Cookie Policy

Effective date: 01.07.2026 | Version: 1.0

1. About this Cookie Policy

This Cookie Policy explains how GURU NETWORK S.R.L. ("we", "us", "our") uses cookies on our website guruvpn.com and SDK-based identifiers or similar technologies in connection with Guru VPN mobile applications. It supplements our Privacy Policy and should be read together with the Privacy Policy, No-Logs Policy, Terms of Service, Fair Usage Policy, Acceptable Use Policy, Transparency Report & Warrant Canary, and, where relevant, Refund Policy.

Cookies are primarily website/browser technologies. Mobile applications do not normally use browser cookies in the same way as websites; instead, they may use SDK-based identifiers, platform identifiers, local app storage, push tokens, subscription identifiers, attribution identifiers, crash/diagnostic identifiers, and similar app technologies.

Our no-logs commitment concerns communications content, traffic payloads, full URLs and page content carried through the VPN tunnel. It does not exclude the collection of VPN connection analytics, IP addresses or DNS request records. Those categories are disclosed in the Privacy Policy and No-Logs Policy.

Amplitude receives VPN connection start/end events, IP addresses and user/device/session identifiers. Events may contain the original IP before connection or a VPN exit IP after connection. These event records are exported to BigQuery. Other integrated providers may process technical identifiers, device/network information and IP data for the purposes described here and in the Privacy Policy. Using a third-party SDK does not place this processing outside the scope of our privacy disclosures.

2. What cookies and SDK-based identifiers are

A cookie is a small file or similar browser storage technology that may contain an identifier and is stored by a web browser. A session cookie usually expires when the browser session ends. A persistent cookie may remain until its expiration date or until the user deletes it.

SDK and account identifiers include the random registration UID, Amplitude user/device/session IDs, Firebase identifiers, RevenueCat IDs, attribution identifiers, push tokens and purchase-verification references. IDFA/GAID may be used where available and permitted. A random UID can link records to the same account and is not automatically anonymous. A new registration creates a new UID without erasing records associated with the old one in other systems. These identifiers are not browser cookies.

3. Categories of cookies, SDK identifiers and similar technologies we may use

The categories below apply where the relevant website component, app feature, SDK or integration is enabled. Additional information about cookies and SDK identifiers can be requested from privacy@guruvpn.com. The Privacy Policy also lists the known sources and identifier fields exported to BigQuery.

3.1. Essential / Strictly necessary website cookies and technical app storage

Purpose: Enable core website and service functionality, such as authenticated sessions, secure payment flows, CSRF protection, consent records, correct routing via CDN/WAF, security checks, and delivery of essential website resources. In mobile apps, equivalent technical functions may rely on local app storage, platform APIs, or technical app identifiers rather than browser cookies.

Retention: Session-only or for the period necessary to support the feature; "remember me" or similar security/session features may last up to approximately 30 days unless configured otherwise.

Legal basis: Consent is not required where the technology is strictly necessary to provide the website, app, account, payment, security, or requested service functionality, but transparency is required.

If blocked or disabled: login, account access, payment flows, security checks, consent preferences, or core website/app functionality may not work correctly.

Examples: session IDs, authentication tokens, CSRF tokens, consent-state cookies, secure payment or routing cookies.

Scope: essential storage supports website, account and app functions. The collection of connection metadata, IP-bearing analytics and DNS request records is described separately in the Privacy Policy and No-Logs Policy.

3.2. Functional cookies and app preference identifiers

Purpose: Remember user choices and preferences, such as language, region, theme, interface settings, cookie preferences, and last-used non-sensitive options. On mobile apps, similar preferences may be stored through local app storage or app settings rather than browser cookies.

Retention: From the session duration to approximately 1 year, depending on the feature and user choice.

Legal basis: Legitimate interests or consent, depending on the jurisdiction, technology, and privacy impact. Where required, we request consent and allow withdrawal.

If blocked or disabled: preferences may not persist and the service experience may be less convenient.

Examples: language preference, theme preference, consent flags, preference-center settings.

Scope: preference storage remembers interface choices. It should not be read as a statement that separate connection or analytics records do not exist.

3.3. Performance, diagnostics and analytics cookies / SDK identifiers

Purpose: measure website/app use, VPN connection success, error rates, reliability, conversion funnels and product performance. Analytics may contain individual events and identifiers even when reports show aggregate metrics. Website analytics may use cookies; mobile analytics may use SDK identifiers. Connection diagnostics are collected manually only in occasional troubleshooting cases.

Retention: provider-side analytics retention depends on the relevant configuration. BigQuery copies have no configured fixed expiration and remain while the warehouse service is maintained. Manual connection diagnostics are collected over up to one day and deleted immediately after analysis; they are not collected automatically. Cookie or identifier expiry does not necessarily delete previously collected events.

Legal basis: Consent where required, particularly in the EU/UK for non-essential analytics cookies or mobile tracking. Aggregated, anonymised, or strictly necessary diagnostics may be processed based on legitimate interests or performance of contract where permitted.

If blocked or disabled: we may receive less diagnostic and performance information, which can limit troubleshooting and product improvement.

Examples: Amplitude, Firebase/Google Analytics, Plausible and other integrated measurement tools. Amplitude receives VPN start/end events, IP addresses and user/device/session identifiers. This analytics collection is separate from occasional manual connection diagnostics.

Scope: no VPN communications content, traffic payloads, full URLs or page content are retained under this category. VPN start/end events and IP addresses can be associated with persistent analytics identifiers; they are not described as anonymous aggregate data.

3.4. Advertising, marketing and attribution cookies / SDK identifiers

Purpose: Where implemented and where required consent has been obtained, measure marketing campaigns, attribute installs or conversions, manage affiliate or referral campaigns, and, where applicable, support advertising or retargeting. Mobile attribution may involve advertising identifiers such as IDFA/GAID or SDK-specific attribution identifiers, subject to platform rules.

Retention: cookie and identifier lifetimes depend on the relevant provider and settings. Campaign and conversion datasets exported to BigQuery, including Singular and Keitaro data, currently have no configured fixed expiration. Expiry or deletion of a cookie does not by itself erase these stored datasets.

Legal basis: Explicit consent where required. On iOS, App Tracking Transparency rules may apply. On Android, advertising ID and platform consent rules may apply. Profiling or targeted advertising requires clear disclosures and opt-out or withdrawal mechanisms where required.

If blocked or disabled: marketing attribution and personalized advertising may be limited or unavailable, but core paid VPN functionality should remain available unless a specific feature depends on the identifier.

Examples: advertising pixels, campaign and affiliate identifiers, AppsFlyer or other enabled attribution tools, Singular campaign measurement, Keitaro conversion measurement, and advertising IDs where enabled. The BigQuery inventory in the Privacy Policy describes which identifiers are included in the listed exports.

Scope: DNS request records are not currently used for advertising, attribution or individual browsing profiles. The separate existence of IP-bearing connection analytics and DNS records is disclosed in the Privacy Policy; these records are not excluded merely because analytics or attribution uses a third-party service.

3.5. Security and anti-fraud cookies / identifiers

Purpose: Protect accounts, payment flows, forms, infrastructure, and the Service against automated attacks, fraud, abuse, suspicious signups, credential attacks, and bot activity. These technologies may support CAPTCHA, rate-limiting, payment-risk checks, device risk signals, and infrastructure security.

Retention: Session-only to several months, depending on the provider configuration, risk event, and documented security purpose.

Legal basis: Legitimate interests in security, fraud prevention, and service integrity, subject to necessity, proportionality, and applicable law. Consent may be required for non-essential third-party tracking elements in some jurisdictions.

If blocked or disabled: some forms, payment flows, account changes, or security checks may fail or require additional verification.

Examples: CAPTCHA tokens, fraud-prevention identifiers, secure routing cookies, WAF/CDN security cookies, payment-risk identifiers where implemented.

No-logs limitation: These technologies are for website, account, payment, app, and infrastructure security. They do not involve full traffic-content monitoring, routine inspection of user communications, maintaining browsing histories, or user-linked DNS logging.

3.6. Third-party and embedded content cookies

Purpose: Where we embed third-party content, such as videos, maps, support widgets, app-store widgets, or similar tools, those providers may set cookies or collect technical identifiers when the content loads or when you interact with it.

Retention: Determined by the relevant third party and its configuration.

Legal basis: Depends on the provider and cookie type. Non-essential third-party cookies typically require consent before being set, especially in the EU/UK.

If blocked or disabled: embedded content may not load or may require additional consent before activation.

Examples: video, map, support, app-store, or social content cookies where such features are implemented.

Scope: loading embedded content can disclose technical information to its provider. Its own notice may apply to independent processing; our use of providers in connection with the Service remains subject to the Privacy Policy.

3.7. Social login, sharing and social media cookies

Purpose: Where implemented, support social login, sharing features, or limited social interaction features. Social providers may set cookies or process identifiers according to their own privacy notices and platform rules.

Retention: Vendor-dependent and subject to the relevant provider's settings.

Legal basis: Consent is required for tracking, targeting, or cross-site social analytics where applicable. Social login may also involve authentication and security processing necessary for the requested login flow.

If blocked or disabled: social login or sharing features may be unavailable or may require additional steps.

Examples: Apple or Google sign-in where offered, and any sharing features that are enabled. Provider-side processing is subject to the relevant privacy notice and applicable law.

Scope: social login supports authentication. The connection, DNS and analytics disclosures in the Privacy Policy remain applicable.

3.8. Application / SDK identifiers (mobile and in-app)

Purpose: Purpose: mobile identifiers support account authentication, subscriptions, purchase verification, install attribution, push notifications, in-app analytics, fraud prevention and enabled app functions. Amplitude uses identifiers to associate VPN connection events and IP addresses with analytics profiles. Manual diagnostics are a separate occasional process.

Retention: account deletion removes the primary user record and linked connection records but does not automatically purge all SDK, analytics, payment or warehouse data. Old identifiers may remain after associated customer profile data is removed. BigQuery exports have no configured fixed expiration. Provider-side retention and lawful exceptions are described in the Privacy Policy.

Legal basis: contract for necessary account, subscription and purchase-verification functions; legal obligations where applicable; legitimate interests for necessary and proportionate security or reliability processing where permitted; consent for non-essential analytics, attribution or tracking where required.

If blocked or disabled: the effect depends on the identifier and available control. Subscription restoration, purchase verification or push delivery may be affected where they depend on it. Changing browser cookies or advertising-ID permissions does not itself erase existing Amplitude profiles or BigQuery exports.

Examples: registration UID, Amplitude user/device/session IDs, RevenueCat IDs, Firebase identifiers and push tokens, OneSignal identifiers, app-store purchase references, and advertising or attribution identifiers where enabled.

Scope: SDK data can include VPN connection events and IP addresses. SDK identifiers are not browser cookies and are not evidence that all collected data is anonymous. VPN communications content, traffic payloads, full URLs and page content are not retained as activity logs.

3.9. Consent and preference management cookies / identifiers

Purpose: Store or recall your privacy choices, such as accepted/rejected categories, region-specific consent state, withdrawal status, and the policy version shown to you. This prevents repeated consent prompts and supports compliance documentation.

Retention: Typically 6 months to 2 years, unless a shorter period is configured or required by law.

Legal basis: Necessary for compliance with consent and documentation obligations and/or legitimate interests in maintaining privacy preferences.

If blocked or disabled: you may be asked to provide cookie or SDK choices more often, and your settings may not persist.

Examples: cookie_consent, consent_settings, opt_out, preference-center identifiers.

No-logs limitation: Consent records should be minimized and, where possible, stored through pseudonymous consent identifiers rather than unnecessary direct identifiers.

4. How we manage consent and third-party technologies

Available consent and preference controls depend on the website/app version, platform and technology. Where presented, a cookie banner or preference centre allows choices by category; mobile settings and platform permissions may provide separate controls.

Where applicable law requires consent, non-essential cookies and SDK-based tracking require that consent. Acceptance of these policies or continued use does not substitute for consent where it is required. This Policy does not imply that every SDK can be disabled through browser cookie settings.

You can withdraw or change consent through the cookie banner, preference center, in-app settings, device settings, or by contacting privacy@guruvpn.com, depending on the technology and platform.

We keep minimized consent records or pseudonymous consent identifiers showing what choices were made, when, and which policy version was shown. We avoid storing more personal data than necessary for consent documentation.

We maintain and periodically review a cookie/SDK inventory, including names, provider/domain, category, purpose, retention, and recipients where applicable. The inventory should be updated after material website, app, SDK, or vendor changes.

Where we rely on legitimate interests for security, fraud prevention, or necessary diagnostics, we document necessity, proportionality, and safeguards where required.

Where third-party providers process data on our behalf, we apply appropriate contractual safeguards, including data processing terms where required. Where providers act independently, their own privacy/cookie notices also apply.

5. Third-party services and processors that may set cookies or process SDK identifiers

Depending on integration, region, platform, consent status, and user settings, the following categories of third parties may set cookies or process SDK-based identifiers through the website, mobile apps, checkout flows, or related services:

Analytics and measurement: Amplitude, Firebase/Google Analytics, Plausible and other enabled providers. Occasional manual connection diagnostics are described in the Privacy Policy and are not an automatic diagnostic collection process.

Subscription management and billing: RevenueCat, Stripe, Apple App Store, Google Play, and related checkout or purchase-verification systems where implemented.

Push notifications: Firebase Cloud Messaging and, where applicable, OneSignal or other platform push-notification services.

Attribution, advertising and affiliate measurement: AppsFlyer, Singular, Keitaro and selected partners where enabled, subject to required consent or platform permission. Communications may also be sent through Brevo as described in the Privacy Policy.

Security and anti-fraud: reCAPTCHA, WAF/CDN security tools, payment-risk tools, or other bot/fraud prevention providers where implemented.

Embedded content and social features: video, map, support widget, social login, or sharing providers where those features are actually implemented.

BigQuery in the United States stores exports from Amplitude, Firebase, OneSignal, Singular, Stripe and Keitaro. The Privacy Policy gives the exported record categories and identifier fields. DNS exports from the logging system are a separate dataset. Metabase queries the primary database and BigQuery live; its cache contains SQL text rather than query results. Contact privacy@guruvpn.com for information about providers relevant to your use of the Service.

Third-party cookies and SDK processing are governed by the relevant providers' own privacy and cookie notices. Where required, we disclose such providers, obtain consent, and apply contractual safeguards. We are not responsible for a third party's independent processing outside our control, but we will take reasonable steps required by applicable law for providers used in connection with our Service.

6. How to manage, disable or delete cookies and SDK-based identifiers

6.1. Web browser

You can block or delete cookies through your browser settings, including Chrome, Firefox, Safari, Edge, or other browsers.

You can use our cookie banner or preference center, where presented, to accept, reject, or change choices for non-essential cookies such as analytics, advertising, or third-party content cookies.

You may disable non-essential cookies at any time. Blocking essential cookies may affect login, payment, security, consent preferences, or core website functionality.

6.2. Mobile applications

Mobile apps may use registration, user, device and session identifiers, advertising or attribution identifiers where enabled, subscription/purchase references and push tokens. Amplitude receives VPN connection events and IP addresses, including original or exit IP depending on the event. These records can persist in provider systems and BigQuery after the app is removed.

Use available app privacy controls, iOS tracking permissions, Android advertising-ID settings, app permissions or notification settings for the relevant technology. These controls have different scopes: a tracking permission or cookie setting is not a general deletion request for all stored analytics. Contact privacy@guruvpn.com to exercise applicable privacy rights.

Uninstalling the app is separate from account deletion and erasure of server-side data. Provider-held SDK identifiers, billing or app-store records, analytics events, push records and warehouse exports may remain. Deleting the primary account does not currently send automatic deletion instructions to Amplitude, Stripe, RevenueCat or Brevo. A new registration receives a new UID; it does not clear old history from those systems.

To request deletion or anonymisation of cookie-derived data, SDK identifiers, or provider-held records, contact privacy@guruvpn.com. We will handle such requests as described in the Privacy Policy and applicable provider deletion workflows.

7. Retention, deletion and limitations

Cookie/identifier lifetimes and retention of derived records are different. The periods stated for website cookies or preferences do not set the retention of existing analytics events or warehouse exports. Personal Data remains subject to applicable purpose and storage-limitation requirements.

BigQuery copies from the six listed sources have no configured fixed expiration and remain while the warehouse service is maintained. DNS records have a 14-day retention in the logging system, but their BigQuery copies do not inherit that period. Database backups remain for no more than 14 days; VPN servers have no backups. Standard operational logs are kept for 14 days. Manual connection diagnostics are collected over up to one day and deleted immediately after analysis.

Primary account deletion does not automatically remove every old identifier or record in analytics, payment, communications or warehouse systems. Removing associated customer profile data does not itself make the remaining records anonymous. Contact privacy@guruvpn.com to request erasure of remaining Personal Data. Requests and any lawful retention exception are handled under the Privacy Policy; provider settings do not remove statutory rights.

8. Children

The Service is not intended for persons under 18. We do not knowingly use cookies or SDK-based identifiers to collect Personal Data from children under 18. If you believe we have collected data from a child, contact privacy@guruvpn.com or support@guruvpn.com.

9. Changes to this Cookie Policy

We may update this Cookie Policy from time to time. Material changes will be posted with a new effective date and, where appropriate, notified to users through the Service or other reasonable means. Continued use after publication of changes constitutes acceptance of the updated Policy to the extent permitted by applicable law.

10. Cross-references

This Cookie Policy should be read together with our Privacy Policy, No-Logs Policy, Terms of Service, Fair Usage Policy, Acceptable Use Policy, Transparency Report & Warrant Canary, and, where relevant, Refund Policy. Where cookie or SDK processing involves third parties, their own privacy/cookie notices and platform rules may also apply.

11. Contact information and requests

For questions about this Cookie Policy, to withdraw consent, to request deletion or anonymisation of cookie-derived data or SDK identifiers, or to ask for the current cookie/SDK inventory, contact: privacy@guruvpn.com or support@guruvpn.com.

For requests involving third-party providers, we will, where possible and legally required, submit deletion or anonymisation requests on your behalf or provide instructions for contacting the relevant provider directly. We will document the outcome where required.

Last updated: 01.07.2026