# Privacy Policy

Last updated 29 August 2026.

Morke is operated by Two Dice Ltd., 7 Bell Yard, London, WC2A 2JR, United Kingdom. We are the data controller for everything described here.

## What this covers

This policy covers morke.co, the account portal on it, and the Morke app for iPhone. The app links to this page as its privacy policy. Everything below applies to all three.

## The account has no name on it

An account is an Account ID, in the form `MK-XXXX-XXXX-XXXX`, and an activation key. We do not ask for an email address, a name, a phone number or a date of birth, and there is no field for any of them on an account.

The contact form on our support page is the one place on this site with an email field in it. It is yours to use or not, and what you type there is never attached to an account. It is described below.

The activation key is hashed with Argon2id before it is stored, so we cannot read it back. A short non-secret prefix is kept alongside the hash so that a key can be looked up at all. Because there is no email on file, there is no password reset. Lose the key and the account is gone.

## Everything we store about an account

This is the whole list:

| What | How long | Why we are allowed to |
| --- | --- | --- |
| 1.0 The account: its ID, the key prefix, the key hash | Life of the account | To provide the service you asked for. Without it there is no account to sign in to |
| 1.1 Device sessions: a credential prefix and hash, the platform, a label you can set, the session status | 60 days after a session goes idle, and 30 days for a browser session | To provide the service, and to hold each account to its device limit |
| 1.2 App Attest keys on iOS: a key id, a public key, a counter, and no reference to any account | Life of the app install | Our legitimate interest in keeping the API reachable only by the real app. |
| 1.3 Sign-in and signup attempts: the action, the key prefix, a coded form of the address it came from, whether it worked, and when | The rate-limit windows are 15 minutes for signing in and 1 hour for creating an account. The job that deletes rows past their window runs every hour, so a row can exist for up to about 2 hours. | Our legitimate interest in stopping someone working through activation keys by brute force |
| 1.4 Node presence: that an account had traffic on a given exit node during a 10-minute window | Pruned on a 30-minute timer against a 2-hour window, so up to about 2.5 hours | Our legitimate interest in knowing whether the service is working and how loaded each node is |
| 1.5 Operational metrics: counts per host, node and route, never per account | 40 days | Our legitimate interest in running the service. There is no account dimension in this data, so it is not about you |
| 1.6 Subscription records: that a subscription exists, where it was bought, and when it runs out | Life of the account | To provide the service you paid for, and to keep the records we are required to keep |
| 1.7 Signup replays: a fingerprint of the signup’s retry key, and the reply sealed so only that key can open it | 15 minutes, then deleted by the hourly job | To provide the service you asked for. A signup reply carries the activation key once, so if it is lost the same request is answered again instead of creating a second account |

**We do store a record of your address when you try to sign in or to create an account.** It is how the rate limit works, and the rate limit is what stands between an activation key and someone guessing at it. What is written is not the address itself but a coded form of it, made with a key that lives only in the server’s memory and changes when the server restarts, so nothing on disk can be turned back into an address. Two attempts from the same address still match while the window lasts, so the record is still derived from your address, and we still treat it as information about you. It sits in a row with the outcome of that attempt and nothing else. It is not joined to your traffic, because there is no traffic record to join it to.

**Presence rows exist.** They record that an account had traffic on a node during a 10-minute window, and nothing about what that traffic was. This is the only data we hold that could build even a weak record of which country an account connected from over time, and it is pruned within hours.

## What is never recorded

The sites you visit, the addresses you connect to, your DNS queries, and the content of your traffic. No row exists for any of it, in any table, at any retention.

Traffic passes through our servers to reach the internet, because that is what a VPN is. While it is passing, the software carrying it can see where a connection is going. That is not incidental: it is how the DNS filters you can switch on in the app work at all. None of it is written down, and nothing about a connection survives it.

Access logging on the exit nodes is not written to disk. We audited that on 5 August 2026: no log files in the node container, and no access lines in the container logs or the system journal. Source addresses are masked in the live view that does exist.

## No analytics and no trackers

This site runs no analytics, no third-party trackers, no advertising or marketing pixels, and no crash or error reporting service. Not a privacy-friendly one either.

Every asset on this site is served from morke.co, so loading a page here does not talk to anyone else. The apps hold to the same rule: the connection numbers they show you live in memory on your device and are never sent anywhere.

## What is stored in your browser

Three cookies, one value in local storage, and one in session storage. This is the whole list. None of it is set by a third party, because there is no third party on this site, and none of it tracks you. If you only read the site, none of it is written.

The three cookies are set when you sign in, and not before. Signing out deletes all three.

- morke_session holds your sign-in token. It lasts as long as that token does, which is about 24 hours from the moment you sign in, and it does not extend itself: the clock starts once, and using the site never pushes it forward. When it runs out you type your key again.
- morke_device holds the credential this browser reuses, so that signing in again continues this browser’s own session instead of creating another. It lasts 60 days from your last sign-in.
- morke_session_hint holds the character 1. It is the one cookie here that a script in your browser can read, and it exists so the page can draw the signed-in header before it has finished loading. There is no token in it and no identifier. It expires with the session.

The first two are httpOnly, which means no script in your browser can read them. The third is the exception, and all it says is that you are signed in.

None of the three is used for anything but signing you in.

The other two are not cookies and have nothing to do with your account. If you use the Reduce motion switch at the bottom of any page to override what your device already asks for, that choice is saved in local storage, so the site still knows about it next time. If you are asked to wait before trying your key again, the moment that wait ends is held in session storage, which your browser clears when you close the tab. Each is a single value, neither is sent to our server, and neither says anything about who you are.

You are not asked to accept any of this. Storing anything in your browser needs your consent unless it falls inside one of the exceptions in Schedule A1 to the Privacy and Electronic Communications Regulations 2003. The three cookies and the waiting time fall under paragraph 4, which covers storage that is strictly necessary to provide a service you asked for, and authenticating you is one of the examples that paragraph gives. The Reduce motion setting is not necessary for the site to work. It falls under paragraph 6, which covers a preference about how a site looks and behaves, and paragraph 6 carries a condition that paragraph 4 does not: we have to say clearly what the storage is for, which is this section, and give you a simple way to object at no cost, which is the same switch. We write the value only when your choice differs from what your device already asks for, and we delete it as soon as the two agree again, whether you moved the switch or changed the setting on your device. If none of our pages is open at that moment, it is deleted the next time you open one.

Clearing this site’s data removes whichever of these are there, and nothing breaks if you do.

## Signing in on this website

Your activation key is typed into the page, sent to our own server, and forwarded from there to our API. Your address goes with it, so that the rate limit in the table above counts you and not this website. The key is never stored in the browser: not in a cookie, not in local storage, not in the address bar. Our server does not write it down either, and it never appears in a log.

Signing in here creates a browser session on your account. It does not count against your device limit, and it appears in the apps under Active connections, labelled Browser, so you can see it and sign it out from any app. A browser session that stays idle is removed after 30 days.

## The status line at the top of every page

To show whether you are connected through Morke, this site sends your IP address to our own API at api.morkenet.com, which resolves it to a country using a database held on that server. We rely on our legitimate interest in the header showing something true rather than a guess. No third-party geolocation service is involved, your address is not stored, and the result is used only to render that one line in the header.

## The contact form on this site

Our support page has a form. It asks for a subject, an email address for the reply, and your message. You choose what goes in all three, and nothing on the page fills any of them in for you.

What you type is sent to our own server and passed on to team@twodice.tech. It is carried by the same provider that serves this website, and it reaches no other company: there is no ticket system and no mail service of anyone else's in the path. It is not stored on this website either, because there is no database behind the form and no copy kept on the server that serves this page. What is left afterwards is your message in that mailbox, which we keep until we delete it. We use the address to reply and for nothing else, and it goes on no list, because there is no list.

We rely on our legitimate interest in answering people who write to us. You can use the form or email team@twodice.tech directly; the form has no advantage over doing that, and it collects nothing extra.

So that the form cannot be used to send bulk mail, our server counts recent submissions against a scrambled form of your network address. The scrambling key is generated fresh each time the server starts, the counter is held in memory, and neither the address nor the count is written down or sent anywhere.

## Payments

Subscriptions bought in the app are processed by Apple. Card details go to Apple and never reach us. What comes back to us is that a subscription exists, when it runs out, and which Account ID it belongs to.

There is a limit here. Apple knows which Apple Account paid for a Morke subscription, because Apple sold it. We cannot change that, and no design on our side would. What Apple can know is that someone is a customer, which is true of anything sold in an app store. What it cannot learn from us is anything about what you do while connected, because we do not have it.

Paying on this website is not available. There is no checkout, no card form and no payment processor involved in this site.

## Who else handles data, and where

We do not sell data and we do not share it for advertising. There is nothing in the schema above that would be worth selling. The parties that do handle something are these:

- **Apple**, for subscriptions bought in the app.
- **Our hosting providers.** The server holding the database is in the Netherlands. The exit nodes are in the Netherlands and in Romania. The website itself is served by a content delivery provider. We will name any of them if you ask.

The Netherlands and Romania are both inside the European Economic Area, which the United Kingdom recognises for data transfers, so no extra transfer safeguard is needed for them. Apple handles payment data under its own terms.

## Your rights

Under UK data protection law you can ask for a copy of what we hold about your account, in a machine-readable form if you want to take it elsewhere, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to processing we do on the basis of our legitimate interests.

The design puts a limit on that. We hold no email address and no name on an account, so there is nothing on file that would let us check that a request comes from the person who holds it. The law does not require us to collect extra information purely so that we could answer such requests, and we are not going to start collecting it. What we can act on is a request that quotes an Account ID.

**Never send us your activation key.** Not to prove who you are, not for support, not for anything. Whoever holds that key holds the account. A request that arrives with a key in it will be refused.

## Deleting your account

You can delete the account yourself: in the app under Settings, or on this website from your account page. The activation key stops working at that moment, every session ends, and there is no undo. You can also email team@twodice.tech from any address, quote your Account ID, and ask us to delete it. We will do it within 30 days and confirm when it is done.

Deleting the account removes its device sessions and erases its credentials, so nothing can sign in to it again. Three things stay: the Account ID, kept so it is never issued to anyone else; the record that a subscription existed; and an opaque purchase reference, kept so a later notice from Apple cannot attach a subscription to the wrong account. None of them names a person and none of them can sign in.

Deleting the account does not cancel an App Store subscription, because Apple sold it. Cancel it in your Apple Account settings first. Anything that carries no account reference, such as the per-node metrics, has nothing in it to delete.

## Complaints

If you think we have handled your data badly, email team@twodice.tech. We will acknowledge your complaint within 30 days and tell you what we intend to do about it.

You can also complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, at ico.org.uk. You do not have to come to us first, though it is usually faster.

## Legal requests

We are a United Kingdom company, so a United Kingdom court or authority can compel us to hand over what we hold. What we hold is the table above. There is no browsing history in it, because we never wrote one.

Some orders under United Kingdom law arrive with a legal prohibition on saying that they exist. That is why this page carries no warrant canary. A canary we would be barred from taking down is not a signal, it is decoration. We are not going to promise to refuse an order we have not seen, and we are not going to claim we have never received one.

## Children

Morke is not for children. It is a paid subscription and it is not intended for anyone under 18. Nothing on this site is aimed at children, and we do not knowingly hold an account for one.

## Changes to this policy

We update this page when the system changes. The date at the top is the date the text last changed, and it is checked every month whether it changed or not. When something is disclosed here it stays disclosed.

## Contact

Two Dice Ltd., 7 Bell Yard, London, WC2A 2JR, United Kingdom. team@twodice.tech.