opening external links and other functions. They are mainly used as local runtime dependencies and do not constitute commercial data cooperation involving sharing personal information with their operators.

Identifiable basic components in the current code include but are not limited to:

4.3 Transfer

Unless we obtain your explicit consent, or need to transfer personal information due to statutory reasons such as merger, division, restructuring, bankruptcy, etc., we will not transfer your personal information to other companies, organizations or individuals.

4.4 Public Disclosure

Unless we obtain your separate consent, or as otherwise stipulated by laws and regulations, we will not publicly disclose your personal information.

5. How We Protect Your Personal Information

We will take reasonable and necessary technical and management measures to protect the security of your personal information, including but not limited to:

• Transmission encryption

• Encrypted storage of sensitive information

• Access permission control

• Log auditing

• Abnormal monitoring

• Regular security checks

Nevertheless, the Internet environment is not absolutely secure. Please properly keep sensitive information such as account passwords and tokens to avoid leakage.

6. Your Rights

Within the scope stipulated by laws and regulations, you have the following rights regarding your personal information:

1. Inquiry and access

2. Replication

3. Correction and supplementation

4. Deletion

5. Withdrawal of consent

6. Account cancellation

7. Obtaining explanations

8. Complaint and report

If you withdraw your authorization for the processing of necessary information or necessary permissions, it may result in the corresponding functions being unavailable, but will not affect the processing that has been carried out based on your consent before the withdrawal.

7. Policy Changes

We may revise this Policy from time to time in accordance with product function changes, legal and regulatory requirements, or business operation needs.

If there are major changes to this Policy, we will give you a prominent notice through pop-up windows, page prompts, reconfirmation of the agreement, etc. Major changes include but are not limited to:

1. Changes in the purpose, method, or type of personal information processing;

2. Changes in the objects of information sharing;

3. Major changes in the methods and procedures for you to exercise your rights;

4. Changes in the operating entity, contact information, or dispute resolution rules.

If the revised Policy requires re-obtaining your consent, we will seek your consent again in the corresponding scenarios.

8. Protection of Minors

We attach great importance to the protection of minors' personal information. If you are a minor under the age of 18, please read this Policy accompanied by your legal guardian and use this software and services with the consent of your guardian.

If you or your guardian have any questions about the protection of minors' personal information, you may contact us via the contact information at the end of this Policy.

9. Contact Us

If you have any questions, comments, or suggestions regarding this Policy, personal information protection matters, or your rights to personal information, you may contact us through the following methods:

• Company Name: Beijing Panabit Software Co., Ltd.

• Contact Email: support@panabit.com

• Contact Address: 10th Floor, Building 5, Haikai Park, Phase II of Zhongguancun Dongsheng Science Park, Haidian District, Beijing

We will process your request as soon as possible after receiving it and reply to you within the time limit stipulated by laws and regulations.

Beijing Panabit Software Co., Ltd.