In the age of digital surveillance, a Virtual Private Network (VPN) is no longer a tool just for security researchers or corporate employees. It is a fundamental utility for anyone who wants to reclaim privacy online.

But a core paradox lies at the heart of any commercial VPN service: How does a VPN verify that a subscriber has a valid subscription and manage the account across multiple devices without compromising anonymity?

The answer lies in how authentication is handled. This article looks under the hood of WrapVPN’s identity architecture, compares Apple and Google login flows, and discusses how WrapVPN protects a person’s email address.

The Tale of Two Sign‑Ins: Apple vs. Google

When the app is opened, options to sign in, typically via Google or Apple, are presented. These single sign‑on (SSO) systems are incredibly convenient, but they handle email addresses very differently.

1. Apple Sign‑In and “Hide My Email”

Apple has made privacy a marquee feature of its ecosystem. When signing in with Apple, iOS gives a critical choice: Share My Email or Hide My Email.

Figure 1: iOS gives users a critical choice: Share My Email or Hide My Email.

If “Hide My Email” is chosen, Apple does something clever:

  • The Obfuscated Address: Instead of handing WrapVPN the actual Apple ID email, Apple’s identity service generates a unique, randomized proxy email address like w2jpgdtd9m@privaterelay.appleid.com.
  • The Forwarding Relay: Apple forwards any notifications or transaction receipts sent to this address directly to the real inbox.
  • Complete Isolation: WrapVPN never sees the real personal email. Because this relay email is unique to WrapVPN, it cannot be used by other third‑party services to track the individual across the web. If the subscription is canceled, the relay address can be disabled in iCloud settings, cutting off all communication instantly.

WrapVPN fully supports this privacy‑centric flow. Whether registration occurs on iOS or Android (via a secure Apple Web authentication bridge), WrapVPN registers the account using this private relay address, treating it as the primary identifier without demanding a real name or personal inbox.

2. Google Sign‑In: The Direct Approach

Google Sign‑In is the default experience for millions of Android users. However, from a privacy perspective, it requires a bit more caution:

  • No Built‑In Masking: Unlike Apple’s prompt, Google’s standard Sign‑In SDK does not offer a quick “Hide My Email” toggle at the moment of login.
  • Sharing the Real Email: When the “Sign in with Google” button is tapped, WrapVPN receives the real, primary Google email address (e.g., example@gmail.com).
  • What this means for the subscriber: If anonymity is paramount, signing in with Google is not the ideal choice. Those who prioritize absolute privacy should opt for Apple Sign‑In with “Hide My Email” enabled, or register with a dedicated, anonymous alias email address.

How WrapVPN Handles Email Under the Hood

Whether the account is created using a private Apple relay address or a primary Google address, WrapVPN follows strict design principles to ensure data is kept secure and isolated.

1. Cross‑Device Synchronization

WrapVPN is built for multi‑device households. A person might have an iPad, an Android phone, a Windows desktop, and a MacBook. To allow a single subscription on all these platforms, WrapVPN maps external identity subjects (apple_sub and google_sub) to a central accounts record.

Figure 2: WrapVPN maps external identity subjects to a central accounts record

The email address (real or obfuscated) acts as a primary key. When a new device logs in, WrapVPN checks this table, verifies the active subscription, and authorizes the device — without requiring a brand‑new account for every operating system.

2. Consolidating to a Zero‑Knowledge Identity Model

Historically, many services rely on third‑party SaaS identity platforms to manage authentication. To reduce security dependencies and prevent metadata leaks, WrapVPN has consolidated its identity services directly into its own internal backend .

By keeping authentication in‑house, WrapVPN ensures that:

  • Login tokens, passwords, and account relations are protected inside a dedicated database.
  • External SaaS providers cannot track login patterns, frequency, or locations.
  • Core authentication tokens are signed securely and verified using modern cryptography (RSA public/private key‑pairs).

3. The Firewall Between Identity and Traffic

The most important rule of a trustworthy VPN is the separation of identity and traffic.

Even if WrapVPN knows an email address (for billing and device sync), the VPN architecture is specifically designed so that the identity can never be linked to online activity:

  • Strict No‑Logs Policy: WrapVPN does not log or monitor the websites visited, the data downloaded, or the IP addresses assigned.
  • Client‑Side Key Generation: WrapVPN uses the industry‑standard WireGuard protocol. Under WrapVPN’s modern security model, the device generates the WireGuard keypair locally. The private key never leaves the phone or computer. Only the public key is registered with the VPN node. Because the server never possesses the private decryption key, it is cryptographically impossible for WrapVPN to decrypt or intercept web traffic.
Figure 3: The private key never leaves user’s phone or computer. Only the public key is registered with the VPN node.

Summary: Choosing an Authentication Strategy

WrapVPN gives the subscriber tools to define their own threat model.

  • For Maximum Anonymity: Sign in with Apple and choose “Hide My Email”. WrapVPN will only know the account by an obfuscated relay address (*@privaterelay.appleid.com).
  • For Cross‑Platform Android/Web Convenience: Sign in with Google. While this shares the real email address (*@gmail.com) for account management, WrapVPN’s cryptographic tunnel and zero‑logs architecture ensure web browsing remains completely private and decoupled from login credentials.

Ultimately, the email is just a ticket to access the network. What happens once on that network remains entirely the subscriber’s business.

Shielding Your Identity: How WrapVPN Handles Apple Private Relay, Google Login, and User Email… was originally published in WrapVPN Engineering on Medium, where people are continuing the conversation by highlighting and responding to this story.