All work

Case 04 / 10

A VPN website, and its apps back in the stores

ID Safe VPN sells VPN subscriptions through its website and mobile apps. I built the website from scratch, in English and Arabic with a subscription shop. When the apps and backend from earlier developers were left on an outdated stack, I took them over too and, in eight working days, rebranded both apps, moved the backend to Laravel 12 on new servers and got new releases through Google Play and App Store review.

Role
Full-Stack & Mobile Developer
Client
Fans Media Ltd, freelance
Year
2024–2026
Stack
WordPress, Elementor Pro, WPML, Easy Digital Downloads, Kotlin, Swift, Laravel
Visit idsafe.app

8

working days for the whole takeover, 57 hours in all

6

codebases moved to clean private repositories

7.2 → 8.3

PHP version of the payment and affiliate APIs

EN / AR

website and store listings, left to right and right to left

Key contributions

  1. 01

    The website, built from scratch

    idsafe.app on WordPress and Elementor Pro, in English and Arabic through WPML, with a subscription shop on Easy Digital Downloads. A purchase creates the customer's VPN account through the API, the cart holds one plan, and custom forms handle affiliate sign-up and account deletion.

  2. 02

    Two existing apps, rebranded and back in the stores

    I took over the Android and iOS apps from earlier developers and renamed ID Shield to ID Safe. Android moved to Android 16 (target SDK 36, 16 KB pages, edge-to-edge) and iOS got a safer in-app purchase flow. Android 2.1 and iOS 3.3 passed review.

  3. 03

    One account across the website and the apps

    Apps now sign in with the customer's website account through a custom WordPress endpoint that checks the subscription, instead of a separate account at the VPN provider. Store purchases are validated and kept in sync by the backend.

  4. 04

    Legacy backend to new infrastructure

    The payment and affiliate APIs went from Lumen 7 on PHP 7.2 to Laravel 12 on PHP 8.3, in Docker on Coolify with new DNS and SSL. Data was migrated, a lost Android signing key was replaced through Google's upload-key reset, and the old server was retired.

Screens

The same home page in Arabic, mirrored right to left: menu, headline, button and store badges all flip sides.
Home page in Arabic
Pricing page: three subscription plans of 1, 12 and 6 months, with the 12-month plan highlighted and discounted.
Pricing
Server page: headline, a find-a-server button and a world map with 75 countries, 40,000+ IP addresses and 2,200+ servers.
Servers
App Store listing for ID Safe VPN: app icon, age rating, category, developer, language and size, with the screenshot gallery.
App Store
Google Play listing for ID Safe: app name, downloads, install button, screenshots, content rating and the app description.
Google Play
Store artwork: the app's connect screen with a large power button, the connected server and the public-to-VPN IP. Store artwork: the app menu with the account, the subscription and its expiry date, and VPN settings such as kill switch, split tunnelling and protocol.
Mobile home page in English.
Mobile home page in Arabic, right to left.

Screens from the live website and the store listings. The Arabic site reads right to left; both listings were rebranded to ID Safe, in English and Arabic.

Before and after

What I inherited, and what the client has now. Switch between the two.

Code

Six private repositories with clean history; signing keys and credentials kept out of the code.

Android

Android 16 (target SDK 36), 16 KB pages, edge-to-edge. Version 2.1 live.

iOS

Rebranded, with restore, pending and server-confirmed purchases. Version 3.3 approved.

Sign-in

Apps sign in with the customer's idsafe.app account, checked against the subscription.

VPN provider

The provider sits behind an interface with a stand-in, so the apps build, test and pass review; one flag switches back once the client picks a provider.

Backend

Laravel 12 on PHP 8.3, in Docker on Coolify, with new DNS and SSL.

Signing

A new upload key, approved by Google; releases are signed again.

Old server

Data migrated, the server snapshotted and deleted.

Eight days

The takeover, day by day, from the work log.

Day 1 of 8 · 18 Sep 2026

Reviewed the Android app against Google Play's current rules, moved it to a new private repository with keys and credentials taken out, started the rebrand, put the WordPress theme under version control and got access to the new server.

Next case Recruitment site for a Belgian federal public service