A heavyweight free-mobile VPN from a Singapore entity with real strengths on paper - no account required, an unusually deep protocol lineup, a self-published transparency report, a bug-bounty program, and a claimed Big-Four ISAE 3000 no-logs attestation - and real transparency gaps underneath. The no-logs audit is the weakest trust artifact this research encountered in a while: the auditor is never named and the report is locked behind an account login, which is the opposite of third-party verification, and two 2026 independent reviews (Security.org, Cloudwards) still describe the no-logs claims as unverified. The free tier's own marketing ('Unlimited Data and Speed', 'No Forced Ads') is contradicted by an independent 500 MB desktop lockout test and by community reports of data caps and ads, and the Play data-safety section's 'No data shared with third parties' sits awkwardly beside the operator's own policy disclosing AdMob, InMobi, Chartboost and Liftoff in the free version. Community sentiment is split between censorship-bypass gratitude and churn over trial-to-paid confusion; HN barely knows the brand exists. As a disposable school-firewall escape hatch it is what users say it is; as a privacy product, its central promise is unverifiable by anyone outside the operator's own accounts.
auditcrypto accepted7 red flagsfacts verified - xvpn.io (homepage, /policy privacy policy, /pricing, /audit-center, /free-vpn, /download/vpn-android, /transparency-report, /protocol/everest), the Google Play listing (com.security.xvpn.z35kb) and the Apple App Store listing (id1250312807), the Security.org and Cloudwards reviews, the NDSS 2026 accepted-papers list plus the MVPNalyzer paper page, the Top10VPN research index and its Free VPN Investigations hub, the r/X_VPN subreddit via arctic-shift archive (post listing + three link_id comment pulls), and HN Algolia comment search all fetched live 2026-11-03. Fetch failures this session, recorded honestly: arctic-shift body-text and title-text search returned 422 on every attempt (known failure mode), so Reddit voices were gathered via subreddit post listings and link_id comment endpoints instead; reddit.com JSON endpoints returned 403 (bot wall); the first guessed NDSS paper URL returned 404 before the correct one returned 200; top10vpn.com/research/free-vpn-investigation (singular) returned 500. The websearch tool returned no results on every query all session, so source discovery relied on direct fetches and operator link graphs.
data-safety vs policy gap: Google Play listing (fetched 2026-11-03) declares 'No data shared with third parties' while the operator's own privacy policy (last updated Sep 16, 2026) discloses ad SDKs AdMob, InMobi, Chartboost and Liftoff in the free version plus Firebase diagnostics - ad networks are third parties by definition; the mismatch is exactly the free-VPN pattern watchdogs document
free-tier overclaim: 'Unlimited Data and Speed' and 'no data caps' marketing (homepage, free-vpn page, Play listing) contradicted by Security.org's hands-on 500 MB desktop lockout and by community reports of 300 MB caps and ad/time limits on the free plan
audit opacity: the ISAE 3000 no-logs audit is attributed to an unnamed Big Four firm with the full report available only after account login (Audit Center, fetched 2026-11-03); no third party can verify it without creating an operator account - Security.org and Cloudwards both declined to credit it in their 2026 reviews
+4 more red flags - expand before signing up
closed-source proprietary protocols: Everest is closed-source with the operator rationale that open-sourcing it would get it blocked, backed only by 'We promise that you are safe' (operator protocol page; Cloudwards calls the six Everest transport pages 'technical jargon'); Talaria's open-source status is claimed, not demonstrated in fetched material
operator identity instability: the current entity LIGHTNINGLINK NETWORKS PTE. LTD. (Singapore) replaced the operator still cited as 'Free Connected Ltd., Hong Kong' in Security.org's Sep 2026 FAQ and Cloudwards' Sep 2026 review - the corporate lineage between the two is not published anywhere in fetched material
inconsistent scale claims across the operator's own pages (100M / 150M / 80M users; 10,000+ servers marketed vs 62,400 in the transparency table) and a subreddit moderator who is also the operator's support channel
transparency-report DMCA volume (64,396 DMCA notices in 2025 alone) is enormous for a VPN provider and is self-published and unaudited; zero data provided is the claim, not an independently verified fact
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 2 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on X-VPN yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Overview
X-VPN homepage - live capture 2026-09-29
X-VPN is a freemium mobile-first VPN based in Singapore under LIGHTNINGLINK NETWORKS PTE. LTD., offering a no-signup free tier funded by mobile ads and used as a funnel into paid Premium. It markets itself as a censorship and network-block circumvention tool, especially on Android and iOS. Despite claims of independence and privacy, its no-logs promise lacks verifiable proof, and its operator history - previously cited as Hong Kong-based - remains inconsistently documented.
Logging & privacy
X-VPN claims a strict no-logs policy: no traffic, DNS, timestamps, or activity linked to users. It cites an ISAE 3000 (Revised) audit by an unnamed “Big Four” firm, but the full report is locked behind user login, making independent verification impossible. Security.org and Cloudwards both state the audit remains unverified, and no court test or public report exists. Jurisdiction is Singapore - a non-14-Eyes country - but the operator’s shift from Hong Kong (Free Connected Ltd.) to Singapore (LIGHTNINGLINK) lacks public documentation, raising transparency concerns. The policy discloses 48-hour retention of anonymized metrics and ad SDKs (AdMob, InMobi, Chartboost, Liftoff), contradicting Play Store claims of “no data shared with third parties.”
Pricing & the renewal trap
X-VPN pricing page - live capture 2026-09-29
The cheapest verifiable intro price is $47.99 for 12 months ($3.99/month), with a 24-month plan at $69.99 ($2.99/month). Monthly billing is $11.99. Renewal pricing is not published - only “then-current prices” apply, creating a hidden cost risk. There’s no renewal ratio or three-year total in derived_pricing due to missing renewal data. The 30-day money-back guarantee applies, but crypto payments are non-refundable. Free use requires no account, but desktop access reportedly hits a 500 MB cap (Security.org), despite “unlimited” marketing.
Features & performance
X-VPN apps / download page - live capture 2026-09-29
X-VPN supports OpenVPN, WireGuard, L2TP, V2Ray, QUIC, and proprietary protocols Everest (closed-source) and Talaria (claimed open-source, beta). It offers a kill switch, split tunneling, multihop, Tor over VPN, P2P, and streaming support. Servers are marketed as 10,000+ across 80+ countries, though the transparency report lists 62,400 servers in Q2 2026 - raising questions about count methodology. Independent tests show DNS/WebRTC leak protection but poor upload speeds and high latency. Talaria, newly launched, has reliability issues (Reddit reports of failed UDP/TCP connections), and Everest’s closed-source nature undermines trust. No self-testing has been conducted.
Ownership & track record
Owned by free-connected (Free Connected Ltd → Chengdu Zhuozhuo Technology, China), with current operations under LIGHTNINGLINK NETWORKS PTE. LTD. in Singapore. The corporate transition is not publicly documented, and editorial sources still cite Hong Kong. Red flags include: ad SDKs disclosed in policy but denied in Play Store data safety, unverifiable audit, closed-source Everest, and inflated user claims (100M-200M users). The transparency report shows 64,396 DMCA notices in 2025 with “0 data provided” - self-reported and unaudited. Community sentiment is split: praise for censorship bypass, frustration over free-tier limits and protocol instability.
Censorship resistance
X-VPN uses Everest protocol obfuscation that mimics traffic to Google, Apple, and Amazon, marketed for bypassing firewalls. Community users confirm effectiveness against school and national blocks. The 11-protocol lineup, including QUIC and Talaria, is designed for evading deep packet inspection. However, Talaria is in beta and has documented reliability issues. While it shows real-world utility in restricted networks, the lack of open-source verification for Everest and opaque infrastructure limits confidence in long-term resilience against sophisticated censorship like China’s GFW.
Verdict
X-VPN works as a disposable tool for bypassing school or workplace blocks on mobile, with zero signup and real ad-supported free access. But its no-logs claim is unverified, audit is gatekept, and ownership trail is murky - making it unsuitable for privacy-sensitive use. The free tier’s “unlimited” claims are contradicted by data caps, and desktop performance is limited. There’s no evidence X-VPN pays review sites, but its press endorsements (e.g., Top10VPN logo on homepage) aren’t backed by independent validation.
++ What holds up
Genuinely accountless free tier on mobile: 'No Sign-Up Needed', 'no registration - connect instantly without sharing personal details' (operator pages + both store listings), with 26 manually selectable free regions including 13 US cities
Deep circumvention story: 11-protocol lineup with the obfuscating Everest protocol and 'disguise technology', plus community reports of working where school/censorship blocks stop other free VPNs (r/X_VPN)
Privacy infrastructure beyond the norm for a free app: self-published transparency report (law-enforcement and DMCA requests 2017-2026 with zero data provided), bug-bounty report, RAM-only server and private-DNS pages, GDPR Art 27 representatives in the EU and UK
Payment options include CoinPayments crypto (BTC/BCH/ETH per Cloudwards) and gift cards; 30-day money-back guarantee on card/PayPal purchases
Both app stores healthy at scale: Play 4.3 (881K reviews, 50M+ installs), App Store 4.7 (627K ratings); developer replies to Play reviews within a day
-- What to watch
The headline no-logs audit cannot be checked: auditor unnamed ('one of the Big Four'), full report login-gated only, and both 2026 independent reviews reviewed before crediting it - Security.org: 'no way to know if the company is telling the truth'; Cloudwards: 'never been tested by a third-party audit or a court case'
Free-tier marketing contradicted in testing and by users: 'Unlimited Data and Speed' / 'no data caps' (operator) vs Security.org's non-refreshing 500 MB Windows lockout, Cloudwards' 500 MB desktop tier, and r/X_VPN reports of a 300 MB non-paid cap and time/ads limits
'No Forced Ads - Mobile ads are optional and non-intrusive' (free-vpn page) vs Play 'Contains ads', a Play reviewer's popup complaints, and the policy's disclosed ad SDKs (AdMob, InMobi, Chartboost, Liftoff) - Chartboost's policy link points to loopme.com, a different adtech company
Play data-safety declares 'No data shared with third parties' while the operator's own privacy policy integrates four advertising platforms and Firebase crash reporting in the free app
Proprietary closed-source core (Everest) with a 'trust us' justification; the open-source Talaria claim is operator-asserted and its source code was not locatable in fetched material
Jurisdiction history is murky: 2026 reviews still name 'Free Connected Ltd., Hong Kong' while live operator documents name LIGHTNINGLINK NETWORKS PTE. LTD., Singapore - the migration is visible only by comparing sources
Performance is middling in independent tests: 40-60% download loss, poor upload and latency (Security.org); 'shockingly bad' upload speeds and 15-minute connection hangs (Cloudwards); Talaria protocol outages reported in the operator's own subreddit (Oct 2026)
Pricing reality check
Intro price
$2.99 /mo
Refund window
30 days
Notes
Live pricing page (2026-11-03): Premium $11.99 billed monthly; $47.99 for the first 12-month plan; $69.99 for the first 24-month plan (order summary shows list prices $11.99 / $143.88 / $287.96 with a 'Save 76% - $217.97' discount line); $2.99/mo is the discounted 24-month monthly equivalent. Security.org's Sep 2026 review tabulates the same ladder: $11.99 monthly, $47.99/yr ($3.99/mo), $69.99/2yr ($2.99/mo). Renewal is at the 'then-current renewal price' per the pricing page - a renewal amount is not published.
Check the renewal price above before any multi-year plan - true-cost calculator.
Is X-VPN legit?
X-VPN is operated by free-connected. Logging claim: Privacy policy (last updated September 16, 2026): 'X-VPN is designed to not collect, store, or log any VPN traffic data or online activity' (source/destination IPs, browsing, DNS, content, servers used, timestamps); 'We do not link your account identity to any VPN traffic or online activity.' Audit Center: 'Based on the results, X-VPN does not track, collect, or store data that could identify a user or locate user activity.' - evidence class: promise only (no proof). No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - xvpn.io (homepage, /policy privacy policy, /pricing, /audit-center, /free-vpn, /download/vpn-android, /transparency-report, /protocol/everest), the Google Play listing (com.security.xvpn.z35kb) and the Apple App Store listing (id1250312807), the Security.org and Cloudwards reviews, the NDSS 2026 accepted-papers list plus the MVPNalyzer paper page, the Top10VPN research index and its Free VPN Investigations hub, the r/X_VPN subreddit via arctic-shift archive (post listing + three link_id comment pulls), and HN Algolia comment search all fetched live 2026-11-03. Fetch failures this session, recorded honestly: arctic-shift body-text and title-text search returned 422 on every attempt (known failure mode), so Reddit voices were gathered via subreddit post listings and link_id comment endpoints instead; reddit.com JSON endpoints returned 403 (bot wall); the first guessed NDSS paper URL returned 404 before the correct one returned 200; top10vpn.com/research/free-vpn-investigation (singular) returned 500. The websearch tool returned no results on every query all session, so source discovery relied on direct fetches and operator link graphs. (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
On the website
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
X-VPN homepage - live capture 2026-09-29X-VPN pricing page - live capture 2026-09-29X-VPN apps / download page - live capture 2026-09-29
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Based on our checks as of 2026-11-03: X-VPN scores 5.1/10 in our weighted review. We logged 7 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do you actually get with the free tier?
Full app access on mobile with no signup, 26 server locations, and ad-supported use. Desktop free access reportedly locks after 500 MB (Security.org) despite “unlimited” claims. No split tunneling or multihop on free plans.
What is the renewal price and real 3-year cost?
Renewal pricing is not published - only “then-current prices” apply. The `derived_pricing` shows no renewal ratio or three-year total due to missing data. The 24-month intro is $69.99; beyond that, costs are unknown.
Is the no-logs claim proven?
No. The audit is attributed to an unnamed Big Four firm, but the report is only accessible after login - unverifiable by third parties. Independent reviewers (Security.org, Cloudwards) still treat the claim as unproven.
Does it work in heavily censored countries?
Community users report success bypassing school and national firewalls, thanks to Everest’s obfuscation. However, no public testing confirms reliability in China, Iran, or Russia. Talaria’s beta status adds uncertainty.
Can you pay anonymously?
Yes. Free use requires no account. Paid plans accept BTC, BCH, and ETH via CoinPayments, with no KYC - though crypto payments are non-refundable.
What happens if X-VPN shuts down?
No public exit strategy. The transparency report shows server leases in third-party data centers. If operations cease, users lose access with no migration path. Account data (email only) would be subject to the privacy policy’s retention rules.
What’s an honest free or cheap alternative?
Proton VPN’s free tier offers verifiable no-logs (court-tested), open-source apps, and no ads - though limited to 3 countries. For low-cost privacy, Mullvad (flat €5/month, anonymous accounts) or IVPN (independent, audited) are better verified, though not free.
The meta-review: what the internet says about X-VPN
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates X-VPN. Every claim links to its source so you can verify it yourself.
What other reviewers say (2)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched 2026-11-03: SecurityScore 8.1/10. Location FAQ says 'X-VPN is located in Hong Kong... owned by Free Connected Ltd., a private company based in Hong Kong' - contradicted by the operator's own current documents naming LIGHTNINGLINK NETWORKS PTE. LTD., Singapore. Tests: free Windows account got 500 MB free premium data then locked out of all servers; mobile free more generous but ad-supported with automatic (non-choosable) server; no split tunneling in their tested apps; no multi-hop; kill switch on iOS but not mentioned on Windows; 11 'Protocol A-K' unnamed on iPad; 40-60% download-speed loss, poor upload/latency; DNS/WebRTC leak-free; Netflix (Taiwan) unblocked; torrenting OK on fastest server (~4 Mbps); crypto/gift-card payments non-refundable for the 30-day MBG; 'no way to know if the company is telling the truth without independent third-party audits'.
Fetched 2026-11-03: verdict 'a hard pass'; security graded 25/100 'Terrible'. Key findings: proprietary Everest protocol closed-source with no reliable documentation ('entirely technical jargon', six identical transport pages, 'trust us is not sufficient for an untested protocol'); WireGuard/OpenVPN/L2TP available and 'X-VPN now identifies its VPN protocols' (July 2024 fact-check update); free plan 500 MB desktop vs unlimited-with-ads mobile, fastest-server-only; privacy 50/100: 'X-VPN has never been tested by a third-party audit or a court case' plus Hong Kong location concern; 8,000+ servers in 58 countries with skepticism about inflation via VPS; connection hangs up to 15 minutes, shockingly bad upload speeds (0.49 Mbps to Melbourne), latency x15 outside the Americas; streaming bright spot 85/100 (Netflix US, Prime, Hulu work; BBC iPlayer failed); payments PayPal/card/CoinPayments (BTC, BCH, ETH)/Advcash/gift cards incl. an unexplained Starbucks gift-card suggestion. Reader comments include a 2020 refund complaint and a positive 2024 note.
What users say (8)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched 2026-11-03: the brand's own subreddit is low-traffic and operator-shaped - recent titles include operator announcements ('Introducing Talaria: X-VPN's new open-source VPN protocol'), basic-user questions ('Why is X-VPN so unknown?', 'Why do you like X-VPN?'), protocol-trouble reports ('x vpn talaria udp protocol stopped working'), school/censorship use cases, spam placeholders and removed posts. A moderator flair user (Plenty-Result-35) answers most threads as a support channel.
Fetched 2026-11-03 (7 comments pulled): skepticism about a 200-million-user claim ('you have to trust a company that they do not keep logs - not something you can compare'), a 50M+ Play-downloads counterpoint, a report of unavailability in some countries plus a 300 MB non-paid limit, and two fan endorsements ('Best VPN ever').
Fetched 2026-11-03 (4 comments): censorship-bypass praise ('extremely good at bypassing censorship, firewalls, and blocks') alongside a user announcing they left for a competing free VPN and another describing free-tier limits (not unlimited time, slower, more ads); the operator-affiliated moderator asks leavers why.
Fetched 2026-11-03 (8 comments): the flagship new open-source Talaria protocol broke in the field days after launch - UDP down, QUIC silently falling back to HTTP, TCP never connecting; the operator moderator confirms Talaria 'is still in beta' and walks the user to support. A working-protocol demonstration of the gap between the Talaria marketing (App Store: 'faster, smoother... audited and open source') and real-world reliability.
Fetched 2026-11-03: the tokenizer splits 'x-vpn' into 'x vpn'; hits are generic phrases ('X VPN connections', 'OS X VPN support', product-placement jokes) - no substantive discussion of the X-VPN service exists in the returned page. Notable absence for a brand claiming 100M+ users.
Fetched 2026-11-03: same conclusion - no HN community verdict on X-VPN; the only tangential hit of value is a 2021 Show-HN thread where the builder of a VPN-review aggregator complains that 'many VPN reviews are bought and paid for', context for why a 50M-install free VPN can stay review-invisible.
Fetched 2026-11-03: HTTP 422 on every body-search and title-search attempt this session (also 422 for title=xvpn on subreddit=VPN) - the known arctic-shift body-search failure mode; thread/link_id endpoints worked and were used instead. Recorded here so the gap in r/VPN and r/androidapps body coverage is explicit rather than hidden.
Fetched 2026-11-03: HTTP 403 - Reddit blocks this datacenter IP; arctic-shift remained the only usable Reddit channel this session.
Who is behind X-VPN?
VPN ownership is often deliberately layered through shell companies. This is what we could verify - with sources. Confidence: confirmed (checked 2026-09-29).
Generated by Qwen3 on 2026-11-03 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: X-VPN is a freemium mobile-first service with a no-account free tier that works for basic censorship bypass on phones, but its privacy claims are unverifiable and its free desktop access is severely limited. Paid plans start at $2.99/month for 24 months, but renewal pricing is undisclosed. It is not a trustworthy privacy tool for high-risk use.
The logging truth: The operator claims a strict no-logs policy, backed by an ISAE 3000 audit from an unnamed Big Four firm, but the full report is locked behind user login, making independent verification impossible. Jurisdiction is officially Singapore (LIGHTNINGLINK NETWORKS PTE. LTD.), though some sources still cite Hong Kong; the policy discloses short-term retention of anonymized metrics and ad SDKs in the free version.
Pricing reality: The $2.99/month deal applies only to a 24-month prepaid plan; monthly billing is $11.99. Renewal occurs at “then-current prices,” which are not published, creating a hidden-cost trap. The free tier is ad-supported on mobile and contradicts its “unlimited” marketing - Security.org and users report 500 MB or 300 MB desktop limits.
What reviewers say vs what users say: Reviewers are skeptical: Cloudwards calls security “terrible” due to closed-source Everest and gives it 25/100, while Security.org scores 8.1/10 but refuses to credit the audit. Users on Reddit praise censorship bypass but report broken protocols (Talaria in beta), free-tier caps, and distrust of scale claims (100M-200M users). The operator’s subreddit is low-traffic and moderated by support.
Who runs it: Officially operated by LIGHTNINGLINK NETWORKS PTE. LTD. in Singapore, though ownership traces back to Free Connected Ltd. (Hong Kong) and Chengdu Zhuozhuo Technology (China). The corporate transition is not publicly documented, and the operator’s identity remains opaque despite trust-upgrade efforts.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 10[B] B: 6[C] C: 8[D] D: 0(D stays empty until our own test phase)
The most trustworthy free VPN on structural grounds: an anarchist Seattle collective that has run since 1999, funds itself by donations, asks no account…
VPN Gate is a legitimate, transparently-run academic experiment that is genuinely free forever and genuinely useful for one thing: getting past government…
auditopen source
intro $0 /mo
Japan - web site hosted at the University of Tsukuba campus (Tennodai 1-1-1, Tsukuba, Ibaraki 305-8573), administrator Daiyuu Nobori, Ph.D., Associate Professor, University of Tsukuba; the volunteer relays themselves are distributed worldwide and 'are not placed in the campus'; aggregated log servers are owned and managed by SoftEther Corporation, the joint research partner (about_us.aspx and about_abuse.aspx fetched 2026-11-03)free vpn 10 d ago
A free, fast, one-tap encryption tool that is deliberately NOT an anonymity VPN - judge it as such. Cloudflare's own docs say the quiet part: WARP collects…
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.