MeerGuard VPNMeerGuard VPN

MeerGuard VPN Browser Extension — Privacy Policy

Last updated: 2026-11-14

MeerGuard VPN is a browser extension that routes web traffic through our proxy nodes. This policy describes exactly what the extension sends off your device and what it keeps locally.

Firefox displays the data required to provide the VPN in its installation prompt. Optional technical data is controlled separately in Firefox's extension settings (about:addons → MeerGuard → Permissions and data). Declining or revoking that optional permission does not prevent you from using the VPN. Firefox private-window access is a separate, optional setting; you do not have to grant it to use MeerGuard in ordinary windows. See section 3 for the scope of the traffic protection.

1. What the extension sends to our servers

  • Your device identifier (device_uid). A random UUID generated on your device the first time the extension runs, stored in browser-local storage. Right after installation the extension sends it to our backend to register this installation (a guest record); in return it receives guest tokens and a key. The VPN itself turns on only after you sign in: the guest key is not used for the connection. Until you sign in it is not linked to your name, email, phone, or any identifier assigned outside the extension. When you sign in, it is sent along with the sign-in so that the backend moves your guest access and this month's free-tier usage to your account. Guest registration can also include the device details described below; Firefox sends those optional details only with your technical-data permission.
  • Where you came from to install the extension. If you followed one of our own links to the extension (on our website, in our Telegram mini app or in a video description), our website saved a small label in its own cookie: the campaign name, where the link was placed and the website page you were on. When the extension creates guest access, it reads that label from our website only and sends it to our backend with the request, so we can see which of our links bring installs. No label means the extension sends only the name of the store it was installed from, or an indication that the label could not be retrieved. Cookies of other websites are never read for this purpose. Firefox makes this cookie-based request and sends the attribution fields only if you allow optional technical and interaction data, and sends only a label it actually found; without that permission it does neither.
  • Country hints and technical signals (Chromium builds only). When registering guest access or a subscription device, the extension sends its store name, browser time zone, browser language and the country/region component of that language, plus a yes/no indication of whether its local checks suspect another VPN (or an unknown value). For guest access these signals can be resent when they change or after a day. They help our backend determine the country and installation environment. Firefox does not send these signals; its local routing and VPN warnings can still use the time zone and language on the device.
  • Localized location names. The server can receive the extension interface language (lang) to return subscription location names in that language. In Firefox this parameter is sent only with optional technical-data consent; declining it still loads the server list with its default names. It is separate from the country hints above.
  • Your IP address, to our API. Requests to our API (guest access, sign-in, server and location list, usage, account, device slots, country check) go directly, not through the VPN, so our API servers see your IP address, as any server you connect to does. Our server uses it to limit how many guest accesses can be created from one address.
  • Sign-in details, if you choose to sign in. Email sign-in: your email address (to send you a one-time code), then the email and the code. Telegram sign-in: the extension opens our sign-in bot in Telegram; the bot receives the Telegram account details Telegram shares with any bot you write to (such as your Telegram ID and name), and the backend links them to your MeerGuard account.
  • Your access key. Issued by our backend (for guest access, or after you sign in) or pasted by you in Settings. Sent to our proxy node as the connection password; the node checks it with our backend. The extension sends it to no one else.
  • Your account session tokens. Sent to our backend with account requests: to load the server and location list, your free-tier usage, and your account summary (email, subscription status and end date, number of devices), and to renew the session.
  • Your chosen exit country. When you pick a location, the choice is sent to our backend and stored with your access key, so our nodes route you through that country.
  • Device details for your subscription's device slots. Like our apps, the extension takes one of a paid subscription's device slots. When you are signed in, on every connection it sends our backend a device ID derived from device_uid by a one-way hash, your operating system and browser name with its major version (read from the browser's user agent), and the extension version. In Firefox, the operating system, browser name/version and extension version are included only while you have allowed optional technical data in Firefox; the device ID required for access is still sent if you decline. This controls the explicit device-details payload; ordinary network requests still carry the headers generated by your browser. With a paid subscription they are stored and shown in your device list on our website and in our subscription panel, so you can unlink the device. Guest registration also uses the optional device description, but does not take a paid device slot. The same device ID is sent to our proxy node as the connection user name (also in guest mode). Signing out releases the slot (if our server is unreachable at that moment, the extension tells you to unlink the device in your account). When you open Settings → Account, the extension loads your subscription's device list (device names, operating systems, dates) from our backend to show it; unlinking a device sends that device's ID to our backend. The list is not stored.
  • The domain of each request you make through the VPN — because a proxy node cannot forward a request without knowing where it goes. For HTTPS sites the node sees only the domain name and port; page content stays encrypted between your browser and the site. Pages opened over plain HTTP pass through the node unencrypted, as they would through any network. Nodes keep aggregate counters (bytes and connection count) per user, not a per-request log.
  • What does not go through the VPN. These sites see your real IP address: - With smart routing on (its initial default is selected locally from the browser's time zone, with browser language as a fallback): Russian banks, Gosuslugi, the tax service, the Central Bank and the Bybit exchange, because they block foreign addresses. The list is built into the extension; our server can add sites of these same kinds to it, but cannot remove the built-in ones. - A short list of exceptions our server sends, and the server that hosts the rule file (see "Rule file" below). - Sites you mark "direct", all sites except the listed ones if you choose "Only on selected sites", and local addresses. - Our API (see above).

Such requests never reach our nodes. A site you mark "through VPN" goes through the VPN even if it is on one of these lists (our API and local addresses excepted). Turn smart routing off in Settings → Routing to send the listed banks, services and Bybit through the VPN too.

  • Rule file. If our server names one, the extension downloads a routing rule file (the site list above) from that file server, at most about once an hour. The request carries no data about you; it goes directly, so the file server sees your IP address.
  • Connection checks. While connected, about once a minute the extension checks that the VPN works: it calls our gateway (no data about you) and requests www.gstatic.com/generate_204, a standard Google connectivity-check address, through the VPN (so Google sees our node's address, not yours; no cookies or other data are added). When you open the extension while disconnected, it calls our gateway at most every 30 seconds, so it can see which address the browser connected to (see webRequest in section 3).
  • Country checks. While connected, about every five minutes the extension makes two requests. One goes directly to our backend, which answers which country the request came from (to warn you if another VPN on your computer intercepts traffic meant to go directly); the backend returns a country code only and does not log your IP address. The other goes through the VPN to the IP-check tool on our website (surikatweb.com/api/my-ip for exits in Russia; the world endpoint is meerguard.app/api/my-ip in Chromium and getsurikat.com/api/my-ip in this Firefox build), to check that sites see the country you selected. When the VPN works, the website sees the address of our server, not yours. The extension keeps only the country code from the answer and sends no cookies with this request; the website's web server keeps its usual access log, as for any visit to our website. If traffic leaks past the VPN — exactly what this check exists to catch — that log and the website's hosting provider see your real IP address.
  • Buying a subscription. To show prices, the extension reads the public list of plans from our server (/payments/plans); this request carries no personal data. "Buy" opens /pricing in a new tab; when your free traffic has run out, it may open the paid trial page (/trial) instead, and when all device slots of your subscription are taken, "Add a device" opens your account page (/cabinet). These pages use surikatweb.com for the Russian site contour and getsurikat.com for the world contour. The choice is made locally from the browser time zone; an unknown region uses the Russian contour. The time-zone value is not sent in these links. In Chromium, links carry labels that tell our website the visit came from the extension (src=ext, utm_source=vpn_extension, utm_medium, utm_campaign); Firefox adds these labels, including on feedback links, only if you allow optional technical and interaction data. Language and currency parameters can still be used to show the appropriate page and prices. If you are signed in, the pricing and trial links also carry your account email (email=…), so the website can prefill checkout; like any address you open, it is kept in your browser history. Before offering the trial to a signed-in account, the extension sends that account's email to our server (/payments/trial-eligibility) to check whether the trial is still available; the answer is only "yes" or "no", and the extension does not store the email with it. If you are signed in, these pages (and the feedback page) open already signed in to the same account: the extension asks our server for a one-time sign-in code (6 digits, valid 5 minutes, works once) and puts it after # in the address — that part is not sent to the website's server or to other sites, and the page removes it from the address right away. Payment happens on the website under its own privacy policy.
  • Links to our apps and website. "Other devices" opens the download of our Windows and Android apps on our website (/dl/windows, /dl/android, or the download page of the world contour), Google Play through our website's redirect (/go?to=play), and our Telegram bot. The "Website" link in About and the account page link open our website too. In Chromium these links carry labels that tell our website the visit came from the extension (s=ext, utm_source=vpn_extension, utm_medium, utm_campaign; the Telegram bot link carries start=extension_telegram). The redirect passes Google Play only that the install came from the extension (utm_source=meerguard, utm_medium=ext), so the app can report its install source when first launched. The links carry no account data. Our website counts clicks on /go and /dl under its own privacy policy. Firefox adds these labels and goes to Google Play through /go only if you allow optional technical and interaction data; otherwise it opens our pages and Google Play directly, without labels, and the Telegram bot without start. "Download Happ" opens the Happ website (happ.su) without labels. "Get a link for Happ" (signed in, on request only) asks our server (/subscriptions/link, with your account token) for your subscription's connection link; it stays only in the open page's memory, is not stored or logged, and leaves the extension only when you open it in Happ, copy it or show it as a QR code drawn locally.
  • Review reminder (Chromium builds only). When you are signed in, the extension asks our backend whether a store-review reminder is due, and reports whether you saw it, dismissed it or opened the store link. The requests use your account token; the extension does not receive or submit your store rating. Firefox does not make these reminder requests or send these events.
  • Email offers you choose to receive. If you change the email-offer preference in account settings, the extension sends your choice to our backend with your account token. It also reads the current preference to show it. This is separate from Firefox's optional technical-data permission.
  • Server address list. At browser start, on install or update, every 6 hours and after repeated connection errors, the extension downloads a signed list of our server addresses (/api/v1/client/bootstrap) from our servers or from a copy on Google Drive. The request carries no data about you; the browser's IP address is visible to the server that answers, as with any download.
  • Connection quality counters. About every 3 hours the extension sends our backend totals of what happened since the last report: how many connection attempts there were and how many succeeded, error codes of failed attempts (for example CONN_SERVERS_UNAVAILABLE), how many times it switched to a backup node or server address, how many minute checks of the node failed (timeout, connection error or an unexpected answer) or found no network at all, how many times none of our servers answered and how many times traffic blocking engaged and with which error code (in Firefox also the kind of such a protection event: a page, a background request or a WebSocket, and whether the server had just changed) — together with the extension version, its build (Chrome, Edge, Opera, Yandex or Firefox — the store version you installed, not your browser version or system) and the region it uses (Russia or rest of world). No websites, IP addresses, node addresses, settings or tokens are included. The request is authorized with your account or guest token only to limit how often reports are accepted; we store the totals per hour without any link to your account. In Firefox these counters are sent only if you allow optional technical data.
  • Uninstalling (Chromium builds only). After you remove the extension, the browser opens the selected website contour with ?utm_source=vpn_extension&utm_medium=uninstall (surikatweb.com or getsurikat.com). The link carries only these labels. Firefox does not open a removal-feedback page.
  • Support emails you choose to send. "Email support" opens your own mail app with a diagnostics report in the message body (version and browser user agent, connection state, error codes, routing mode and number of rules, the country of the connected node, time zone and the countries from the checks above, whether you are signed in, device slot status, the start of the device ID — no IP addresses, no domains from your rules, no passwords, keys or tokens). Nothing is sent until you send the email yourself; the full report is also placed on your clipboard.
  • Support chats in Telegram you choose to start. "Message us on Telegram" opens our support bot (@MeerGuardSupport_bot) in Telegram Web and places the same diagnostics report on your clipboard. Nothing is sent until you paste it into the chat yourself; what you send there is also processed by Telegram under its own privacy policy.

The extension does not separately extract or upload your browsing history, page content, form values, cookies, keystrokes or passwords entered on other sites. This does not remove the proxy's need to forward the web requests you send through it: plain HTTP traffic, including its headers and content, is visible in transit; HTTPS content stays encrypted. Cookie-based install attribution is limited to the Chromium flow described above. No third-party analytics SDK is included.

2. What the extension stores on your device

Browser-local storage (kept until you sign out, change the setting, or remove the extension):

  • Your device identifier (device_uid).
  • Your access key (treated as a password).
  • Session refresh token: your account's after you sign in, otherwise the guest one.
  • Your routing rules and settings — which sites go through the VPN or around it, smart routing, Kill-switch, WebRTC blocking, the chosen exit country.
  • The downloaded routing rule file.
  • Connection state, error codes and device slot status (used by the popup and the built-in self-test).

Session storage in memory (cleared when the browser closes):

  • Short-lived access tokens and the proxy credentials in use (access key and device ID).
  • The last server, location and exception lists (so the extension can switch nodes when the network fails).
  • Your account summary (email, subscription, number of devices), to show it in the popup.
  • While you sign in by email: the email address, until the code expires.
  • Results of the checks in section 1 (country codes, whether another VPN was noticed).

Signing out deletes your account tokens, the access key issued at sign-in (a key you pasted yourself is kept) and the account summary; the VPN then stays off until you sign in again.

Stored data leaves your device only as described in section 1.

3. What the extension does with browser APIs

  • proxy — routes browser requests using a proxy server and exception list/PAC script in Chromium, or per-request proxy decisions in Firefox. On disconnect the extension releases its routing. It affects the browser where it is installed, not other applications or system traffic. If a connection fails while you want the VPN on and Kill-switch is on (the default), protected traffic is blocked until it reconnects. In Firefox, startup/emergency protection blocks HTTP(S) and WebSocket requests except the exact API hosts needed to restore access and local addresses; during that lock it also blocks your ordinary direct-site exceptions. Disconnecting releases the lock. Firefox private windows are covered only if you separately allow the extension to run in private windows; without that permission MeerGuard does not protect them. Browser proxy protection does not cover every network protocol; see the optional WebRTC protection below.
  • webRequest + webRequestAuthProvider (Chromium) / webRequestBlocking (Firefox) — answers our proxy node's HTTP 407 authentication challenge with your access key and this install's device ID (as the user name), so the browser does not show you a password dialog. Credentials are given only to our node. In addition, for requests to our own API hosts only, it reads the IP address the browser connected to, to notice another VPN on your computer (such VPNs use special address ranges); only a yes/no result is kept, in session storage. Request bodies are not read or modified by the extension. Firefox also checks the selected proxy before sending protected requests and cancels requests using a missing or different proxy.
  • declarativeNetRequestWithHostAccess (Firefox) — enforces the startup/emergency traffic lock described above, including while the background page is not active. Rules are stored in the browser and are not sent to our servers.
  • storage — the storage described in section 2.
  • alarms — the periodic checks described in section 1, hourly rule list updates, and retries of a failed connection or guest access.
  • privacy — not requested at install. The browser asks you for it only when you turn on "Block WebRTC" in settings (off by default). Then, while the VPN is on, and while traffic is blocked after a connection failure, it turns off WebRTC traffic that would bypass the proxy (webRTCIPHandlingPolicy), so websites cannot learn your real IP address through it. The setting is removed on disconnect or when you turn the option off. No other privacy setting is read or changed.
  • contextMenus — the page menu items "route this site around/through the VPN" and "remove the rule". Only the page's host name is used, to create your routing rule on this device; page content is not read.
  • <all_urls> host permission — required so the extension can answer the proxy authentication challenge for any hostname you may visit, apply Firefox's traffic protection, and make the checks and downloads described in section 1. The permission is used only for that; the extension does not inject content scripts and does not read page content.

4. Who we share data with

  • The proxy nodes we operate, for as long as needed to forward your traffic. Nodes are operated by MeerGuard.
  • The hosting and email delivery providers of our servers and website process this data on our behalf (for example, the website's reverse proxy terminates TLS for our website, including the exit country check).
  • Google, only in the connectivity check and as a copy of the server address list described in section 1 (no data about you).
  • For users in Russia, requests to our account API may pass through a content delivery network (Yandex Cloud CDN, api.tarnet.site) that forwards them to our servers on our behalf, including your account or guest token.
  • Telegram, only if you choose to sign in with Telegram or write to our support bot.
  • No analytics providers, no advertising networks, no data sales.

Limited Use. We use the data described in this policy only to provide the extension's purpose — routing your browser traffic through the VPN and managing your access to it — and for the installation-link measurement and reminders explicitly described above for Chromium. We do not sell it or transfer it to third parties except as listed above, do not use or transfer it for advertising or to determine creditworthiness or for lending, and do not allow humans to read it, except with your consent (for example, a support request you send us), for security purposes, or to comply with applicable law.

5. Retention

  • Connection quality totals — kept per hour without any link to your account; the marker used to limit how often your reports are accepted expires within an hour.
  • Traffic counters — kept as long as your account or guest access exists so we can enforce the free-tier limit. Reset monthly.
  • Your chosen exit country — until you change it or your access key is removed.
  • Diagnostics on our side — kept for at most 30 days.
  • Device slot records — while the device is linked to your subscription; removed when you sign out or unlink the device in your account. If signing out cannot reach our server, the record stays until you unlink the device in your account.
  • The website's access log (including exit country check requests) — rotated after 14 days.
  • On uninstall, all local data is removed by the browser. To also remove data on our side, contact us at support@meerguard.app.

6. Children

The extension is not directed at children under 13. We do not knowingly collect data from children.

7. Changes

Material changes will be shown as an update in the extension listing before they take effect. The Last updated date at the top of this page is authoritative.

8. Contact

support@meerguard.app