Every browser store has hundreds of extensions with “free” in the name. Yet servers, bandwidth and development cost money every single month. If you are not paying that bill, someone else is — and it's worth knowing exactly how. What follows isn't scare tactics but the documented ways “free” pays for itself.
Way 1: selling your connection to strangers
The textbook case is the Hola extension. In 2015, researchers showed it was turning its users' devices into exit nodes for a separate paid service: strangers were going online from the addresses of people who had installed a “free VPN”. The user thought they were hiding their address — in reality they were renting it out to people they'd never met, along with the responsibility for whatever those people did with it. The scheme is alive and well today: reselling “residential” addresses is an entire market, and free apps remain its main source of raw material.
Way 2: collecting and selling your browsing history
A service your traffic flows through sees, at minimum, the addresses of the sites you open. To ad-tech that is inventory, and many privacy policies openly permit selling it — in the “we share data with partners” clause that almost nobody reads to the end.
The scale was captured well by a study from CSIRO, Australia's national research agency: of 283 Android apps with VPN permissions they examined, roughly one in five didn't encrypt traffic at all, and three out of four embedded third-party trackers. And then there's 2020, when a group of services promising “no logs” was found to have left a database of more than a terabyte exposed to the internet: addresses, connection histories, and passwords in plain text. A marketing promise and how a service is actually built are two different things.
Way 3: rewriting ads and links in your pages
To work at all, a VPN extension typically needs the permission to “read and change your data on all websites”. That permission means what it says: the extension can rewrite any page you open — insert its own ad blocks, swap out other people's ads for its own, or replace affiliate links in shops so that the commission on your purchases flows to its owner.
There's a quieter variant, too: someone buys a popular free extension from its author, audience included. The next silent auto-update turns a familiar icon into an ad platform, and from the outside it's nearly impossible to notice — browsers update extensions without asking.
Way 4: calling something a VPN that isn't one
Most “VPN extensions” are technically proxies for a single browser, and the differences don't end there:
- Only the browser is covered. Every other app — messengers, mail, banking — keeps going online exactly as before, with no protection at all.
- Site names can leak. If DNS queries bypass the proxy, the list of sites you visit is visible to your provider in the clear — even while the browser icon glows “protected”.
- The browser can betray your real address. WebRTC, the technology behind in-browser calls, can report your true address to a site right past the proxy — unless the extension has specifically taken care of it.
- There may be no encryption at all. A proxy and encryption are separate things; some “VPN extensions” simply redirect traffic without encrypting a byte.
The easiest way to know is to check for yourself: open our IP check page — it shows how the internet sees you, with protection on and off.
How to spot an honest service
None of this means every free service is malicious: paid services often run honest free tiers, where the source of money is in plain sight. The one question always worth an answer is: what does this service live on? A few signs you're looking at a tool rather than a data-collection storefront:
- a clear payment model — a subscription is the answer to “what does it live on”;
- the whole device is protected, not one program: a proper system-level tunnel;
- a privacy policy written in human language: what is collected, why, and for how long;
- no “change your data on all websites” permissions — a system tunnel doesn't need them.
Our own interest here is stated plainly: Mayak lives on subscriptions — which is exactly why we have no reason to sell your connection, your history, or ad space in your pages. What technical logs we keep and why is spelled out in our privacy policy — in normal language, no fine print.
More on the topic: how to make sure the connection is really protected rather than merely showing a badge — four checks in a minute; how obfuscation differs from encryption — “AmneziaWG vs WireGuard”.