Privacy policy

Updated October 14, 2026

GuruGuard is operated by Furkan Coban. Contact support@shepardai.pro about support, access, correction or deletion of your data.

Profile checks

A website search sends the Instagram username or shared public link to GuruGuard. We may retrieve publicly accessible profile text, captions, highlight titles and bio-link pages through public sources. Availability varies. Server-collected content and its review may be cached in our database. Reviews expire for display after 24 hours; a failed collection attempt expires after 15 minutes. Expiry prevents reuse; it does not automatically erase a database row.

The extension checks text visible on an open public profile. It excludes Instagram messages, account settings and private-profile checks. Database lookups send the profile username. Bio-link inspection sends the link and username. Choosing “Submit for review” sends the available profile text to our review queue. Submitted content is unverified and does not overwrite a shared profile review.

Screenshots and mobile capture

When you select a screenshot on the website, text recognition runs on your device. The image is not uploaded to GuruGuard. Choosing to check the recognized text sends that text and the entered username to our server for a temporary review; it is not added to the shared profile cache.

The experimental Android capture feature requires your screen-recording approval and, for audio, your audio permission. It processes selected screen frames and available playback audio on the device. If you send the resulting text for a check, that text is processed by our server. This feature is in testing; it is not continuous background monitoring.

Feedback and account suggestions

Comments and suggestions send the text you enter and the relevant account identifier to GuruGuard. They enter a moderation queue. Approved comments, account reasons and source links may appear publicly. Do not submit passwords, payment details, private conversations or other sensitive information.

Comments do not require an account and are displayed without a visitor identity. They are not a promise of complete anonymity: our hosting provider processes network request information. For abuse limits, the application stores a daily derived IP identifier separately from comments and suggestions, rather than attaching a raw IP address to a submission.

Pending comments are eligible for cleanup after 30 days; approved comments stop displaying after 90 days. Unapproved account suggestions are eligible for cleanup after 30 days; approved account entries may remain until removed. Explicit profile contributions are eligible for cleanup after seven days. These cleanup operations run when the relevant submission service receives new submissions, so physical deletion can occur later.

Accounts, AI credits and payments

AI credits currently show a demo balance. Purchases, account connection and credit-funded AI checks are paused. The demo does not call an AI model or create a payment or real credit transaction.

If these services are enabled later, Google sign-in identifies the account. The application uses a hash derived from your Google account identifier; it does not save your Google password. Session and extension connection tokens are stored as hashes on the server. Sessions expire after 30 days; unused connection codes expire after five minutes.

An optional AI explanation sends selected public profile text to the configured AI provider through our server. Payment checkout is handled by Creem. We store purchase identifiers, amounts, status and credit transactions; we do not receive or store your full card number. The applicable provider policies and updated purchase terms will be linked before live sales are enabled.

Device storage and service providers

The extension saves your protection preference, hidden account identifiers and any connection token in browser storage. The website saves followed account identifiers and uses a service worker to cache its application files for offline access. Remove these through browser site-data settings or by uninstalling the extension. There are no advertising trackers in the application.

Cloudflare hosts the public website and its database and processes requests, including connection metadata, under its own infrastructure settings. Public-source requests contact Instagram, search sources and selected bio-link sites. Future optional sign-in, payment and AI providers may process data in other countries. We do not sell submission text or use it for targeted advertising.

Your choices

Use the support address above to request access, correction, removal of a comment or account entry, or deletion of account records. Include the relevant username, comment identifier or purchase reference, but never send passwords or card details. We may need to verify the request. Public source pages remain under their original publishers' control. Records needed for payment reconciliation, abuse investigation or legal obligations may need to be retained.

Do not submit information about children or private individuals. If a submission contains such information, contact us to request removal. We will update this page when data handling changes.