Is Urban VPN safe? For anything you want kept private, no. Urban VPN is a free, peer-to-peer VPN and browser extension from Urban Cyber Security, and it routes other people's traffic through your device while sharing your browsing data with its corporate family. The desktop app is not a virus, but the Urban VPN Proxy extension secretly captured AI chatbot conversations in 2025, which is spyware behavior. The service is free, but you pay with your data.
Is Urban VPN Safe? The Short Answer
Urban VPN (also written UrbanVPN) fails on data practices, not on the tunnel itself, and the checks below show where that line falls.
We put it through the same checks we run on every VPN: leak tests, day-to-day use on each platform, and a close read of the privacy policy and store disclosures. The grid below splits what it does OK from where the risks are. For speed, streaming, pricing tiers, and support, see our full Urban VPN review.
Pros
- No IP, DNS, or WebRTC leaks while the tunnel is connected
- Free on desktop, and the Windows app installs in under two minutes with no account
- No mainstream antivirus classifies the desktop app as malware
Cons
- The free network routes strangers' traffic out through your IP address
- The privacy policy allows selling raw personal data to affiliates
- The extension harvested AI chats from July to December 2025
- No independent audit of any privacy claim
Outside ratings are mostly low. vpnMentor scores Urban VPN 3.3/10 and ranks it 182nd, near the bottom of all the VPNs it has tested. Security.org is kinder, with a security score of 6.8/10.
How Urban VPN's P2P Network Puts You at Risk
The pros and cons above only hint at it, but the biggest structural risk isn't a bug. It's the design. Urban VPN's free service runs on a community peer-to-peer (P2P) network, which means users share their connections with each other instead of relying only on company servers.
Your Device as an Exit Node for Other Users
In a normal VPN, your traffic leaves the company's server, and websites see the server's IP address. In Urban's free network, your traffic can exit through another user's device, and other users' traffic can exit through yours. Urban's own marketing calls the free Windows app an "IP-sharing VPN," which means exactly that: other users' traffic can leave through your connection.
We saw the effect on our own data plans. While connected, daily data use climbed by roughly 500MB to 2GB, because other users' traffic was passing through the device. The bigger cost is legal rather than financial. When your device is an exit node, whatever a stranger does online appears to come from your home IP address. If someone torrents pirated films through your connection, the copyright notice goes to your internet account, not theirs.
Free P2P Network vs Premium Servers
The P2P arrangement is documented for the free service. Urban also sells a Premium tier, but neither its privacy policy nor its Terms of Service contains any peer-to-peer or IP-sharing language. So Urban doesn't state in writing whether paying stops your device from acting as an exit node. The data-sharing clauses covered below apply to every user, paid or free. If you want to know how the paid plans differ on price, our Urban VPN review covers the tiers.
Is Urban VPN Legit or a Scam?
Knowing how the network works raises the obvious next question: who runs it, and why? Urban VPN is a registered company with working apps, so it isn't a scam in the fake-product sense. The catch is that the product is shaped around data collection. That makes it legit as a business but risky as a privacy tool.
Who Owns Urban VPN (Urban Cyber Security and BiScience)
Urban VPN is operated by Urban Cyber Security Inc., registered in Wilmington, Delaware. Its Terms of Service are governed by New York law. The developer's phone number on the Chrome Web Store uses Israel's +972 country code, and our review places the operation in Tel Aviv.
Security researchers and the press tie the company to BiScience, a data broker that sells clickstream and browsing data products, such as AdClarity, to advertisers. The exact relationship isn't public. Some reports call BiScience an affiliate, while The Hacker News report on the extension's removal describes it as the parent company. Urban's own policy never names BiScience at all.
How a Free VPN Makes Money From Your Data
Running a global VPN costs real money, so a free VPN with no data cap on desktop can sound too good to be true. Urban's policy explains the trade. It says the company sells "marketing insights and behavior segments," and it allows Urban to "sell or otherwise disclose raw Personal Information to our affiliates or parent company so that they may aggregate, anonymize, and de-identify such information."
In plain terms, your browsing is the product, and the VPN is how Urban gets access to it.
The Red Flags in Urban VPN's Business Model
The cons we listed at the top already cover the exit-node design, the data sale, and the missing audit. Two more problems sit underneath them. Urban never makes an explicit no-logs statement for VPN traffic, and its support can't fill the gap: there is no live chat or phone line, and email replies take days and often miss the question.
Any one of these would give us pause. What makes them worse is how they stack. A service that sells data, has no auditor checking it, and can't answer basic questions leaves you with nothing but its own word, and that falls short of a basic privacy standard.
Is Urban VPN a Virus or Malware?
Is Urban VPN a virus? The desktop app is not. Most "Urban VPN virus" alerts are potentially unwanted program flags, not detections of true Urban VPN malware: the app doesn't spread itself, damage files, or resist uninstalling. The browser extension is a different story, covered in the next section.
What Antivirus Scanners Flag (PUP and Adware vs Malware)
F-Secure lists two potentially unwanted application detections for Urban's service file, according to file.net's entry for urbanvpnserv.exe. Detections vary by vendor and change as signatures update, so treat these as examples rather than a universal verdict. Avast flags the same file name as a PUP only when it sits in C:\Windows or System32, where malware sometimes impersonates it. The legitimate copy lives in C:\Program Files\UrbanVPN\bin\.
Kaspersky shows the installer as "Trusted (not approved)." It carries a valid certificate, but Kaspersky hasn't formally verified it, and several Urban VPN files show up in yellow for caution rather than green.
A PUP (potentially unwanted program) is software you installed on purpose that does things you may not want, such as showing ads or collecting data. Malware is built to damage your system or steal from you without consent. Antivirus tools warn about PUPs but usually leave the choice to you.
Why the Desktop App Behaves Like Riskware Even Though It Is Not a Virus
Riskware is legitimate software whose normal behavior creates risk, and Urban VPN fits that description. On Windows, it installs a background service called UrbanVPNServiceInteractive that keeps running outside the app window, so closing the app doesn't stop it. Add a network that sends strangers' traffic through your connection, and it's clear why scanners hesitate even without a malware signature.
Is Urban VPN Proxy Safe? The Browser Extension and Malware Reports
Is Urban VPN Proxy safe? Based on its record, no. Where the desktop app counts as riskware, the extension crossed into behavior that researchers describe as spyware, and that is where most "Urban VPN Proxy malware" searches come from.
What the Chrome, Edge, and Firefox Extension Can Access
The extension is a browser proxy, not a full VPN. It only covers traffic inside the browser and doesn't encrypt it. The Urban VPN Proxy Chrome listing discloses that it collects location, web history, and website content, including visited URLs, ads shown, clickstream data, and IP address. The listing shows 7,000,000 users, a 4.7 rating, and version 5.14.4.
A LayerX analysis of the older version 5.1.0 counted 10 permissions, and those can change between releases. The most sensitive were:
- management, which lets it control your other installed extensions
- scripting, which lets it inject and run code inside the pages you visit
- access to all URLs, which covers every website you open
The extension also bundles an ad blocker, anti-phishing, and an "AI protection" warning feature. Ironically, it shows its own ads on top of web pages.
The AI Chatbot Data Collection Report
In December 2025, Koi Security reported that Urban VPN Proxy was capturing users' conversations with AI chatbots. According to Infosecurity Magazine's report on the AI chat harvesting, the code arrived in version 5.5.0, released July 9, 2025, and Chrome and Edge pushed it to existing users automatically.
The code targeted 8 AI platforms: ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI. It captured prompts, replies, conversation IDs, and timestamps, then sent them to Urban's analytics servers. Sibling extensions such as 1ClickVPN Proxy and Urban Ad Blocker ran the same code, reaching more than 8 million users across Chrome and Edge.
The collection was switched on by a hardcoded setting with no toggle. It kept running when the VPN was disconnected and even when the "AI protection" feature was turned off.
At the time, Urban VPN Proxy had more than 6 million Chrome users and a Google "Featured" badge. The Urban-linked extensions were removed from the Chrome Web Store on December 18, 2025, and from Edge Add-ons on December 23, 2025. The Chrome listing is available again, with no public explanation of its return, and the Featured badge isn't shown on it as of September 2026. If Microsoft Defender flags the extension as a trojan (Trojan/ChatGPTStealer), don't dismiss the alert: remove the extension.
Is the Urban VPN Extension Safer Than the Desktop App?
No, the extension is the riskier of the two. The desktop app at least encrypts traffic and hasn't been caught harvesting chats. The extension encrypts nothing, sits inside the browser where you type passwords and prompts, and doesn't block WebRTC on its own, so your real IP can leak unless you disable WebRTC in the browser. If you only want to change your location in the browser, try one of our safer free VPN Chrome extensions.
Privacy and Logging: What Data Urban VPN Collects and Shares
The AI episode is the loudest problem, but the privacy policy explains the quieter one. Urban VPN collects far more than a privacy-focused VPN should, and it says so openly.
Logging Policy and Third-Party Data Sharing
Urban VPN's privacy policy, last updated September 4, 2026, lists what it collects:
- IP addresses, which it says are trimmed and hashed daily
- Browsing activity, including URLs, pages visited, and search results
- Usage data, such as time spent, features used, and crash logs
- Prompts and other inputs you enter into certain AI tools
- E-commerce activity, device identifiers, and Google or Apple sign-in details
Browsing data is de-identified within 90 days, but the policy admits: "While we cannot guarantee that all personal data is removed, we do take steps to remove or filter out identifiers." There is no explicit no-logs statement for VPN traffic. You can opt out of the sale or sharing of your data through the policy's "Opt Out Right" section, which is worth doing if you keep the app.
US Jurisdiction and No Independent Audit
On paper, Urban VPN sits under US jurisdiction through its Delaware registration and New York governing law. In practice, the day-to-day operation appears to sit with Israel-based affiliates, so "US jurisdiction" describes the paperwork more than where the data work happens.
There is also no independent audit. Proton VPN pays outside firms to verify its no-logs claims every year. Urban never has, so everything in its policy rests on its word alone.
Security Check: Encryption, Protocols, and Leak Tests
The privacy side falls short, but the tunnel itself holds up better than the data practices suggest.
Encryption Standards and the Urban LinkX Protocol
Urban VPN's FAQ says the service uses the OpenVPN protocol with 256-bit encryption. Urban doesn't publish its exact cipher, though, and support doesn't answer technical questions about which encryption it actually uses. We treat "256-bit" as a vendor claim, not a verified setup.
Urban announced its in-house protocol, Urban LinkX, on May 7, 2026. LinkX is built on WireGuard and launched on 394 of Urban's 692 servers, reaching Premium mobile users first and free users after the Windows rollout. Urban's speed claims compare LinkX only with its own older protocol, and it hasn't said how LinkX handles WireGuard's habit of keeping user IPs in a server table. As Tom's Guide pointed out, a new protocol doesn't fix the data collection problem.
IP, DNS, and WebRTC Leak Test Results
When we ran leak tests across multiple servers, we saw no IP, DNS, or WebRTC leaks while the tunnel was up. The weak point is when it drops. Connections dropped often in our testing, and we found no kill switch on the free desktop app to block traffic when that happened. Urban's FAQ says the app has a kill switch toggle, but it doesn't say which platforms or plans include it.
Is Urban VPN Safe to Use on Windows, Mac, Android, and iPhone?
The data-sharing risks follow you onto every platform, but day-to-day stability varies by device.
- Windows: The app uses about 200 to 300MB of RAM even when idle, pushes ads and upgrade prompts, and leaves its background service running. Our best free VPN for Windows picks are cleaner options.
- Mac: The macOS app crashed several times during our normal testing period.
- Android: The Play Store data-safety listing has stated that users can't delete collected data. These labels change between versions, so check the current one.
- iPhone and iPad: The iOS app requires iOS 16.0 or later. It disconnected frequently for us and needed manual reconnection every few hours.
Everyday browsing also feels slower, and each connection attempt takes more than 10 seconds. Our review has the full speed and streaming results.
How to Remove Urban VPN and Its Extension Safely
If the platform notes above have you ready to leave, removing Urban VPN takes a few minutes, but the extension and the Windows service need separate steps.
- Remove the extension. Go to chrome://extensions (or edge://extensions in Edge), find Urban VPN Proxy, then click Remove. In Firefox, open Add-ons and themes, then click Remove next to Urban VPN.
- Uninstall the Windows app. Open Settings, go to Apps, select Urban VPN, then click Uninstall. If Windows blocks it, end the Urban VPN process in Task Manager, then try again.
- Uninstall the Mac app. Quit Urban VPN, then drag it from Applications to the Trash.
- Delete the phone app. Press and hold the app icon, then choose Uninstall or Remove App.
- Clean up your accounts. If the extension was installed any time after July 9, 2025, change your passwords and clear your browser cookies and cache.
After uninstalling on Windows, check that the C:\Program Files\UrbanVPN\ folder is gone and that UrbanVPNServiceInteractive no longer appears in Task Manager's Services tab.
Who Should Avoid Urban VPN (and When Is It Low Risk?)
Once you know how to get it off your devices, the harder question is whether to install it at all. Most people should skip it. Urban VPN is safe enough only for short, low-stakes jobs on a spare device where you aren't signed in to anything, such as checking how a public website looks from another country. Even then, your IP address keeps working as an exit node while you're connected.
Avoid Urban VPN if you:
- Use AI chatbots for work, health, or personal questions
- Bank, shop, or check email in the same browser
- Share a home connection and don't want legal notices tied to it
- Are on a capped mobile data plan
Safer Free VPN Alternatives to Urban VPN
Free doesn't have to mean data-funded. The three services below run on dedicated servers, so no stranger's traffic exits through your device, and none of them sells user data.
| VPN | Logging | Independent audit | P2P exit node | Data sharing | Jurisdiction | Buy |
|---|---|---|---|---|---|---|
 |
No-logs | Five annual Securitum no-logs audits | No | No | Switzerland | Check price → |
 |
No identifying logs | App and server audits, no dedicated no-logs audit | No | No | Canada | |
 |
Stated no-logs | None | No | No | Iceland (formerly Switzerland) | |
 |
Collects IP, browsing, and AI inputs | None | Yes | Sells or discloses to affiliates | US (Delaware), Israeli ties |
- Proton VPN Free is our first choice. It has passed its fifth consecutive annual no-logs audit, and the free tier has no ads and unlimited data. Our guide to whether Proton VPN is safe goes deeper, and the Proton VPN review covers performance.
- Windscribe Free has seen its no-logs claim hold up in a court case and a server seizure, as our Windscribe review explains.
- PrivadoVPN Free gives you 10GB a month. It lacks an audit, but it doesn't use your device as an exit node. See our PrivadoVPN review.
For a wider shortlist, see our best free VPN picks.
Final Verdict: Is Urban VPN Safe to Use?
So, Urban VPN: is it safe to keep installed? If it's already on your computer or phone, we'd remove it, starting with the browser extension, since that's the piece with a documented history of hidden collection. If you keep any part of it, turn on the privacy policy's opt-out first. Then move to an audited free VPN that doesn't borrow your IP address. A VPN is only worth it if it protects you from exactly the kind of data collection Urban is built on.
