Privacy Policy

Effective September 30, 2026

Koru Shield is a DNS filtering service. This policy explains what data we collect, why we collect it, and what we do with it. Short version: we collect the minimum needed to run the service, we never sell your data, and we never see the content of your browsing.

What we collect

• Account information. Your email address and login credentials (or your Google account identifier if you sign in with Google). Used for authentication, billing, and support.
• DNS query metadata. To filter threats, our resolvers necessarily see the domain names you look up, plus timestamps and which of your profiles made the request. This is how blocklists and parental controls work.
• Service configuration. Your filtering profiles, blocklist choices, and linked device identifiers. Stored so your protection follows you.
• Operational logs. Standard server logs (IP addresses, error traces) used for security, abuse prevention, and reliability. Retained for a limited period.
• Website analytics. Our marketing site uses PostHog to measure page views and button clicks so we can improve the site. PostHog does not receive your email address, DNS queries, or device identifiers. See PostHog's privacy policy. You can opt out by enabling Do Not Track in your browser.

What we do not collect

We do not see the content of the websites you visit, your messages, your files, or anything inside encrypted connections. DNS filtering works on domain names only. We do not build advertising profiles, and we never sell or rent your personal data to anyone.

Where your data lives

Koru Shield operates servers in Northern Virginia and Oregon, in the United States. Your DNS data stays in the US. We will update this section if we add regions.

How we use your data

• Provide and operate the filtering service you signed up for.
• Authenticate you and secure your account.
• Detect abuse, fraud, and attacks against our infrastructure.
• Send service emails (verification, password resets, billing). Marketing email only with your consent.

Sharing

We share data only with infrastructure providers needed to run the service (hosting, email delivery, payment processing), under contracts that limit them to operating the service. We disclose data when required by law. We do not share query data with advertisers or data brokers, ever.

Data retention

DNS query logs are kept only as long as needed for filtering, security, and debugging, then deleted or aggregated. Account data is kept while your account is active and deleted on request, subject to legal retention obligations.

Security

Data is encrypted in transit and at rest. Access to production systems is limited and logged. No system is perfectly secure, and we will notify you of breaches as required by law.

Children and families

Koru Shield is designed to help families stay safe online. Parents manage profiles for their household. We do not knowingly collect data directly from children; a parent or guardian creates and manages the account.

Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing contact@korushield.com. Depending on where you live, you may have additional rights under laws such as the CCPA or GDPR, which we honor.

Changes

We will post material changes to this policy here and update the effective date. Continued use of the service after changes means you accept the updated policy.

Contact

Questions about this policy: contact@korushield.com, Austin, Texas.