Privacy Policy

This Privacy Policy explains what personal information Vexto ("Vexto", "we", "us") collects when you use our website and our Vexto desktop application (together, the "Service"), why we collect it, how we protect it, and the choices you have. We have written it in plain language and we have tried to keep our data collection as small as we reasonably can. By creating an account or using the Service you confirm that you have read this policy.

1. Who we are and how to reach us

Vexto is the controller of the personal information described in this policy. If you have any question about privacy, or want to exercise any of the rights described below, contact us at support@acrostorm.com. Please write "Privacy" in the subject line so that we can route your message quickly.

2. Information we collect

We collect only the information needed to run accounts, deliver downloads and keep the Service secure. This falls into four groups.

Account information. When you sign in with Google we receive your Google account ID, your e-mail address and your display name from Google, and we create a Vexto username for you. We never receive or store your Google password. A few older accounts, such as the owner's, may have a password, which we store only as a salted, one-way hash (scrypt). We also store the date your account was created and your role (user, teacher, moderator, admin or owner).
Session information. When you log in we create a random session token that is stored on our server and in a cookie on your device. It lets you stay logged in and lets us expire or revoke your session.
Technical information. Like most websites, our servers and hosting provider may process your IP address, browser type, requested pages and timestamps in ordinary server logs. We also hold your IP address briefly in memory to limit repeated login attempts and protect accounts from guessing attacks.
Student number. Each account receives a randomly generated student number so that you can write it on your optical forms and your teachers can match a form to your account. Teachers, administrators and the owner can look up a student by number, username or name.
Sign-in and preference data. We store the language you chose when you first signed in, and, when you sign in to the Vexto app through your browser, a short-lived one-time code (stored as a hash) that expires after 10 minutes.
Moderation records. If an account is warned, suspended or banned, we record the reason, the date, the duration and the administrator who acted, so that we can enforce our Terms of Use and handle appeals.
Messages you send us. If you e-mail us we keep the message and our reply so that we can help you and handle follow-up questions.

We do not ask for your real name, phone number, address, date of birth, payment details or government identifiers, and we do not run advertising or sell personal information.

3. How we use your information

We use the information above to create and secure your account and to authenticate you when you log in; to give logged-in users access to the install page and downloads; to publish service announcements, downtime notices and update notes; to prevent abuse, fraud and security incidents; to answer your questions and provide support; to meet our legal obligations; and to improve the reliability of the Service. We do not use your information for automated decision-making that has legal or similarly significant effects on you, and we do not build advertising profiles.

4. Legal bases for processing

Where data protection law such as the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of a contract (providing your account and downloads under our Terms of Use); our legitimate interests in keeping the Service secure, preventing abuse and understanding how it is performing, which we balance against your rights; compliance with legal obligations; and your consent where we ask for it, which you may withdraw at any time.

5. The Vexto desktop app and data on your device

The desktop app is designed to work on your own computer. Your settings, such as colours, fonts, clock options, timer length and ray options, are stored locally on your device. Your list of locked apps is also stored locally in a file inside the app's data folder. We do not receive your settings or your locked-app list.

When you start a focus session with app locking turned on, the app asks your operating system to close the applications you chose and checks periodically that they stay closed. To build the app chooser it reads the names, shortcuts and icons of installed programs on your device. This happens only on your device. Vexto does not capture your screen, does not log keystrokes, does not read the contents of other applications and does not monitor your browsing.

The website and the app load fonts from Google Fonts. When they do, Google may receive technical information such as your IP address, as described in Google's own privacy policy. If you prefer, you can block these requests and the interface will fall back to system fonts.

6. Mobile companion and QR linking

We are developing a mobile companion that you will be able to link to your account by scanning a QR code. This feature is not available yet. When it launches, we expect to process a device identifier and linking status for each phone you connect, and we will update this policy and tell you before any new data is collected. You will be able to unlink a device at any time.

7. Cookies and local storage

We use a single essential cookie, named "sid", which keeps you logged in. It is marked HttpOnly and SameSite and, on secure connections, Secure. Without it you cannot log in. We also use your browser's local storage to remember the colour theme you choose on the website. We do not use advertising, analytics or cross-site tracking cookies. Because these items are strictly necessary for features you request, they do not require a consent banner under most laws, but you can delete them at any time in your browser settings.

8. Who we share information with

We do not sell or rent your personal information. We share it only with service providers that help us run the Service, such as our hosting and file storage providers and Google (for sign-in), who may process it on our behalf under confidentiality and data protection obligations; with professional advisers or authorities where we are legally required to; and with a successor if Vexto is ever merged or acquired, in which case this policy would continue to apply to your information. Site administrators can see the usernames of other administrators, and the owner can see the e-mail addresses of admin accounts, but ordinary administrators cannot browse user passwords or sessions, which are never visible to anyone.

9. International transfers

Our hosting provider may store and process information in countries other than the one where you live. Where we transfer personal information out of the European Economic Area, the United Kingdom or other regions with transfer rules, we use appropriate safeguards such as standard contractual clauses or an adequacy decision.

10. How long we keep information

We keep account information for as long as your account exists. If you delete your account from the Account page, we remove your account record and your active sessions immediately. Server logs are kept for a limited period, normally no longer than 90 days, unless we need to keep them longer to investigate abuse or comply with the law. E-mails to support are kept for as long as needed to resolve your request and for a reasonable period afterwards. Backups are overwritten on a regular rolling cycle. Moderation records, and the username and e-mail address of a banned account, may be kept for as long as needed to enforce the ban, prevent evasion and handle appeals, even if you ask us to delete the account, because we have a legitimate interest in protecting the Service and its other users.

11. How we protect your information

We protect your information with salted password hashing, random session tokens, HTTPS in production, HttpOnly cookies, rate limiting on login and registration, request checks against cross-site request forgery and restricted access to administration features. Staff permissions are limited to the role they were given. No system is completely secure, and we cannot guarantee absolute security, but we take the protection of your data seriously and will notify you and the relevant authorities where the law requires us to after a breach.

12. Your rights and choices

Depending on where you live, including under the GDPR, the UK GDPR, Turkey's Personal Data Protection Law (KVKK), and certain US state laws, you may have the right to:

access the personal information we hold about you and receive a copy;
correct information that is inaccurate or incomplete;
delete your information (you can delete your account yourself, or ask us to);
restrict or object to certain processing, including processing based on our legitimate interests;
receive your information in a portable format;
withdraw consent where we rely on it; and
lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at support@acrostorm.com. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law, normally within one month.

13. Children

The Service is intended for people aged 16 and over. If you are younger than 16 you may create an account only with the permission and supervision of a parent or guardian who accepts our Terms of Use on your behalf. We do not knowingly collect personal information from children without that permission. If you believe a child has given us information without permission, contact us and we will delete it.

14. Links to other sites

Our website may link to third-party websites. We are not responsible for their content or privacy practices, and we encourage you to read their policies before giving them any information.

15. Changes to this policy

We may update this Privacy Policy from time to time, for example when we add features such as the mobile companion. We will post the new version on this page with a new "last updated" date and, if the changes are significant, we will give you additional notice, for example by a banner on the website. Your continued use of the Service after a change means you accept the updated policy.

16. Contact

Questions, requests or complaints about privacy can be sent to support@acrostorm.com.