Privacy Policy — Zero Activity Logs & VpnService Disclosure
Complete disclosure of account storage, RFC 9474 blind-token unlinkability, Android VpnService usage, Free Tier rewarded ads, and data deletion rights.
Who We Are & Scope
Shuriko VPN provides the Shuriko VPN virtual private network application across Android (package identifier: dev.shuriko.com), iOS, desktop, and this web portal. This Privacy Policy describes exactly what data our control plane, ephemeral caches, and WireGuard® exit nodes process, why we process it, and how you can permanently delete your account and associated data.
We keep no activity logs. Because tunnel credentials are authorized using IETF RFC 9474 (RSAPBSSA-SHA384-PSS) partially blind RSA signatures, our control plane cannot see the unblinded token you redeem on a VPN node, and our VPN exit nodes never receive your email address, account ID, or billing record.
Android VpnService Prominent Disclosure
On Android devices, Shuriko VPN uses the system android.net.VpnService API (declared via android.permission.BIND_VPN_SERVICE) as its core and sole functionality to establish an encrypted device-level network tunnel to our remote WireGuard® VPN servers.
- Why VpnService Is Used: The Android
VpnServiceinterface creates a virtual local network adapter (TUN) on your device so network packets from your device (or the specific apps you configure via Split Tunneling) are encrypted using WireGuard® (ChaCha20-Poly1305) before leaving your device. - No Traffic Manipulation or Ad Injection: We never use
VpnServiceto inspect, log, modify, redirect, or monetize your network traffic, nor do we bypass ad-blocking controls or collect browsing histories from the tunnel. - Local-Only Tunnel Keys: Your WireGuard® client private key is generated on your device and never transmitted to the control plane. Only the ephemeral public key is sent directly to the chosen exit node alongside an unblinded RFC 9474 bearer token.
What We Store on Your Account
We store an account record in Cloud Firestore (accounts/{randomId}) so you can sign in across sessions and so our control plane can verify whether you hold an active Pro subscription or a Free Tier access window:
| Account Field | Purpose & Handling | Retention |
|---|---|---|
email | Trimmed and lowercased email address used for account login and password recovery (absent for temporary Guest accounts). | Until you delete your account |
passwordHash | Managed by Firebase Authentication or hashed with Argon2id. Plaintext passwords are never stored or logged. | Until you delete your account |
plan | free or paid, derived from whether any store entitlement expiry is still in the future. | Until you delete your account |
accessExpiresAt | Timestamp of your current subscription end or active 6-hour rewarded ad access window. | Until you delete your account |
billingAccountToken | Opaque random UUID passed to Google Play / App Store so store renewal webhooks can be matched to your account without storing a payment receipt. | Until you delete your account |
providerExpiresAt | Per-store expiry timestamps reported by Google Play, Apple App Store, or Stripe. | Until you delete your account |
createdAt | Timestamp when the account record was created. | Until you delete your account |
Waitlist Reservations: If you join our early access waitlist on this website, we store your normalized email address, optional alias, optional X handle, target platform, and preferred server region in the waitlist collection until early access concludes or you request removal at /delete-account.
No Activity Logs & RAM-Only Nodes
We do not store a history of when you connected, which VPN server you selected, your source IP address, your assigned tunnel IP address, your DNS queries, the websites or IP addresses you visit, or the unblinded connection tokens that authorize a tunnel.
- Volatile RAM-Only Exit Nodes: VPN nodes keep active WireGuard® peers in process and kernel memory only. They do not write connection records to disk. Restarting a node drops all active tunnels immediately.
- Local Unbound DNS Resolver: Each VPN exit node operates an on-box Unbound recursive resolver configured with
logfile: "",use-syslog: no, and QNAME minimization (RFC 9156). DNS queries are never logged or forwarded to third-party DNS providers. - Redacted API Telemetry: Control-plane HTTP request logs record only
msg,route,status,durationMs, and error codes—never your email address, IP address, or bearer token.
Short-Lived Operational Keys
Short-lived operational state lives in memory-backed Redis configured with disk persistence disabled (save "", appendonly no). Every key expires automatically via a strict Time-To-Live (TTL):
| Ephemeral Key | Stored Value | Automatic Expiry (TTL) |
|---|---|---|
session:{id} | Authenticated account ID for active app session | 30 days (or revoked immediately on logout/deletion) |
grant:{id} | Temporary blind-signing grant metadata | 120 seconds (deleted immediately once signed) |
nonce:{value} | Rewarded ad nonce state (issued or earned, no account ID) | 15 minutes |
admob-tx:{transactionId} | Deduplication marker so a single ad reward is not applied twice | 48 hours |
rate:{bucket} | Abuse-prevention counter keyed by one-way SHA-256 hash (not raw IP) | 1 minute to 24 hours |
node:{id} | Server heartbeat (region, endpoint, WireGuard® public key, load) | 90 seconds |
Free Tier, Bandwidth Policy & Rewarded Ads
The Free Tier is supported by optional Google AdMob rewarded video ads:
- 6-Hour Access Windows: Watching one rewarded ad grants one 6-hour (21,600-second) VPN access window on designated Free Tier exit nodes, renewable via a new rewarded ad when the window expires.
- Fair Network Capacity: Automated per-peer traffic management ensures consistent WireGuard® performance across shared exit relays without inspecting or logging user traffic.
- AdMob Pre-Tunnel Disclosure: Because the rewarded ad must load and complete before the VPN tunnel starts, Google AdMob sees the real IP address and advertising identifiers of a Free Tier user during that ad request. We disclose this clearly here and in the Google Play Data Safety section.
- Paid Tier Does Not Initialize Ads: Pro subscribers never load or initialize the Google Mobile Ads SDK.
- EEA & UK Consent: In the European Economic Area, the United Kingdom, and Switzerland, the app presents Google's User Messaging Platform (UMP) consent dialog before requesting any personalized advertising.
Paid Tier & Store Billing
Android subscriptions are processed through Google Play Billing, iOS subscriptions through the Apple App Store, and desktop/web subscriptions through Stripe.
The payment store necessarily knows that you purchased a subscription. When your app presents a Google Play purchase token or App Store signed transaction to our API, we verify the purchase directly with the store, update your plan, accessExpiresAt, and opaque billingAccountToken, and immediately discard the raw purchase token and signed receipt. Paid connection tokens last at most 24 hours and are automatically rotated using blind signatures while your subscription remains active.
What We Do Not Claim
We believe in verifiable engineering claims rather than marketing hyperbole:
- Registered accounts have an email address stored in our account database, and Google Play, Apple, or Stripe know when a subscription purchase occurs.
- A global network observer capable of monitoring traffic simultaneously entering the VPN node and exiting toward a destination server may attempt timing or volume correlation.
- Those facts are why this Privacy Policy states “no activity logs” and “cryptographic unlinkability between account identity and exit traffic”, and deliberately never claims that any internet service makes you “100% anonymous” or “untraceable.”
Third-Party Sharing & Subprocessors
We do not sell your personal information, and we do not embed third-party analytics SDKs or crash-reporting SDKs. Data is shared only with the infrastructure providers required to operate the service:
- Google Play Billing: To verify Android subscription entitlements.
- Apple App Store: To verify iOS subscription entitlements.
- Stripe: To verify desktop and web subscription entitlements.
- Google AdMob: Only when a Free Tier user chooses to watch a rewarded ad to unlock a 6-hour access window.
- Google Firebase (Google Cloud): Used for Firebase Authentication, Cloud Firestore (account & waitlist records), Firebase App Check (device attestation against automated API abuse), and Firebase Remote Config.
Retention, Deletion & Your Privacy Rights
You have the right to access, export, or permanently delete your account data at any time:
- Instant In-App Deletion: Open the Shuriko VPN Android app and navigate to
Settings → Account & Access → Delete Account Permanently. Confirming deletion immediately erases your Firestoreaccounts/{id}document and revokes all active Redis session keys. - Web-Based Account & Waitlist Deletion: If you have uninstalled the app or wish to delete your data from a browser, use our dedicated Account & Data Deletion Portal at
/delete-account. - Zero Node Data to Delete: Because WireGuard® exit nodes never receive your account ID or email and store no connection logs on disk, there is no historical tunnel activity tied to your identity.
Contact & Data Controller
For privacy inquiries, data protection requests (GDPR / UK GDPR / CCPA), or questions regarding this Privacy Policy, contact the service operator: