Qihoo 360 did not respond to questions about the current status of its app holdings, but TTP found evidence that suggests the company remains connected to the apps.

In its 2020 annual report, Qihoo 360 said it sold something called “Project L,” which appears to be the app-related companies Lemon Seed, Lemon Clove, and Autumn Breeze, to unnamed “external parties.” (Qihoo 360 does not describe Project L, but key pieces of information it does disclose about the project, including how much it cost to acquire and when it was originally acquired, match the information Qihoo provided for the three app-related companies.) The sale occurred in September 2020, according to Qihoo 360, a few months after the U.S. Commerce Department sanctioned the company as a national security threat.

However, corporate registration documents for Lemon Seed in the Cayman Islands as well as Lemon Clove, Autumn Breeze, and Innovative Connecting in Singapore suggest an ongoing connection with Qihoo 360. The most recent corporate filings for Lemon Seed, Lemon Clove, Autumn Breeze, and Innovative Connecting, from March 2025, all list one director, Chen Ningyi. (Three of the filings identify this person as a Chinese national.) The name Chen Ningyi is on a Qihoo patent from 2017. The Chinese version of this patent gives Chen’s name in Chinese characters, which matches an individual who was described in 2020 by China Daily, the mouthpiece of the Chinese Communist Party, as a general manager of 360 Mobile Guard, Qihoo 360’s mobile phone security app.

This same Chen Ningyi was also named a board member and legal representative of a Qihoo subsidiary when it was sold to another Chinese tech firm in March 2023. (See additional research details at the bottom of the report.)

Qihoo 360 may have entered the app business through a little-known Chinese company called Guangzhou Quanyong Information Technology Co., Ltd., TTP's investigation found.

Guangzhou Quanyong developed apps for Apple’s iOS and Android, and corporate records show it created several apps in the Innovative Connecting network. According an undated profile in PitchBook, which collects market data on mergers and acquisitions, Qihoo 360 acquired “SpringTech,” which appears to be the English name for Guangzhou Quanyong. (The “quan” in Quanyong means “spring.”) Guangzhou Quanyong officially dissolved in 2022, but shared the same address as the Qihoo subsidiary described above.

TurboVPN, the first VPN mentioned in this section, has been advertising itself on Facebook and Instagram this year. One of its ad campaigns, which ran in January and February, targeted Spanish-speaking users in the U.S., saying Turbo VPN can help with the threatened U.S. TikTok ban.

1 of 4 A recent ad campaign on Facebook and Instagram promoted the Chinese app TurboVPN. Hong Kong shell companies A number of the VPN apps in the Apple App Store traced back to Hong Kong companies, which were ultimately owned by individuals or companies in mainland China.

While Hong Kong may conjure up a benign image in the minds of some Americans, owing to its long history of relative autonomy from China, the region since 2020 has experienced a sharp crackdown on pro-democracy activists and opposition leaders orchestrated by the central government in Beijing. New Hong Kong national security laws have been used to justify this crackdown, including a controversial ordinance introduced in March 2024. Last year, the U.S. government issued a warning to American businesses operating in Hong Kong that they face risks of warrantless surveillance and forced surrender of data to authorities due to the region’s national security laws.

One of the apps examined by TTP, X-VPN, was the 4th most popular free VPN app in the U.S. for iPhone and iPad in 2024. The app’s page in the Apple App Store gives its developer as Free Connected Limited, a generic-sounding company with no obvious connection to China. However, the app’s privacy policy, which users must click to view outside the App Store, shows that Free Connected is based in Hong Kong.

TTP found Free Connected Limited listed in the Hong Kong government’s corporate registry and examined the company’s most recent annual filings. These filings indicate the company is actually owned by a Chinese tech firm, Chengdu Zhuozhuo Technology Co., Ltd. Chengdu Zhuozhuo’s website says the company is focused on “internet transmission and network resources integration.”

Free Connected Limited has run multiple ads for X-VPN on Google, with one ad from February promoting it to Americans as a way to get around the TikTok ban. “Best Free VPN for TikTok Ban,” the ad states, adding, “Use TikTok Anytime in US with X-VPN.”

1 of 3 The Chinese firm Free Connected Limited ran an ad campaign for its X-VPN app on Google. Another app called VPNIFY, which ranked 25th among top free VPN apps, gives its developer as Neonetworks solution ltd. Again, this is not a name that gives any indication of a China connection. But at the bottom of Neonetworks’ externally linked privacy policy page, it gives a Hong Kong address.

Neonetworks’ 2024 incorporation form in Hong Kong shows that its sole shareholder is a Chinese citizen and resident of mainland China.

An app called VPN Bucks also had a Hong Kong connection. The app, ranked 22nd, gave its developer as Free Apps Limited, a company registered in Hong Kong that was dissolved in 2021. The company’s last annual report in Hong Kong showed that its sole shareholder was a Chinese citizen with an address in Guangzhou, southern China. VPN Bucks’ App Store page still listed Free Apps Limited as its developer in 2024 when TTP conducted its initial research; the app has since been removed from the App Store.

TTP also found that VPN Bucks’ privacy policy contained identical passages to that of VPN Proxy Master, an app described earlier in this report that is part of the Innovative Connecting network. The VPN Bucks’ privacy policy even retained a reference to “Innovative” in its text, in a line that began, “Innovative's registered place of business is in Singapore.” (TTP found no additional evidence connecting VPN Bucks to Innovative Connecting, and it is possible the developers of VPN Bucks simply copied the privacy policy of an Innovative Connecting app.)

It was a similar story with LinkWorldVPN, another app that fell just outside the top-100 ranking. TTP determined that its developer, MUSKETEER NETWORK TECHNOLOGY LIMITED, is a Hong Kong company. Corporate records there show the company’s sole officer/shareholder is a Chinese citizen with an address in mainland China.

LinkWorldVPN has disappeared from the Apple App Store since TTP conducted its initial research. But TTP found that the app ran a months-long ad campaign on Facebook and Instagram last year in both the U.S. and Europe.

Because Meta’s Ad Library preserves data about ads that run in the European Union in keeping with EU law, we can see that the LinkWorldVPN ads targeted users as young as 13.

1 of 3 LinkWorld VPN ran a months-long Meta ad campaign last year. Other apps traced back to China Some of the apps identified by TTP appeared to be linked to companies outside China but ultimately showed evidence of Chinese ownership.

For example, one app examined by TTP, WireVPN - Fast VPN & Proxy (ranked 23rd), gives its developer as WEILAI NETWORK TECHNOLOGY CO., LIMITED.

TTP found an exact match for a UK-based company with this name, with an address in Warwickshire, England. However, the company’s sole director is a Chinese national who resides in China. According to UK corporate records, this Chinese national exercises “significant control” over the company, owning 75% or more of shares and voting rights.

As with previous examples in this report, this entity appears to be a shell company: Its most recent annual accounts filing in the UK indicates it had just £100 in assets and that it was dormant, meaning it had not recorded any business activity or income that year.

The app’s privacy policy includes language that appears to be lifted directly from Chinese government regulations prohibiting “harmful information” that hurts China’s national honor or attacks the Chinese Communist Party.

A similarly named app called Wirevpn – Secure & Fast VPN (ranked 68th) lists its developer as freevpn Ltd. That company is registered in Belize, but it has a privacy policy that is identical to the other WireVPN app mentioned above.

The privacy policy of two Wire VPN apps appeared to copy Chinese government regulations on "harmful information." Two other apps, VPN Proxy OvpnSpider (ranked 36th) and Best VPN Proxy AppVPN (ranked 82nd), list their developer as WCOMES TECHNOLOGIES CO., LIMITED. TTP found corporate filings that indicate this is a Hong Kong company. According to its most recent annual return filed in Hong Kong, the company has two shareholders who are residents of mainland China, and at least one of them is a Chinese citizen.

According to independent researchers who looked at this company previously, it has a development team in Minsk, Belarus—which, like China, is an authoritarian country known for cracking down on dissent. Job listings on the WCOMES website note the company’s office location in Minsk.

Conclusion TTP’s findings show that a significant number VPN apps in Apple’s App Store trace back to China, a fact that may be putting the privacy of American users, and U.S national security, at risk. Americans may be downloading these apps and using them to browse the internet without any knowledge that their data may be subject to China’s national security laws and accessible by the Chinese government. For Apple, a company that markets itself as a champion of user privacy and security, this is a glaring security oversight.