Private Internet Access VPN

Private Internet Access (PIA) is a commercial VPN service. This is its open-source Android client, but it does not include a server or a free service tier: you need an active PIA account before it can connect.

The current source offers WireGuard, OpenVPN and AmneziaWG. Its default Automatic mode chooses among them according to country and endpoint support. Per-app split tunnelling, custom DNS, port forwarding on supported regions, PIA MACE DNS blocking and automation rules are built in; the kill-switch control opens Android’s system setting for an always-on VPN. Availability can vary by account, server region and Android version.

Network automation and permissions

PIA can react when the phone joins a Wi-Fi network. Android treats Wi-Fi identifiers as location-sensitive, so the automation module declares fine and background location. The setting starts disabled in the fixed source. If you do not use Wi-Fi rules, do not grant background location.

The app also declares boot, wake-lock, notification and foreground-service permissions for persistent VPN operation. Split tunnelling needs to know which installed apps can be routed inside or outside the tunnel; the measured manifest itself does not request Android’s broad QUERY_ALL_PACKAGES permission.

MACE is off by default in the source. It changes DNS handling while connected to block domains on PIA’s list; it is not a browser content blocker and cannot remove empty spaces left by blocked ads.

Sharing connection statistics starts off and is presented on the first-run consent screen; it can be changed later. Debug logs are sent only when the user chooses the send action.

This F-Droid variant

The project defines Google, Amazon, no-in-app, Meta and F-Droid flavours. This package is the fdroid flavour; build 10718 is shared by the non-Play variants, while the Play variant uses build 718. Google Play billing is included only in the Google flavour. Although the fdroid compile-time update URL is blank, the app still asks PIA’s latest-release service on startup. PIA’s response can display an update or block the splash screen until an update is taken, and supplies the external download URL.

This is the developer’s own release APK. F-Droid rebuilds it from source, confirms that the result matches and publishes the same developer-signed file as PIA’s upstream pia-fdroid-release-4.1.5-10718.apk; those two copies can update one another. We did not verify whether the Play Store variant uses the same signing key.

Version 4.1.5 is 40.7 MB and needs Android 7.0 or later. It includes native libraries for 32- and 64-bit ARM and x86. The release notes list improved connectivity, dedicated-IP support over OpenVPN, stability fixes and an automation fix. Its SHA-256 is 777f0d538d406162dc732c07496fef43a5f15099a3da1afe149c5c612a2c1022, matching F-Droid’s signed index. The client code is MIT licensed; the required PIA network is proprietary and paid.

Flagged by F-Droid:

• NonFreeNet: Relies on or promotes a proprietary network service.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Versions currently kept in the F-Droid repository. We host and check only the newest one.