SuperVPN Free VPN Client is a hugely popular free VPN app for Android. Its Google Play page reports between 50 and 100 million installs, and as we write it has a 4.2 rating from more than half a million users.
You can install and use the app for free, and there are no restrictions for the first 20 days (although you will see lots of ads). After that, VPN sessions are automatically disconnected after 60 minutes. You can start a new session with a tap.
The free service limits your locations to France, Germany, Canada and the US. Upgrading to the VPN account gets you servers in Japan and England, too.
- Want to try SuperVPN Free VPN Client? Download it here
Buying the service is more difficult than we expected, as you can't do it directly from the SuperVPN app. Instead you must install a separate Payment Tool just to see the prices.
Prices seem relatively high at $5 (£4) for a month, $4.33 (£4) if you pay for a year upfront. That's a lot to cover a single mobile. The Private Internet Access annual plan costs only $3.33 (£2.50) a month for an excellent service which you can install on all your devices.
Free VPN apps aren't generally a good choice for privacy as there's usually little data on who runs them, or what they might be doing with your information. Would SuperVPN Free VPN Client be different, we wondered? Let's see.
The app has a developer (SuperSoftTech) that doesn't appear to have a website, and isn't mentioned anywhere except in reference to this app. That's a common trick, presumably an attempt to hide the real identity of the developer, but if a VPN wants to earn trust then it needs to be more open, honest and transparent.
In this case, at least, the developer isn't difficult to find. SuperVPN's contact email address is listed as goanalyticsapp.gmail.com, which a quick Google check tells us belongs to Jinrong Zheng, the developer responsible for LinkVPN and several other apps. A little more searching finds a page about the app, with the goanalyticsapp.gmail.com email, and an address in Beijing.
The first is the closest the document gets to a logging policy:
"We do not monitor your traffic. The only thing we monitor if the IPs you are using to enter our servers are not blacklisted in respected Black lists databases, like spamhaus.org."
That leaves plenty of scope for session logging – incoming and outgoing IP addresses, connection times, locations, device ID, bandwidth used – although if you've not handed over any personal details, these won't easily be linked back to you.
After trying to reassure users that the service isn't collecting information on them, the document spoils it a little with this paragraph:
"Where we keep your information – We keep all information on highly secured servers based in United Kingdom and USA. All Information might be transferred to other servers we could use and we will take reasonably care with these possible transfers."
So, despite the lack of logging, the developer has enough information on you to justify explaining where it's all stored? Doesn't make much sense to us.
An alternative interpretation might be that this clause was thrown in to make it look like SuperVPN is UK or US-based, and so a little more appealing to the average European and North American user. Whether that's true or not, there's nothing here that makes the app appear more trustworthy.
The small print aside, we've seen others posting concerns about SuperVPN.
In 2016 Australian researchers CSIRO found that SuperVPN was flagged as malware by 13 engines at VirusTotal, the third highest score out of a field of 234. They were mostly classing it as adware-like rather than anything truly dangerous, and that still means most engines thought it was safe (and as we write its VirusTotal score is zero), but this indicates the app may be doing things differently to many other VPNs.
A 2016 Vulners.com report listed many other SuperVPN vulnerabilities and problems. We have no idea if the report was accurate, and the vulnerabilities may have been fixed in the meantime, anyway, but this is still a concern.
The final issue for us is the app permissions. It needs access to Device & App History, Identity, Location, Photos/Media/Files, Wi-Fi Connection Information and Device ID and Call Information. That covers the rights to see installed apps, browsing history, profile data and your file system. We're struggling to think of a good reason to hand over any of this.
- We’ve rounded up the best free VPN services of 2018
SuperVPN's lengthy permissions list makes it a little scary to install, but it's our job to take these risks, so we tapped the Install button and the app was ready to go in seconds.
We couldn't miss the ads. The app opened with a full-screen example. We cleared it, and another appeared. We tapped Continue and were taken to the main app screen, which had an embedded ad. We clicked Connect > Cancel and encountered two further full-screen pop-ups: one showed an app on Google Play, the other was a browser window. We closed those, too.
Look in between the ads and you'll find a very simple VPN client. A Connect button gets you a connection to the nearest location (France, Germany, Canada, US), or a menu enables selecting it manually, and one tap disconnects you when you're done. There's nothing else to learn, and not an option or configuration setting in sight.
The underlying technology seems to be much the same as most other VPN apps. SuperVPN adds a standard VPN connection to the Settings > Wireless & networks > VPN list, and calls it up on demand.
We chose France, clicked Connect, and cleared another full-screen ad. The display had started a 60-day countdown, although we're unsure why. Perhaps you now get a 60-day trial, rather than a 20-day affair.
Our speed tests* showed UK to France connections delivering 18-22Mbps, Germany around 12Mbps, the US reaching 9Mbps and Canada struggling to 8Mbps. That's nothing special, but it's what you might expect from a free service, and is enough for basic browsing and streaming on the move.
SuperVPN's site unblocking abilities were also no more than average. It got us access to YouTube and Comedy Central, but Netflix detected an ‘unblocker’ and refused to play.
Whatever we might think about its other issues, SuperVPN delivered on our final leak tests. We used ipleak.net, doileak.com and other sites to analyze our connection, and they couldn't find any giveaway leaks or clues to our real identity.
*Our testing included evaluating general performance (browsing, streaming video). We also used speedtest.net to measure latency, upload and download speeds, and then tested immediately again with the VPN turned off, to check for any difference (over several rounds of testing). We then compared these results to other VPN services we've reviewed. Of course, do note that VPN performance is difficult to measure as there are so many variables.