1. Who is responsible for the data
The Duga VPN app is developed and published by Liberty Holding s.r.o., IČO 21889228, address: Plynární 1617/10, Holešovice, 170 00 Praha 7, Czech Republic. Liberty Holding is responsible for account, device, diagnostic log and support data.
Access to Duga is sold by LLC “Tsifrovoy Servis”, OGRN 5187746012328, INN 9725000741, KPP 026801001, address: 453118, Republic of Bashkortostan, Sterlitamak, Khudaiberdina St., bldg. 150a, 2nd floor, office 1. LLC “Tsifrovoy Servis” is responsible for payment and refund data.
For any question about your data, write to support@duga.world.
2. What data we process
Account. Your email address, if you sign in with a code from an email or through Google. From Google we receive only your email address and Google account identifier. Without signing in, the app works in guest mode.
Device. Identifiers of the device and of the app installation, the device name, platform and model, and where the app was installed from: the store or the website, the link or invitation, and the website visit that led to it.
Diagnostic log. App and system version, errors and crashes, rejected requests to the service, VPN status, connection check results, network type, the mobile operator code of the SIM card, stops of the app by the system, and the battery, power saving and notification modes for the app. The app sends the log automatically from the first launch; sending cannot be turned off. After sign-in, the log is linked to the device and through it to the account: this is how support finds the log for a request.
Support. Support chat messages and the files attached to them. The app and system version, VPN status, network type and operator code are added to a request automatically. If you write to support on Telegram, we also receive the name, username, ID, language and profile photo of your Telegram account. Telegram conversations are not linked to your Duga account and are not deleted with it.
Payment. Email address for the receipt, the amount, status and identifiers of the payment, and the data passed on by the payment provider. On the website, we send the payment link to the email of the account we find by the address you enter. Some payment providers also receive your IP address. Bank card data is entered on the provider’s side; Duga neither receives nor stores it.
Bonus program. The link between the inviter’s and the invitee’s accounts, credited bonuses and, once bonus withdrawal becomes available, a crypto wallet address for the payout.
IP address. The service uses the IP address of a request to protect itself against overload and abuse. The service does not determine location from the IP address.
Website. The duga.world website counts visits with Google Analytics and with its own statistics. Google receives the address of the page you open and of the site you came from, clicks and scrolling, the device type, browser and language, and an approximate location derived from the IP address. For this, the website stores Google Analytics cookies in your browser for up to 2 years. The website’s own statistics are visits (the page, its language and the site you came from) and clicks on the download buttons, together with the labels of the link or invitation you came through. For them, the website keeps in your browser a random visitor number, the time it was created and the time of the last page you opened, and the labels of the link or invitation you came through; the number is used for 30 days and is replaced with a new one on your next visit after that. The website writes the number and the labels into the downloaded file or into the Google Play link to link the visit with the app installation. PostHog receives this information; after you click the Google Play button, Google also receives the number and the labels written into the link. By continuing to use the website, you agree to this. You can opt out by blocking cookies and site data for duga.world in your browser settings, and opt out of the website’s own statistics by also blocking JavaScript for duga.world: the download buttons work without it too, using plain links without labels.
3. What we do not collect
Duga does not keep a log of the websites and services you open through the VPN and does not store the content of your traffic. The app does not collect location, the advertising identifier, hardware device identifiers, the list of installed apps or contacts. The data is not used for advertising.
4. Why we need the data and on what legal basis
- access to the service, the account and devices — to perform our contract with you;
- payments, receipts and refunds — to perform the contract and meet accounting requirements;
- diagnostic log and support — to select a working connection, find and fix failures and respond to requests; the legal basis is our legitimate interest in keeping the service working;
- website visit and installation statistics — to understand how people find the website, where they get lost on it and which links and invitations bring them to the app; the legal basis is your consent, which you give by continuing to use the website;
- protection against abuse — our legitimate interest: for example, a deleted account cannot be signed into again with the same email address.
5. Who receives the data
The data is processed by services acting on our behalf:
- VDSina hosting: the service’s servers, databases and support chat, VPN nodes;
- Yandex Cloud CDN (Russia): delivery of encrypted VPN traffic to the nodes;
- PostHog (USA): the diagnostic log, service events (registration and linking of devices, rejected requests, issuing of VPN settings, the trial period, payments, invitations), the website’s own statistics and where the app was installed from;
- Google (USA): sign-in with Google, website visit statistics and the installation label from Google Play;
- Namecheap: sending emails with sign-in codes and payment links, and the support mailbox;
- payment providers: payment, cancellation and refund of payments.
If you write to support on Telegram, Telegram also receives the conversation and processes it under its own privacy policy.
The data is transferred to countries outside the European Union and Russia, including the USA. We transfer only what is needed for the service to work.
6. How long the data is kept
- account, device and in-app support chat message data — for as long as the account exists;
- files attached to support chat messages — 90 days after sending;
- data of a device not signed in to an account — until you delete it: to do so, sign in to an account and delete it;
- diagnostic log — for as long as it is needed for support and troubleshooting;
- website visit statistics in Google Analytics — 14 months;
- the website’s own statistics — for as long as they are needed to understand where people come from; the visitor number in the browser — used for 30 days, then replaced with a new one on your next visit;
- sign-in code — 10 minutes, the email address it was sent to — 1 day, sign-in session — 30 days;
- payment link — 1 hour, a fingerprint of the email address entered on the payment page, used to count the request limit — 1 day;
- service records of sign-ins, VPN keys and requests to the service — 90 days after they stop being valid;
- payment records and the email address for receipts — 5 years, as required by accounting law.
7. Data deletion
You can delete your account in the app: Account → Rules and data → Data deletion → “Delete data” (in the app’s Russian interface: Аккаунт → Правила и данные → Удаление данных → «Удалить данные»). Without the app, write to support; the procedure is described on the Account Deletion page.
After deletion, the account email address, in-app support chat correspondence and files, invitation codes, and device names and models are erased. Devices are signed out of the account and the account’s VPN keys are revoked: they can no longer be used to connect.
The following remain:
- payment records with the email address for receipts and balance records — 5 years, as required by accounting law;
- a fingerprint of the email address and sign-in identifier from which the address cannot be recovered: it prevents signing into the deleted account again;
- device records without name and model;
- records of revoked VPN keys and sign-in sessions — 90 days;
- diagnostic log entries that have already been sent.
Unpaid bonuses are forfeited upon deletion.
8. Your rights
You may request access to your data, its rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Send your request to support@duga.world; you will receive a reply within 30 days. If you are in the European Union, you may lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů, or with the supervisory authority of your country.
9. Changes to the policy
A new version is published on this page with its date at the beginning of the document.