GOOGLE PLAY STORE COMPLIANCE · DATA SAFETY & PERMISSIONSAndroid Package: dev.shuriko.com
Google Play Data Safety & Android Permission Audit
Line-by-line verification of our Google Play Data Safety declarations, ephemeral Redis keys, and least-privilege AndroidManifest.xml permissions.
01
Google Play Data Safety Form — Verifiable Mapping
This disclosure maps Shuriko VPN (dev.shuriko.com) directly to the categories in the Google Play Store Data Safety section. Every row reflects the actual runtime behavior of our open codebase.
| Play Data Category | Data Type | Collected? | Shared? | Purpose & Handling |
|---|---|---|---|---|
| Personal Info | Email address | Yes (Optional in Guest Mode) | No | Account authentication and linking subscription entitlements in Firebase Authentication / Cloud Firestore. |
| Financial Info | Purchase history (Plan & Expiry) | Yes | Verified with Google Play | We store only plan, accessExpiresAt, and an opaque billingAccountToken. Raw Play purchase tokens are discarded after verification. |
| Device or Other IDs | Advertising ID & IP (Free Tier Only) | Free Tier AdMob Only | Google AdMob | When a Free Tier user watches a rewarded ad before connecting, Google AdMob receives the request IP and device ad ID. Pro accounts never initialize AdMob. |
| Web Browsing | Browsing history, DNS queries, traffic | No — Never Collected | No | WireGuard® nodes run in volatile RAM with local Unbound DNS (logfile: "") and RFC 9474 blind tokens. |
| Location | Precise or approximate location | No — Never Collected | No | The app never requests GPS/location permissions and does not log client IP addresses on VPN nodes. |
| App Activity & Crashes | Analytics & crash logs | No — Zero SDKs | No | We do not bundle Firebase Crashlytics, Google Analytics, or any third-party telemetry trackers. |
02
Fields Explicitly Excluded from Storage
Unlike conventional VPN providers that log connection metadata, the accounts/{randomId} document and VPN exit nodes never store:
Client Source IP Address
DNS Queries or Domains
Selected VPN Server History
Connection Timestamps
Unblinded RFC 9474 Tokens
WireGuard Private Keys
03
Android Manifest Permissions Audit
Shuriko VPN follows Google Play's least-privilege permission policy. Every permission declared in AndroidManifest.xml serves a user-facing tunnel or reliability function:
| Android Permission / Service | Why It Is Required |
|---|---|
android.permission.BIND_VPN_SERVICE | Core system permission required to establish the encrypted WireGuard® TUN interface via Android's VpnService. |
android.permission.INTERNET & ACCESS_NETWORK_STATE | Required to communicate with the control API, mint blind tokens, and transport encrypted WireGuard® UDP packets. |
android.permission.FOREGROUND_SERVICE & android.permission.FOREGROUND_SERVICE_SYSTEM_EXEMPTED | Maintains the active VPN tunnel and monitor notification (ShurikoVpnMonitorService) so Android does not kill your active VPN connection while you switch apps. |
android.permission.POST_NOTIFICATIONS | Displays live tunnel status, remaining session time, and a quick Disconnect action in the system notification shade. |
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | Optional user-initiated setting in Settings to prevent aggressive OEM battery savers from dropping an active WireGuard® tunnel in the background. |
android.permission.QUERY_ALL_PACKAGES | Used exclusively on-device to populate the Split Tunneling app picker in Settings so you can choose which installed apps route through or bypass the VPN. Your installed app list is never transmitted off your device. |
android.permission.VIBRATE | Provides subtle tactile feedback when connecting or disconnecting the Enso dial (can be toggled off in Settings). |
04
Google Play Security Declarations
- Data Encrypted in Transit: All control-plane API calls use HTTPS/TLS, and all VPN data-plane traffic is encrypted using WireGuard® (ChaCha20-Poly1305 with Curve25519 key exchange).
- Account Deletion Available: Users can delete their account and associated data both in-app (
Settings → Delete Account Permanently) and via our public web portal at /delete-account. - Questions or Compliance Audits: Contact Shuriko VPN at abdullah.alagi@outlook.com (Last verified: 2026-11-12).