Cute VPNSecurity
Cute VPN uses Xray with VLESS + gRPC + REALITY. This page explains how traffic is encrypted, what that means in practice and the limits of that protection.
How traffic is encrypted
When you connect, Cute VPN creates a secure channel between your device and the VPN server. All traffic passing through this channel is encrypted, so its contents cannot be read by your internet provider, administrators of public Wi-Fi networks or other intermediate nodes.
Encryption is built on the VLESS protocol over the gRPC (HTTP/2) transport with REALITY connection security — a modified TLS layer that additionally masks the handshake as an ordinary website.
As a result, the contents of your requests to websites and services are protected from interception on the path between your device and the VPN server.
What a VPN protects and what it does not
A VPN connection protects data in transit between the device and the VPN server. It is important to understand the boundaries of that protection:
- Protects: the contents of traffic on the “device — VPN server” segment, especially on public Wi-Fi;
- Does not protect: files stored on the device itself — the VPN does not encrypt them;
- Does not hide: connection metadata (the fact and time of connection, data volume), which the VPN server can see;
- Does not mean: full anonymity — your IP address is visible to the VPN server, and the sites you visit see the VPN server’s IP address.
What happens beyond the VPN server
Once traffic leaves the VPN server and travels to the destination site, its further protection depends on the site itself: if the site uses HTTPS, the data remains encrypted; if the connection is not secure, traffic on the “VPN server — site” segment may be readable.
A VPN does not replace HTTPS and does not fix vulnerabilities in the services you visit.
HTTPS and website security
The Cute VPN website uses HTTPS to protect your connection. The site’s settings and cookies are transmitted over a secure connection.
Behaviour after disconnecting
After the VPN disconnects, network behaviour depends on your Android settings. Automatic blocking of all traffic when the connection drops (a kill switch) is not claimed as an app feature.
Report a problem
If you discover a vulnerability or security problem, report it through the support contact listed in the app’s Google Play listing.