Under the owner's review — not legal advice. Placeholders in ⟨angle brackets⟩ are decisions still to be taken.

Privacy Policy

Last updated 2026-10-31.

Controller: the Vflin team — no company, no registered address — reachable at support@vflin-antik.com.

1. The principle

The cloud is built so that the server cannot read what it stores for you. Your profiles leave your computer as signed, encrypted blobs; the keys stay on your devices; your password is never sent — a check value derived from it on your device is.

measuredThe table below is not a promise: it is what was read back from the database of a running server after accounts were created from this site and from the desktop app.

2. What the server holds

in the clear	sealed (encrypted; the server cannot read it)	never received
your email address, and whether and when it was confirmed whether two-step verification is on a 16-byte login salt the ids and names of your signed-in devices, when each was added and last seen for each synced profile: its id, the ciphertext's size and hash, a version vector, the core version your plan and its invoices: the plan, the amount, the currency, when each was issued and paid your account's public key, and your team memberships if you are in one how many wallets each profile holds — a count your own app reports with each sync, so that a plan's wallet ceiling can be applied. The server sees the number and nothing else about them	the check value derived from your password (stored as an Argon2id hash of it) the two-step verification seed every profile's contents — cookies, storage, extensions, settings the keyring that opens them the one-time codes mailed to you and each device's secret — kept only as keyed hashes	your password your master password, if you set one, and your recovery code the pages you visit, the proxies you use, the accounts you keep in profiles the seed phrases and private keys of your wallets

builtA wallet lives inside a profile, and a profile is ciphertext the server will not open. So the seed phrase and the private key never reach us, in any form — not sealed, not hashed, not counted into anything.

builtAnd the honest half of it: that wallet ceiling is accounting, not protection. The number comes from your own app, and the server cannot check it without reading the profile — which is the one thing it must never do. A modified client that reports zero has no wallet ceiling at all. The ceiling on profiles is different: those are rows the server counts itself.

3. Server logs and request data

The server logs each request's method, path, status and duration, and applies rate limits by IP address; when the site is served through Cloudflare, Cloudflare passes the visitor's IP to the server for that purpose and applies its own privacy terms to the traffic it handles. Logs are kept for 90 days and are not exported.

4. This website

The site sets no tracking cookies and loads no third-party scripts, fonts or analytics; its Content Security Policy allows only its own origin. The cabinet keeps your sign-in in an httpOnly cookie this site's own proxy sets (scoped to one URL, unreadable by page scripts; it dies with the browser unless you tick "stay signed in", which gives it a 30-day life), a random device id, the device secret the server hands this browser at each sign-in so that the next one needs no mailed code (one per account address, replaced by every sign-in, forgotten when the account is deleted), and the theme and language you pick in Settings, in local storage — nothing else.

5. Payments

Paid plans are paid in cryptocurrency, straight to our wallet at the address the invoice shows. Our payment service issues the invoice and watches that address: it sees the transfer the way anyone sees it on a public network, holds no money and moves none. We keep the invoice (the plan, the amount, the currency, when it was issued and paid) and never ask for your wallet's keys or seed phrase.

6. Your rights and the account's deletion

You can see everything the server holds about you in the cabinet: the account, its devices, its plan and its payment events.
You can delete the account from the cabinet. The server removes the account, its devices, the synced profiles' pointers and encrypted blobs, the subscription and team memberships. Payment history stays for the books, without a link to the account. Profiles on your own computers are untouched. measuredDeletion was exercised against a live server.
Requests that the cabinet cannot serve (a copy of your data in a file, a correction of the email) go to the support address; we answer by mail within 30 days.

7. Email

We send mail to confirm your address when you create an account (a 6-digit code, valid for 15 minutes, one attempt), to let in a device your account has not used before when two-step verification is off (the same kind of code), and to reset a password (a one-shot link valid for 30 minutes); before a paid plan ends, to remind you of it; and 7 days before cloud copies over your plan are removed, to warn you. The mail goes out through the SendPulse mail service.

8. Changes

The date at the top moves when this policy changes.

Terms · Refunds · What the server can and cannot see (technical) · Home