Privacy Policy

Last updated: 2026-11-06

1. Who we are

VolFlash ("we", "us") operates the website at https://volflash.com. This policy explains what personal data we collect, why, how long we keep it, and the choices you have. It covers the website, the email digest, and paid memberships.

2. What we collect

• Account data. Your email address and a password. Passwords are never stored in readable form — we keep only a salted PBKDF2-SHA256 hash.
• Sign-in data. A random session token in an HttpOnly cookie, so you stay logged in. We also record the time you last signed in.
• Membership and payment records. Your plan, the period it covers, the payment provider, the provider's order reference, and the amount. We do not receive or store card numbers, bank details, or your PayPal password — those stay with the payment provider.
• Email subscription data. If you subscribe to the digest: your email address, a confirmation token, the language you chose, and timestamps for subscribing, confirming, and unsubscribing.
• Language preference. A cookie recording whether you browse in Chinese or English.
• Network data. Like any website, our servers see the IP address and user-agent of requests. We use them transiently for rate limiting and abuse prevention. IP addresses are not stored in your account record, but they may appear in short-lived server logs (see section 6).
• Usage analytics. We use Umami, a privacy-oriented analytics service, to count page views and a small number of product events (for example, "upgraded to Pro"). It does not use advertising cookies and does not build cross-site profiles.

We do not collect your name, address, phone number, or any special-category data. We do not buy data about you from third parties.

3. Why we process it (legal bases)

• Contract. To create your account, deliver the service you signed up for, and process your membership.
• Legitimate interests. To keep the service secure and available: rate limiting, abuse prevention, debugging, and aggregate usage statistics.
• Consent. For the email digest. You give it by confirming the subscription, and you can withdraw it at any time by unsubscribing.
• Legal obligations. To keep records we are required to keep, for example payment and tax records.

4. Who we share it with

We do not sell your personal data, and we do not share it for advertising. We use these processors, each of which handles only what it needs:

• PayPal — payment processing. Receives what is necessary to take payment and to calculate tax based on your billing address.
• Resend — transactional email and the daily digest. Receives your email address and the message content.
• Umami — privacy-oriented page analytics.
• Our hosting provider — serves the site and stores the database.

We may also disclose data if we are legally required to, or to protect the rights and safety of the service and its users.

5. International transfers

Our servers are located outside mainland China, and the processors above operate in various countries. If you access the service from another region, your data will be transferred to and processed in these locations. We choose processors that offer appropriate safeguards for international transfers.

6. How long we keep it

• Account and membership records — until you delete your account, plus any period we are required to keep for tax and accounting purposes.
• Session tokens — expire automatically, and are deleted when you sign out.
• Email subscription records — until you unsubscribe or ask us to delete them.
• Server logs — rotated and deleted after a short retention period, currently 14 days.
• Backups — encrypted-at-rest database snapshots, currently kept for 14 days.

7. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, export it, restrict or object to certain processing, and withdraw consent. To exercise any of these, email yeluyide@gmail.com. We respond within 30 days and may ask you to verify that you control the email address on the account. You also have the right to complain to your local data-protection authority.

Deleting your account removes your account record, sessions, and subscription link. Records we must keep for tax or accounting reasons, and aggregated statistics that no longer identify you, may survive deletion.

8. Cookies

We set only two first-party cookies, both of which are functional: a session cookie that keeps you signed in, and a language cookie that remembers Chinese or English. Analytics is cookieless. We do not use advertising or tracking cookies, so there is no consent banner to dismiss.

9. Security

Passwords are hashed with PBKDF2-SHA256. Traffic is served over HTTPS. The database is accessible only from the server itself. Accounts are rate limited to slow down credential stuffing and bulk registration. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you.

10. Children

The service is intended for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

11. Changes

If we materially change this policy, we will post the new version here and update the date at the top. Where the change is significant, we will also notify registered users by email.

12. Contact

Questions about privacy: yeluyide@gmail.com.