1. Who is responsible for the data
The Duga VPN app is developed and published by Liberty Holding s.r.o., IČO 21889228, address: Plynární 1617/10, Holešovice, 170 00 Praha 7, Czech Republic. Liberty Holding is responsible for account, device, diagnostic log and support data.
Access to Duga is sold by LLC “Tsifrovoy Servis”, OGRN 5187746012328, INN 9725000741, KPP 026801001, address: 453118, Republic of Bashkortostan, Sterlitamak, Khudaiberdina St., bldg. 150a, 2nd floor, office 1. LLC “Tsifrovoy Servis” is responsible for payment and refund data.
For any question about your data, write to support@duga.world.
2. What data we process
Account. Your email address, if you sign in with a code from an email or through Google. From Google we receive only your email address and Google account identifier. Without signing in, the app works in guest mode.
Device. The identifier that the service assigns to the device, its name, platform and model, as well as a random identifier of the app installation.
Diagnostic log. App and system version, errors and crashes, rejected requests to the service, VPN status, connection check results, network type and the mobile operator code of the SIM card. The app sends the log automatically from the first launch; sending cannot be turned off. After sign-in, the log is linked to the device and through it to the account: this is how support finds the log for a request.
Support. Support chat messages and the files attached to them. The app and system version, VPN status, network type and operator code are added to a request automatically.
Payment. Email address for the receipt, the amount, status and identifiers of the payment, and the data passed on by the payment provider. When you pay through FreeKassa, the provider also receives your IP address. Bank card data is entered on the provider's side; Duga neither receives nor stores it.
Bonus program. The link between the inviter's and the invitee's accounts, credited bonuses and, once bonus withdrawal becomes available, a crypto wallet address for the payout.
IP address. The service uses the IP address of a request to protect itself against overload and abuse. The service does not determine location from the IP address.
Website. The duga.world website counts visits with Google Analytics. Google receives the address of the page you open and of the site you came from, clicks and scrolling, the device type, browser and language, and an approximate location derived from the IP address. For this, the website stores Google Analytics cookies in your browser for up to 2 years. By continuing to use the website, you agree to this. You can opt out by blocking cookies for duga.world in your browser settings.
3. What we do not collect
Duga does not keep a log of the websites and services you open through the VPN and does not store the content of your traffic. The app does not collect location, the advertising identifier, hardware device identifiers, the list of installed apps or contacts. The data is not used for advertising.
4. Why we need the data and on what legal basis
- access to the service, the account and devices — to perform our contract with you;
- payments, receipts and refunds — to perform the contract and meet accounting requirements;
- diagnostic log and support — to select a working connection, find and fix failures and respond to requests; the legal basis is our legitimate interest in keeping the service working;
- website visit statistics — to understand how people find the website and where they get lost on it; the legal basis is your consent, which you give by continuing to use the website;
- protection against abuse — our legitimate interest: a deleted account cannot be signed into again with the same email address.
5. Who receives the data
The data is processed by services acting on our behalf:
- VDSina hosting: the service's servers, databases and support chat, VPN nodes;
- Yandex Cloud CDN (Russia): delivery of encrypted VPN traffic to the nodes;
- PostHog (USA): the diagnostic log and service events — rejected requests, issuing of VPN settings, payment outcomes;
- Google (USA): sign-in with Google and website visit statistics;
- Namecheap: sending emails with sign-in codes and the support mailbox;
- payment providers ENOT, Lava, FreeKassa (Russia): payment, cancellation and refund of payments.
The data is transferred to countries outside the European Union and Russia, including the USA. We transfer only what is needed for the service to work.
6. How long the data is kept
- account, device and support chat data — for as long as the account exists;
- diagnostic log — for as long as it is needed for support and troubleshooting;
- website visit statistics in Google Analytics — 14 months;
- sign-in code — 10 minutes, sign-in session — 30 days;
- payment records and the email address for receipts — 5 years, as required by accounting law.
7. Data deletion
You can delete your account in the app: Account → Rules and data → Data deletion → “Delete data” (in the app's Russian interface: Аккаунт → Правила и данные → Удаление данных → «Удалить данные»). Without the app, write to support; the procedure is described on the Account Deletion page.
After deletion, the account email address, support chat correspondence and files, invitation codes, and device names and models are erased. Devices are signed out of the account and the account's VPN keys are revoked: they can no longer be used to connect.
The following remain:
- payment records with the email address for receipts and balance records — 5 years, as required by accounting law;
- a fingerprint of the email address and sign-in identifier from which the address cannot be recovered: it prevents signing into the deleted account again;
- device records without name and model;
- records of revoked VPN keys and sign-in sessions;
- diagnostic log entries that have already been sent.
Unpaid bonuses are forfeited upon deletion.
8. Your rights
You may request access to your data, its rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Send your request to support@duga.world; you will receive a reply within 30 days. If you are in the European Union, you may lodge a complaint with the Czech supervisory authority, Úřad pro ochranu osobních údajů, or with the supervisory authority of your country.
9. Changes to the policy
A new version is published on this page with its date at the beginning of the document.