Privacy Policy
Your workbooks are read and compared in your browser, on your device. They never reach our servers. We keep only what sign-in, licenses and billing need: your e-mail address, when your trial started, your organization and your plan.
This policy explains how Enloint (representative: Kim, Sung eun; business registration number 211-23-70065), 402-748A, 12 Teheran-ro 70-gil, Gangnam-gu, Seoul, Republic of Korea, the operator of xellshift (“we”), handles personal data when you use the app at app.xellshift.com and the website at xellshift.com. We are the controller of this data. For questions or requests, write to support@xellshift.com.
1. What we never receive
Workbooks, the values and formulas in them, your notes, results and the reports you export are processed on your device and are not sent to us or to anyone else. The app loads nothing from other servers, and its Content Security Policy lets it connect only to its own address, and only for sign-in, licenses and billing:
- Comparing, and Why it changed on the built-in sample, make no request.
- With a valid license stored on your device, Why it changed makes no request either. The app asks for a new license only when the stored one is missing or about to expire.
You can check this in your browser’s developer tools. Neither the app nor the website uses analytics, advertising or tracking.
2. What we collect, why, and for how long
- Your account: your e-mail address and when the account was made, to sign you in and to send you sign-in links. Kept while your account exists.
- Your trial: when it started (at your first sign-in), to give the 14-day trial once per person. Kept while your account exists.
- Sign-in links: a fingerprint (hash) of each one-time link, the address it went to and a fingerprint of the IP address that asked for it, to send the link and limit abuse. Each link works once, for 15 minutes; these records are deleted about a day later.
- Sessions: a fingerprint (hash) of your session, kept for up to 90 days or until you sign out, to keep you signed in.
- Licenses: your plan and when each license was issued and expires, to issue licenses and to prevent misuse. Kept while your account exists.
- Organizations and seats: the organization’s name, its members’ e-mail addresses and roles, and when each was added, so the owner and admins can manage seats. Kept while the organization exists; when a member is removed, the record says so and when, and their seat is freed.
- Billing: from Freemius, the license bought (its ID, plan, number of seats and dates), the buyer’s e-mail address, and the company or personal name on the order, used as the organization’s name. We never receive card or bank details. Kept while the license matters for your plan and as tax and accounting rules require.
- Messages you send us, to answer them.
We process this data to provide the service you asked for (sign-in, licenses, organizations and purchases), and for our legitimate interest in keeping the service secure and free of abuse.
3. Who processes it for us
- Cloudflare hosts the app, the website and our database (Cloudflare D1). The database is kept in Cloudflare’s EU jurisdiction. Like any web host, Cloudflare handles request data such as IP addresses to deliver and protect the service.
- Resend sends our sign-in and seat e-mails.
- Freemius is the reseller and merchant of record for purchases. It processes your payment and billing details as an independent controller under its own privacy policy, and gives us the license details above. When you open the checkout, the app passes your e-mail address to Freemius.
We do not sell personal data or share it with anyone else, except where the law requires it. Some of these providers process data outside your country, including in the United States and the Republic of Korea, where we operate; such transfers rely on the providers’ data protection terms, including the EU Standard Contractual Clauses where they apply.
4. Cookies and your browser’s storage
When you sign in, the app sets one cookie, xs_session, needed to
keep you signed in; it is sent only to the app’s own sign-in and license
service (/api). The app also keeps your account details and your
license in your browser’s own storage, on your device, so that
Why it changed works without asking our server each time. Clearing your
browser’s data for app.xellshift.com removes them. The website sets no
cookies.
5. Your rights
You can ask us for a copy of your personal data, to correct it, to delete it or your account, to restrict or object to its processing, or to receive it in a portable form. Write to support@xellshift.com from the address on your account; we answer within one month. Deleting an account removes your account, sessions and seats; billing records may be kept as tax rules require. You may also complain to your data protection authority, for example in the EU the authority of your country, or in Korea the Personal Information Protection Commission.
6. Security
Sign-in links and sessions are stored only as fingerprints, all traffic is encrypted, licenses are signed, and the app is locked down by its Content Security Policy. Only the operator can access the database.
7. Children
xellshift is meant for professionals and students, and is not directed at children under 16.
8. Changes
We will post any update here with its effective date, and tell signed-in users about material changes by e-mail or in the app.
Contact
Controller and person responsible for personal data: Enloint, 402-748A, 12 Teheran-ro 70-gil, Gangnam-gu, Seoul, Republic of Korea · support@xellshift.com