Privacy Relays and Secure Gateways vs a Full VPN: What's the Difference?

Privacy tools have multiplied. Some phones and browsers now include a built-in relay that hides parts of your activity. Several network companies give away a free app that sends your traffic through their systems. They are often compared with VPNs, and sometimes described as a free replacement. They are related, but they are not the same thing.

This article explains the differences in plain terms, without naming products or ranking brands. It compares what each type covers, who you have to trust, where it falls short and when each one is the right choice. By the end you should be able to read any product page and work out which category it belongs to.

Why these tools get compared with a VPN

All of these tools try to answer the same worry: someone along the path between you and a website can see too much. That someone might be the owner of a Wi-Fi network, your internet provider or the website itself.

They differ in how much traffic they cover, where they sit and who operates them. A useful starting point is the basic idea of a VPN, described in the Cloudflare overview: an encrypted tunnel between your device and a VPN server, through which your traffic exits to the internet. The tools below do part of that job, or do it differently.

Privacy relays: scoped and built in

A privacy relay is usually a feature of an operating system, a browser or an account, not a separate app. The design most often looks like this:

1. Your device sends the request, encrypted, to the first relay operated by one company.
2. That first relay knows who you are, meaning your network address, but it does not see the website you asked for.
3. It passes the request to a second relay, often run by a different company.
4. The second relay knows the destination but not who you are, and it connects to the website.

The point of splitting the work is that no single operator sees both halves of the picture. That is a clever design and, for ordinary browsing, a real privacy improvement.

Where the scope is limited

Relays are typically narrow. The scope is set by the platform and may include:

• web browsing in one browser only
• some apps that use standard web connections
• DNS requests, and only for certain traffic

Other traffic, such as many apps, games, messaging services, system services and anything that is not ordinary web traffic, often does not go through the relay. Whether it applies on a particular network can also vary, and a relay may be switched off by a network setting, a workplace policy or a VPN.

The practical lesson: with a relay, ask exactly what it covers. If the answer is "web browsing in one browser", then that is what you have.

Free secure gateway apps

A second group are free apps from network, security or infrastructure companies. The name varies, but the pattern is common:

• You install an app and switch it on.
• Your DNS requests, and sometimes your wider traffic, are sent in encrypted form to the provider's network.
• The provider may offer extras such as filtering known harmful sites.
• A paid tier may add more features.

Encrypting DNS is a real benefit. DNS is the system that turns site names into addresses, and the standards for encrypting it include DNS over HTTPS in RFC 8484. If you want to know what DNS is, the Cloudflare explainer is a good start.

What these apps are, and are not

Often they are best described as a secure gateway or a protected resolver. In practice:

• They may protect DNS only, which hides the names of sites you look up from the Wi-Fi operator, but not the connection itself.
• If they carry general traffic, the provider's network is the new place where your traffic exits.
• They usually have fewer settings than a full VPN: fewer ways to choose how the connection is made, less control over what goes through it, and limited troubleshooting information.
• Because the app is free, the provider's reason for offering it matters. It might be goodwill, a way to promote another product or a paid upgrade path. Check the policy and the business model, as covered in our guide on free VPNs without ads.

None of this makes them bad. It makes them a different class of tool.

What a full VPN does

A full VPN is usually a system-wide tunnel. Once connected, most or all of the device's internet traffic goes through it, whatever the app. Typical features include:

• coverage for every app, not just the browser
• a choice of connection methods, set by the service
• controls such as a kill switch and split tunneling
• an app or profile for several kinds of device, so the same protection follows you from phone to laptop
• a clear commercial relationship with the provider

A VPN does not make you invisible. It moves the point at which your traffic appears to leave your connection, and it hides the content of the traffic from the local network. The fuller picture is covered in what a VPN actually protects and what a VPN cannot protect you from.

For many people, the practical difference is straightforward. A relay or gateway is a layer you get with a platform or a free app, and a VPN is a tool you choose for a purpose.

Side-by-side comparison

Question	Privacy relay	Free secure gateway app	Full VPN
Where it lives	Built into the platform, browser or account	Separate app	Separate app or system profile
What traffic is covered	Often web browsing, sometimes more	DNS, sometimes more	Most or all device traffic
Operators involved	Often two, to split what each knows	One provider	One provider
Controls and settings	Few	Few to moderate	Usually the most
Coverage across devices	Limited to those with the feature	Depends on app availability	Depends on app availability
Public Wi-Fi protection	For the traffic it covers	For the traffic it covers	For most device traffic
Typical cost	Bundled with a subscription or account	Free, often with a paid tier	Paid, though free tiers exist
Troubleshooting help	Limited	Limited	Usually better
Best for	Everyday browsing with minimal effort	Extra DNS privacy at no cost	Broader coverage and control

What each one protects you from, and whom you trust

What they do and do not protect

Protects you from, to a degree:

• A Wi-Fi owner or café network reading the sites you visit, for the traffic covered
• A website seeing your exact home address, when the relay or tunnel hides it
• Basic tracking based on your network address

Does not protect you from:

• Malware, phishing and weak passwords. See how to recognise phishing websites.
• Being identified by what you do while signed in. If you log in to a service, it knows who you are.
• Browser fingerprinting and cookies, which identify you regardless of your address.
• A compromised device.
• Traffic that falls outside the tool's scope.

None of the three tools makes you anonymous. For the deeper difference between a tunnel and an anonymity network, see VPN vs Tor.

Trust: who can see what

Every privacy tool moves trust from one party to another. The honest question is: whom are you trusting instead?

• With a relay, you trust the platform and the operators of both hops. The two-hop design limits what each can learn, but you still depend on their promises and on the platform itself.
• With a free gateway app, you trust one provider with your DNS or traffic. Check the privacy policy, and ask how it earns money.
• With a full VPN, you trust the VPN company with all the traffic it carries. That is why choosing a provider with a clear commercial relationship, plain terms and a track record matters.

Be wary of absolute language such as "nobody can see anything". It is rarely true for any tool. A plain description of what is visible to whom is a better sign.

Four everyday scenarios

Browsing in a cafe. Priya mostly reads news and shops in her browser. A relay that covers that browser adds a useful layer against the cafe network, and she may not need more.

An evening of apps and games. Tom plays online games and uses several chat apps at night. A browser-focused relay does not touch most of that traffic. A tool that tunnels the whole device is a better match, and he can check by looking at his visible address.

A traveller with three devices. Lucia has a phone, tablet and laptop and wants the same protection on all of them. A feature built into one platform will not follow her to another. A full VPN with apps for each system gives consistent coverage.

A student who only wants private DNS. Ken's goal is limited: keep the dorm network from seeing which sites he looks up. A free gateway app that encrypts DNS may be enough for that, as long as he understands it does not hide everything.

How to choose

Ask these questions, in this order:

1. What do I need to protect? Browsing only, or all apps?
2. Which devices? One platform, or several?
3. How much control do I want? A single switch, or settings such as a kill switch and split tunneling?
4. Whom am I trusting? Read the policy and the business model.
5. What happens if it fails? Does traffic fall back to the open network?
6. Does it combine with other tools? Read the documentation.

If you need broad coverage and control, a full VPN is the closer fit. Our guide to VPN vs proxy helps compare it with other tunnel-like tools.

Combining tools

Usually you will not run two of these at once. When a full VPN is connected, the system often turns off or bypasses a relay for the traffic the VPN carries. That is normal. After enabling any combination, check your visible address and test for DNS leaks, so you know which tool is actually in charge.

Common mistakes and limits

• Treating a relay as a full VPN. It is a scoped feature, so confirm what it covers.
• Assuming a free app carries all your traffic. Many protect DNS only.
• Believing "private" means "anonymous". Neither relays nor VPNs make you anonymous.
• Forgetting that workplace and school networks may turn relays off. Settings differ by network.
• Not testing. A quick check of your visible address and DNS takes minutes.
• Ignoring the business model. Free tools still have costs, so find out who pays.

A VPN has limits too: it depends on a provider you must choose carefully, and it can affect speed. Our guide on HTTPS vs VPN shows how it combines with the encryption sites already use.

Summary

Privacy relays and free secure gateway apps are useful, but they are narrower than a full VPN. A relay is usually built into a platform and covers a limited set of traffic, splitting what two operators can see. A gateway app often protects DNS or part of your traffic through a free provider. A full VPN tunnels most or all device traffic and gives you more control and consistency across devices, at the cost of choosing and trusting a provider. Match the tool to the job, ask exactly what is covered and test the result. If a full VPN suits you and you prefer a fixed number of days with no automatic renewal, see how XPASS pricing and passes work.