Privacy policy

1. What we store

Vaslo shows no ads and uses no cookies or analytics tools that track how you use it.

Senders

• Email address: signing in creates your account and stores your email address. With Google sign-in we store only the email address Google has verified.
• Sign-in code: only a hash of the code is stored, never the code itself. A code is valid for 10 minutes and is deleted when used or when a new one is requested.
• Signed-in session: lasts 30 days. The server stores a hash of the session value and removes that record when you sign out.
• Transfer details: title, message, file names, sizes and types, retention period, download limit, creation time, download count, and the recipient email addresses you typed in. A link password is stored only as a hash.
• Files: the files you upload are kept in private storage.
• Pass purchases: the pass type, its period and the order number from the payment provider (Polar). You enter card details on Polar's checkout page; Vaslo does not receive them. When you start a payment, we pass your sign-in email address to Polar.

Senders without an account (guests)

• The first time you send without signing in, Vaslo creates a guest account record. Instead of an email address it holds a temporary address made by the service (g-…@guest.vaslo.invalid). We do not ask for your real email address or name, and no mail can be delivered to the temporary address.
• A guest session cookie (vaslo_session, the same cookie as signing in) is stored in this browser, so you can keep sending as the same guest for 30 days. The server stores only a hash of the cookie value.
• Transfers and files sent by a guest are stored the same way as the transfer details and files under "Senders" above. A guest cannot enter recipient emails or set a link password, so those two are never stored. Guest limits apply: up to 2 GB per transfer, 5 transfers a day, kept 1 day.
• A guest account record is deleted automatically by the daily cleanup job once it is more than 7 days old and has no transfers left, and its sessions are deleted with it. While transfer records remain, the guest record remains too; transfer records are deleted after the period in "4. Retention and deletion". Records of blocked transfers are not deleted automatically, so the guest record stays for those.
• If you sign in in the same browser after sending as a guest, transfers that are still open move to your account and the guest session is deleted.
• Starting a guest session runs the bot check (Cloudflare Turnstile), and the number of sessions that can be started from one IP address is counted with a hash of the IP address.

Recipients

• Recipients have no account. Opening a link shows the sender's email address (for a link sent by a guest, the temporary address made by the service), the title, the message and the file names.
• When a download starts we store the time and a hash of the IP address. The raw IP address is not stored. The hash is made with a value that changes every day, so the same IP gives a different hash on another day and cannot be followed across days.
• For statistics we store which file was downloaded (one file or download all) and when.
• When a link password is entered, attempts are counted per IP hash.
• When you report a link we store the report text (up to 2,000 characters), the transfer, the time and the review status. The report form does not ask for your email or other details about you.

All visitors

• Abuse prevention: there are rate limits on requesting sign-in codes, starting a guest session, creating transfers, entering passwords, starting downloads and reporting, counted per IP hash.
• Mail records: the kind of mail (sign-in code, notice to recipients, first-download notice, expiry notice), its status, time and a hash of the address. The list of mail waiting to be sent holds the recipient address and the message content.
• As a rule, server logs do not keep email addresses or share codes in clear text.
• Cloudflare, which hosts the service, processes network information such as IP addresses while serving requests.

2. Cookies and the bot check

Vaslo sets only the cookies the service needs to work. There are no advertising or tracking cookies.

• vaslo_session: signed-in state, or the guest session created when you send without signing in. 30 days.
• vaslo_locale: your language choice (Korean or English). 1 year.
• vaslo_unlock_{share code}: remembers that you entered a link password, so you are not asked again. 1 hour.
• vaslo_grant_{share code}: download permission. 1 hour.
• vaslo_glogin: confirms that a Google sign-in is in progress. 10 minutes.

On the sign-in, create-transfer (including starting a guest session on a first send), link-password and report screens we use Cloudflare Turnstile to check that you are not a bot. Your browser talks to Cloudflare for this check.

3. What we use it for

• Delivering files: creating transfers, links, downloads, expiry and deletion
• Signing in and identifying you, and sending without signing in (guest sessions)
• Sending email: sign-in codes, the link notice to recipients, the first-download notice, the reminder 24 hours before expiry
• Applying limits and passes, and processing payments
• Preventing abuse, handling reports and blocking

We do not use your information for advertising.

4. Retention and deletion

• Files: deleted from storage automatically when the transfer expires. The cleanup job runs about every 10 minutes, so there can be a short gap between expiry and deletion. When the sender deletes a transfer the link closes right away and the files are deleted; if deletion fails it is retried automatically.
• Unfinished uploads: stopped and deleted automatically after 24 hours.
• Transfer records (title, message, file names, recipient email addresses, download records): kept for 90 days after the files are deleted, then deleted.
• Records of blocked transfers and of reports: not deleted automatically.
• Sent-mail records: deleted after 90 days. Expired sign-in codes and expired sign-in sessions (guest sessions included): deleted by the daily cleanup job.
• Guest account records: deleted automatically once they are more than 7 days old and have no transfers left (see "Senders without an account" above).
• The account (email address): kept until you ask us to delete it, then destroyed without delay. How to ask is under "7. What you can do".
• Pass purchase records: kept as required by Korea's Act on Consumer Protection in Electronic Commerce: records of contracts and withdrawals 5 years, records of payment and supply 5 years, records of consumer complaints and disputes 3 years. They are kept separately for those periods even after you delete your account, and destroyed when the period ends.

[To confirm: how long records of reports and blocked transfers are kept]

[To confirm: how long the list of mail waiting to be sent is kept and how it is deleted]

5. Who processes data for us

• Cloudflare: hosting, storage of files and data, sending email, the bot check (Turnstile)
• Polar: payment for passes. Polar processes the payment as the merchant of record.
• Google: only if you choose Google sign-in. We receive the email address Google has verified.

We do not send information to advertising or analytics companies.

Transfers abroad

We entrust processing or storage to the companies below. Data is transferred to companies outside Korea over the network whenever the service is used, and is kept until you delete your account or the contract with the company ends (or longer where the law requires). The destination is the country of the company's data centers; the table lists the main one.

If you refuse a transfer to a "Required" company you cannot use the service. Data goes to the other companies only when you use the related feature (paying for a pass, Google sign-in), so you can refuse by not using it. Questions can go to each company's privacy contact or to our privacy officer under "7. What you can do".

6. Security

• Link passwords, sign-in codes and session values are stored only as hashes.
• Share links and receive codes are random 8-character codes, and repeated lookups of codes that do not exist are rate limited. File storage is private; recipients download through a short-lived address issued after a permission check.
• Vaslo does not offer end-to-end encryption. Anyone who has the link can download the files (unless a link password is set), so choose carefully who you give the link to.

7. What you can do

• You can delete a transfer at any time from your sent history. A transfer sent without signing in moves to your account's sent history when you sign in in the same browser, where you can delete it; if you do not, it is deleted automatically when its retention period ends (1 day for guests). To have it deleted sooner, email us the link at the contact address.
• You can clear cookies in your browser. If you block the sign-in cookie you cannot sign in.
• You may ask to access, correct, delete, restrict processing of, or withdraw consent for your personal data. Ask for account deletion the same way.
• Send requests to the privacy officer's email (hello@vaslo.app). We handle them within 10 days of receipt; if there is a justified reason we cannot, we tell you the reason and when we will.
• For remedies, you can contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).

Privacy officer

• Officer: Representative (Unbound Lab)
• Email: hello@vaslo.app
• Contact the officer for privacy questions, complaints and remedies.

8. Changes to this page

We announce changes on screen 7 days before they take effect, and 30 days before for changes important to your rights, such as new data items, purposes or processors.