Privacy Policy
Your workbooks, inputs, results and reports are calculated and stored in your browser, on your device. They never reach our servers. We keep only what sign-in, licenses and billing need: your e-mail address, your organization and your plan.
This policy explains how Enloint (representative: Kim, Sung eun; business registration number 211-23-70065), 402-748A, 12 Teheran-ro 70-gil, Gangnam-gu, Seoul, Republic of Korea, the operator of xellstorm (“we”), handles personal data when you use the app at app.xellstorm.com and the website at xellstorm.com. We are the controller of this data. For questions or requests, write to support@xellstorm.com.
1. What we never receive
The calculation engine runs inside your browser tab. Workbooks, the values in them, your setups, simulation results and the reports you export are processed on your device and are not sent to us or to anyone else. The app loads nothing from other servers, and its Content Security Policy lets it connect only to its own address; you can check this in your browser’s developer tools. Neither the app nor the website uses analytics, advertising or tracking.
2. What we collect, why, and for how long
- Your account: your e-mail address and when the account was made, to sign you in and to send you sign-in links. Kept while your account exists.
- Sign-in links: a fingerprint (hash) of each one-time link, the address it went to and the IP address that asked for it, to send the link and limit abuse. Each link works once for 15 minutes; these records are deleted about a day after it expires.
- Sessions: a fingerprint of your session, kept for up to 90 days or until you sign out, to keep you signed in.
- Licenses: your plan and when each license token was issued and expires, to issue licenses and to prevent misuse. Kept while your account exists.
- Organizations: the organization’s name, its members’ e-mail addresses and roles, and open invitations, so owners and admins can manage seats. Kept while the organization exists; when a member leaves or is removed, the record says so and when, and their seat is freed.
- Billing: from Freemius, the license bought (its ID, plan, number of seats and dates), the buyer’s Freemius user ID and e-mail address, and the company or personal name on the order, used as the organization’s name. We never receive card or bank details. Kept while the license matters for your plan and as tax and accounting rules require.
- Messages you send us, to answer them.
We process this data to provide the service you asked for (sign-in, licenses, organizations and purchases), and for our legitimate interest in keeping the service secure and free of abuse.
3. Who processes it for us
- Cloudflare hosts the app, the website and our database. The database is kept in Cloudflare’s EU jurisdiction. Like any web host, Cloudflare handles request data such as IP addresses to deliver and protect the service.
- Resend sends our sign-in and invitation e-mails, from its EU region.
- Freemius is the reseller and merchant of record for purchases. It processes your payment and billing details as an independent controller under its own privacy policy, and gives us the license details above. When you open the checkout or the billing portal, the app passes your e-mail address to Freemius.
We do not sell personal data or share it with anyone else, except where the law requires it. Some of these providers process data outside your country, including in the United States and the Republic of Korea, where we operate; such transfers rely on the providers’ data protection terms, including the EU Standard Contractual Clauses where they apply.
4. Cookies and your browser’s storage
When you sign in, the app sets one cookie, xs_session, needed to keep you signed in; it is sent only to the app’s own sign-in service. The app also keeps data in your browser’s own storage, on your device: recent workbooks with their setups, run history, settings, your license token, and the step you were on. It stays on your device and is never sent to us; clearing your browser’s data for app.xellstorm.com removes it. The website sets no cookies.
5. Your rights
You can ask us for a copy of your personal data, to correct it, to delete it or your account, to restrict or object to its processing, or to receive it in a portable form. Write to support@xellstorm.com from the address on your account; we answer within one month. Deleting an account removes your account, sessions and memberships; billing records may be kept as tax rules require. You may also complain to your data protection authority, for example in the EU the authority of your country, or in Korea the Personal Information Protection Commission.
6. Security
Sign-in links and sessions are stored only as fingerprints, all traffic is encrypted, licenses are signed, and the app is locked down by its Content Security Policy. Only the operator can access the database.
7. Children
xellstorm is meant for professionals and students, and is not directed at children under 16.
8. Changes
We will post any update here with its effective date, and tell signed-in users about material changes by e-mail or in the app.
Contact
Controller and person responsible for personal data: Enloint, 402-748A, 12 Teheran-ro 70-gil, Gangnam-gu, Seoul, Republic of Korea · support@xellstorm.com