Cookie Policy

1What a cookie is

A cookie is a short piece of text a site asks your browser to keep and to send back on every later request to that site. It is how a website recognises the same browser twice: HTTP itself has no memory, so without one every page you opened would arrive as a stranger.

The mechanism is neutral. What matters is how many cookies a site sets, what is inside them, how long they last, and who else gets to read them. This page answers all four, and it is short because the answers are short.

2The only cookie we set

Nothing is written to your browser until you sign in. You can read every page on this site — the prices, the setup guides, this policy — without a single cookie being set. Finishing a sign-in writes one. In full:

• Name — dkuvpn_session.
• Purpose — it says which account is signed in. It is the only thing that decides whose dashboard, whose data usage and whose subscription link a page will render.
• Contents — your netid, which is the name your account is given from your Duke address, and an expiry timestamp: base64url-encoded JSON, followed by an HMAC-SHA256 signature. It is signed, not encrypted. The signature means the value cannot be edited without being rejected, but the netid inside it is readable by anyone holding the cookie.
• Flags — httpOnly, so no script on the page can read it; SameSite=Lax, so it is not attached to requests another site makes on your behalf, only to a link you follow here yourself; Secure in production, so on the live site it travels over HTTPS and nothing else; path /, so it goes to this site and nowhere else.
• Lifetime — 30 days from the sign-in that wrote it. It is not renewed as you browse, so 30 days later you sign in again. A browser that kept it past that would gain nothing: the expiry is inside the signed value, so the server refuses it too.
• Deleted — when you sign out. Signing out replaces it with an empty value and a zero lifetime, which is how a browser is told to throw a cookie away.
• Set by — this site, under this domain. No other site can read it, because a cookie is only ever sent back to the origin that set it.

Treat the cookie as a credential. It cannot be forged, but anyone who copies its value out of your browser is signed in as you until it expires. Sign out when you are finished on a computer that is not yours.

Because its path is /, your browser attaches it to every request to this site, including the subscription and console paths served through to Marzban on the same origin. Marzban authenticates with its own token and has no notion of this cookie.

3Why there is no cookie banner

Consent rules, wherever they apply, carve out cookies that are strictly necessary to deliver a service the user asked for. dkuvpn_session is that cookie and it is the only one: it is written at the moment you sign in, it carries nothing but who you are and when it lapses, and without it the site cannot tell your dashboard from anyone else's. There is nothing here to consent to, because nothing is set for anyone's benefit but yours.

A banner would also be dishonest. The ones you click away elsewhere are asking permission for the analytics, advertising and data sharing bundled behind them. We run none of those, so a pop-up would imply a choice that does not exist. If that ever changes, the new cookie will be off until you turn it on, and the banner will arrive with it.

The page you are reading is built as static HTML. It reads no cookie and it does not know who is asking — which is why the menu at the top of it never shows you as signed in.

4What we do not set

Each line below was checked against the code rather than assumed. None of the following appears on any page of this site:

• Analytics running in your browser — no Google Analytics, no Plausible, no counter script, no session recording. How many people visited is worked out afterwards from the web server's own log, which puts nothing on the page and is described in the Privacy Policy.
• Advertising and retargeting. Nothing about you is sold to an advertiser, because nothing is collected that could be sold.
• A tag manager, or a tracking pixel of any sort — no invisible image, iframe or beacon. Every image on the site is a file served from this domain.
• Third-party script. Every script this site serves comes from this origin.
• Cross-site tracking. dkuvpn_session is a first-party cookie, and there is no third-party cookie here for anyone to follow you with.
• Fingerprinting. Nothing reads your fonts, canvas, screen or device list to assemble an identifier.
• localStorage, sessionStorage or IndexedDB. The site writes nothing else to browser storage at all.

Three browser settings are read, and naming them is what keeps the list above honest. Every page asks whether you have switched on “reduce motion”, which stops the globe turning and shortens every transition on the site; “reduce transparency”, which turns the navigation bar solid; and “increase contrast”, which strengthens a few of the colours. Each answer decides how a page looks, and nothing more. None of the three is stored and none is sent anywhere.

Marzban's own admin console is served at /admin for whoever administers the service. That is a separate application and whatever it keeps in a browser is its own; nothing in a student's use of dkuvpn goes near it.

5Fonts, which are usually the leak

This site is set in EB Garamond. On most sites a font like that is fetched from fonts.googleapis.com, which means your browser makes a request to Google — carrying your IP address — before the first word is drawn. Not here. The font is downloaded once when the site is built and served from this domain along with everything else, so your browser never contacts Google. Chinese text is set in the CJK font already on your device and is not downloaded at all.

The reason is practical as much as principled: fonts.googleapis.com is not reachable from mainland China, and a site that waits on it is a site that does not load where its students are.

6Your language is in the address, not a cookie

Every page lives under /en or /zh. Arrive without one and the site reads the Accept-Language header your browser already sends on every request, picks the nearer of the two, and redirects you once. Nothing about that is stored: no cookie is set, and switching language is a link rather than a preference we remember for you.

7What happens when you leave this site

Two things here take you somewhere else, and once you are there this policy stops applying.

• Paying. The buy buttons open Gumroad's checkout in a new tab. Gumroad is the merchant of record, handles the card details this site never sees, and sets its own cookies under its own policy. All that travels with you is what is in the link: the plan you picked, and your netid, so the payment can find your account.
• The setup guides. The install buttons point at the App Store, at Happ's own site, or, on Windows, at GitHub, where its installer is published. Those are third-party sites with their own cookies and their own policies. The guides link to them and do nothing more.

Every response from this site carries Referrer-Policy: same-origin, so when one of those links opens, the site at the other end is not told which page you came from.

8Refusing or clearing cookies

Every browser can block cookies, delete them, or delete the ones belonging to a single site — in Chrome, Safari, Firefox and Edge it sits under Settings, in the privacy section. Clearing this site's cookies deletes dkuvpn_session and nothing else, because there is nothing else to delete.

There is one honest consequence. dkuvpn_session is the only thing that says whose account a page may read, so blocking or deleting it signs you out. Nothing breaks — the sign-in page still works, and a new six-digit code is one email away — but you will have to sign in again, and if you block cookies for this site outright you cannot stay signed in at all.

Signing out does the same thing on purpose. On a shared or borrowed computer it is worth the two seconds.

9The VPN connection is not a cookie

Clearing cookies signs you out of this website. It does nothing to the connection. Your subscription link lives in your VPN client, the client reaches the exit servers itself, and none of it passes through this browser or touches its cookies — so a cleared browser keeps connecting, right up until the next time you want to look at your dashboard.

The reverse holds too: nothing about your browsing runs through a cookie. What the proxy panel holds against your account is a running total of bytes used, an expiry date and a data limit — the Privacy Policy lists the rest of that account in full. Not a list of the sites you opened, the addresses you reached, or the names you looked up.

10Everything that is not a cookie

This page covers browser storage and nothing more. What the service knows about you — the Duke address you sign in with, the sign-in codes and how briefly they are kept, the IP address counted against the rate limit, the record of what you paid for, and what the proxy panel stores against your account — is set out in the Privacy Policy. The rest of the arrangement is in the Terms.

11Changes, and how to reach us

Every version of this page is dated. If it changes, the date at the top changes with it, and any change to what is kept in your browser — a new cookie, or an existing one doing something new — is stated plainly here rather than folded into a paragraph. The date is the announcement: there is no mailing list, and we will not email you about a policy.

Anything on this page that is unclear, or wrong, goes to support@dkuvpn.com. If you find a cookie on this site that this document does not list, say so — that is either a bug in the site or a bug in this page, and both get fixed.