What an Android VPN can see while you are connected

Android’s VpnService gives a VPN app a virtual network interface. Traffic included in the app’s configuration enters that interface, is encrypted by the VPN protocol, and is sent to the selected gateway. The gateway decrypts the VPN envelope and forwards the underlying packet to its destination.

This creates two distinct visibility points: the local access network sees an encrypted connection to the VPN gateway, while the gateway processes the traffic needed to send it onward.

What the local network can normally observe

While the VPN is connected, the Wi-Fi operator or mobile carrier can typically observe:

• that the device is communicating with a VPN gateway;
• the gateway’s IP address;
• connection timing and volume; and
• information outside the tunnel, including control traffic that the app sends directly over HTTPS.

The local network does not receive the plaintext content carried inside the VPN tunnel. A VPN does not hide the fact that a network connection exists.

What the VPN gateway processes

To route an active connection, the gateway processes source and destination network addresses, protocol information, packet size, and timing. DNS queries are also visible to whichever resolver handles them.

TuxlerVPN Mobile currently configures a Tuxler-operated DNS resolver through the tunnel, with Quad9 as a fallback if the primary resolver is unavailable. The Privacy Policy explains that flow and the circumstances in which Quad9 may receive a query.

What HTTPS still protects

Most modern websites and apps use HTTPS or another form of end-to-end encryption. For those connections, the VPN gateway forwards encrypted application data and does not receive the page content, passwords, messages, or payment details in plaintext.

The gateway can still process network metadata required for delivery. Depending on the protocol and server configuration, destination information may also be inferable from IP addresses, DNS, or TLS connection metadata. Encrypted Client Hello and encrypted DNS can change parts of that picture, but deployment varies.

A VPN does not replace HTTPS. If a browser reports an invalid certificate, do not treat the VPN connection as a reason to ignore that warning.

What the Android permission does not grant

Android’s VPN permission is a network-routing permission. By itself, it does not grant access to contacts, photos, messages, microphone, camera, or another app’s private storage.

Separate Android permissions would be required for those resources. Review the current Google Play permission list and the app’s Data safety information for the installed version.

What TuxlerVPN Mobile retains

The current policy separates active-session processing from records that remain afterward:

For the full retention language, review Logging & Retention Data and the Privacy Policy. Those documents, not this summary, govern the current service.

A precise way to describe the trust boundary

When TuxlerVPN Mobile is connected, the access network’s view changes from the routed destinations to an encrypted connection with the VPN gateway. The gateway then handles the network information required to deliver the traffic. HTTPS remains responsible for end-to-end application encryption.

That is why a responsible VPN description should explain both tunnel protection and provider-side processing, without promising invisibility or anonymity.