Privacy Policy

Last Updated: September 7, 2026

1. Information We Collect

We collect the following when you create an account and use Maru:

• Account information — your email address, and a password you choose. Passwords are stored only in hashed form.
• Content you add — the links, magnet links and torrent files you submit, and the names and metadata of files in your cloud storage.
• Purchase information — a record of booster point purchases. Card and billing details are handled by Google Play and never reach us.
• Device and diagnostic data — app version, device model, operating system version, crash reports, and anonymous usage events such as which screens are opened.
• IP address — recorded with purchases for fraud prevention, and present in routine server logs.

2. How Downloads Reach You

Maru is a remote downloader. When you add a link, the transfer runs on our infrastructure rather than on your device:

• Your device never connects to a peer-to-peer network. It does not join a torrent swarm, and your IP address is not shared with other peers or listed publicly as a participant in a transfer.
• The only connection your device makes is an encrypted HTTPS connection to Maru. Your network provider can see that you are connected to Maru and how much data you transfer, but not the peer-to-peer activity behind it.
• Our servers and those of our upstream storage provider do make those connections on your behalf, and we keep a record of your transfers on your account as described under Data Retention below. You can delete that history at any time.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the service
• Process purchases and credit booster points to your account
• Send transactional email — confirmation codes, sign-in codes, and replies to support requests
• Diagnose crashes and fix bugs
• Detect and prevent fraud and abuse

4. Service Providers We Share Data With

We do not sell or rent your personal information. We share the minimum necessary with the following providers, each acting on our behalf:

• Google Firebase (Crashlytics, Analytics, Performance Monitoring) — crash reports, anonymous usage events and performance traces, linked to a randomly generated installation identifier rather than your account. Maru shows no ads, and the advertising ID is explicitly removed from the app.
• RevenueCat — purchase state, identified by your Maru customer ID, so purchases can be verified and credited to the right account.
• Google Play Billing — processes all payments. We never see or store your card details.
• Our own servers — operated by us. Cloud file storage and downloading are performed by our upstream storage provider.

5. Data Retention

Account information and your stored files are kept for as long as your account exists. Server logs are retained for up to 14 days. Crash and analytics records are retained according to Firebase's own retention policy. Purchase records are kept as long as required for tax and accounting purposes.

6. Deleting Your Account

You can permanently delete your account and all associated data at any time, without contacting us:

• In the app, go to Settings → Account → Delete Account.
• On the web, sign in at maruapp.net and use the same option under Settings.
• Deletion removes your account, your stored files, your transfer history and any remaining booster points. It cannot be undone, and purchases cannot be refunded or restored afterwards.
• Anonymised crash and analytics records that are not linked to your account may persist until they expire under the retention periods above.

7. Data Security

All traffic between the app and our servers is encrypted in transit with HTTPS. Your session credentials are stored on your device in encrypted form, keyed by the device's own hardware-backed keystore, and are excluded from device backups. No system is perfectly secure, but we take appropriate technical and organizational measures to protect your information.

8. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Deletion is available directly in the app as described above; for anything else, contact us through Settings → Get Support and we will respond within 30 days.

9. Children

Maru is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to This Policy

If we change this policy we will update the date at the top of this page, and for significant changes we will notify you in the app.

11. Contact Us

For any question about this Privacy Policy or your data, reach us through Settings → Get Support in the app.