MOROKPrivacy Policy
1. General provisions
This policy describes what data IPFB LLC (1207 Delaware Ave #1262, Wilmington, DE 19806, USA; hereinafter “we”) processes when operating the MOROK service: the MOROK apps for iPhone and iPad, Android, Windows, macOS and Linux, the website morok.io, the account area panel.morok.io and the service’s servers. Our principle is to keep only what is essential to provide access and record payments.
2. What we do not collect or store
- the addresses of websites and services you access through MOROK, or the content of your traffic;
- the IP addresses of visitors to the website and the account area — web server logs are disabled (the exceptions are described below);
- bank card details — payment takes place on the payment provider’s side;
- data from third-party analytics systems and advertising trackers — neither the website nor the account area has any; which cookies and browser storage entries the website and the account area use, and which of them are turned on only with your consent, is described in Section 9.
The exception is protection against guessing and abuse. When you request a login code, a free trial or test access, the service stores the IP address (for the trial, the address’s network) together with that request, so that codes cannot be brute-forced and the trial cannot be obtained again. If guessing comes from a single address, that address is written to a service log and included in a notification to the administrator. The servers’ system logs may contain the IP addresses of incoming connections; they are used only to protect the servers from attacks and are overwritten automatically.
In addition, the number of requests from a single IP address to the app crash-report intake is counted in memory only, for no more than one hour, to protect it from abuse. That address is not written to disk and does not appear in any log.
3. What data we store and why
| Data | Why it is needed |
|---|---|
| The email address the account was created with | Logging in to the app and the account area, identifying the account, making sure the free trial is used only once |
| One-time login code — only while it is valid | Confirming a login with your email address |
| Session cookie set after you log in to the account area (strictly necessary; valid for 7 days from your last request to the service — each request extends it — or until you log out), and the login session in the MOROK app | Only to keep you signed in to your account |
| Technical account identifier and personal connection link | Connecting your devices to the service |
| Subscription period, whether the free trial has been used, bonus days, the referring account, if any | Recording paid access and bonuses |
| Total traffic volume per account (not broken down by websites or addresses) | Operating the service and planning server load |
| Number of simultaneously connected devices and time of the last connection | Enforcing the limit of 3 devices per account |
| The account’s country, determined from the connection network (the IP address itself is not stored for this), and counters of connections by day and country for the last 30 days | So that the sites of your country open directly |
| Type and version of the app used to load the connection settings | Helping the user with setup and support requests |
| Payment records: order number, amount, currency, payment method, status, the payment provider’s transaction ID, date | Recording payments, refunds, resolving disputes |
| Log of account operations (granting the free trial, renewal) — without IP addresses | Support and resolving disputes |
| Log of service emails: which email (template), when and for which account (by its technical ID) was sent and whether sending succeeded — without the email address and without the content of the email | Support: to tell whether a sign-in code, reminder or receipt email went out, and to look into “the email did not arrive” reports |
| Anonymous app crash reports — daily totals only: error type, its anonymised text and place in the code, app version, platform, number of repeats. No account, device, email address or IP address; addresses, links, long numbers and identifiers, and file paths are automatically stripped from the error text | Finding and fixing app errors |
| Email address or Telegram username and message text — only if you write to us yourself | Replying to your request |
We process this data to perform our agreement with you (the Terms of Service) and to meet our obligations to record payments.
4. Sharing data with third parties
We do not sell user data and do not share it for advertising. Data is processed by the following parties only to the extent necessary for the service to work:
- Payment provider — accepts payment on its own page and under its own rules; it may ask you for additional data (for example, an email address). From the provider we receive only the order number, amount, currency, payment method and payment status.
- Apple and Google — distribute the MOROK apps through their app stores, deliver push notifications and provide sign-in with Apple ID or a Google account if you choose it. Downloading and updating the apps are governed by the terms and privacy policies of those companies.
- Google’s email service — sends the login-code emails and access notifications; it receives your email address and the text of the email.
- Telegram — carries our support channel @morokio_support_bot if you write to us there; data processing in Telegram is governed by Telegram’s privacy policy.
- SmartBTN support chat — powers the chat on the website and in the account area if you have allowed the “Support chat” category and write in the chat; it receives the conversation and whatever you choose to tell us there.
- Hosting providers — provide the servers on which the service runs.
We may disclose data upon a lawful request from competent authorities — only the data we have, as listed in Section 3. We have no information about the resources you visit or the content of your traffic.
5. Where data is stored
Account and payment data is stored on servers of the hosting providers the service works with. Backups are stored encrypted.
6. Retention periods
- Account data is kept for as long as the account exists. At your request, we delete the account and the data associated with it within 30 days.
- Your email address is kept for as long as the account exists and is deleted together with it at your request. A login session ends when you log out or after 7 days without requests to the service; each request extends it by another 7 days.
- Payment records are kept for as long as necessary for accounting, refunds and legal requirements, but for no longer than 5 years.
- IP addresses stored to protect against guessing and abuse are kept no longer than this purpose requires.
- Correspondence with support is kept no longer than needed to resolve the matter, and for no more than 1 year.
- Connection counters by day and country are kept for 30 days; the account’s country is kept as long as the account exists.
- The service email log is kept for 400 days and anonymous app crash reports for 90 days; they are then deleted automatically.
7. Security
Only staff who need data to operate the service have access to it. Administrative interfaces are closed to public access, and data is transmitted only over encrypted channels.
8. Your rights
You can ask what data about you is stored, request that it be corrected or deleted, and withdraw your consent to processing by stopping using the service. Write to us at support@morok.io and include the email address of your account or your order number — we will reply within 30 days. Deleting the account ends access to the service.
9. Website, cookies and browser storage
The website morok.io and the account area panel.morok.io use no advertising trackers and no third-party analytics systems. Strictly necessary cookies and browser storage entries are always on: without them sign-in and the protection of the sign-in form do not work. Everything else is turned on only with your consent.
Cookies and browser storage
| Name and where it is stored | Category | Purpose | Lifetime |
|---|---|---|---|
morok_consent — cookie on morok.io and panel.morok.io | Strictly necessary | Remembers your choice in the cookie banner so we do not ask again | 12 months |
lang — cookie on morok.io and panel.morok.io | Strictly necessary | Remembers the website language you picked with the RU/EN switch, so pages open in it | 12 months (after an old /en/ link — until you close the browser) |
refresh_token — cookie on panel.morok.io, not readable by page scripts (HttpOnly) | Strictly necessary | Login session: keeps you signed in | 7 days from your last visit to the account area, or until you log out |
morok_oauth_bind, morok_oauth_bind_g — cookies on panel.morok.io (HttpOnly) | Strictly necessary | Protect Sign in with Apple and Google against forged requests | 10 minutes |
morok.cab.device — browser storage (localStorage) on panel.morok.io | Strictly necessary | A random number for this browser in the list of your devices in the account area | Until you clear the site data |
morok.cab.s — browser storage (localStorage) on panel.morok.io | Strictly necessary | A “signed in” mark so the account area opens without the sign-in screen | Until you log out |
| Anonymous visit counter — stores nothing in your browser | Analytics | Daily totals of page views and button clicks, with no cookies, IP address or visitor identifier | — |
SmartBtnClient — SmartBTN chat cookie on morok.io and panel.morok.io; smartbtn_node_state and smartbtn:widget-header:… entries in browser storage (localStorage) | Support chat | Recognise you the next time you open the chat and show the conversation history; remember the working chat server and the window header in your language | Cookie: 400 days; entries: until you clear the site data; removed when you withdraw consent |
On your first visit the website shows a banner: you can accept all, keep only the strictly necessary ones, or choose categories one by one. Until you choose, analytics and the support chat are not loaded. You can change or withdraw your consent at any time via the “Cookie settings” link in the website footer or in the Settings section of the account area; when you withdraw consent for the chat, we remove its entries from your browser.
We honour the Global Privacy Control (GPC) signal: if your browser sends it, analytics stays off even if you click “Accept all”. We do not sell your personal information or share it for advertising (including within the meaning of the California CCPA/CPRA).
10. Children
The service is not intended for persons under 18 without the consent of a legal guardian.
11. Changes to this policy
We may update this policy. A new version is published on this page with its date. If the changes expand the range of data collected, we will notify you in advance on the website and by email.
12. Contacts
For questions about data processing: IPFB LLC, 1207 Delaware Ave #1262, Wilmington, DE 19806, USA; support@morok.io.
This English text is a translation of the Russian version, provided for convenience. In case of any discrepancy between the English and Russian versions, the Russian version prevails. Русская версия