Your work, your privacy.

Draft notice: This page describes the current implementation. It is not a finalized legal privacy policy. The operator must confirm jurisdiction, retention rules, contact details and legal basis before inviting public registrations.

What the service stores

Account email, hashed password, username, profile details, active hashed sessions, uploaded media, page content, commission requests, conversations and moderation reports are stored in PostgreSQL and local file storage.

Where files live

Media files are stored on the operator's own configured storage volume. Public artwork and published profile media are accessible to visitors. Commission reference images and deliveries require order participant authorization.

Session security

Session cookies use the HttpOnly flag and SameSite protection. Passwords are hashed, and reset links expire. Email delivery uses the SMTP service configured by the operator.

Support and staff actions

Support requests, replies, private staff notes, and moderation audit records are stored to help resolve issues and document staff decisions. Ordinary account holders cannot read internal staff notes or other users' tickets.

Site analytics

Published creator pages record daily aggregate page views, page slugs, and referring hostnames. Analytics do not store raw IP addresses, tracking cookies, or unique visitor identifiers. Signed-in owner visits, recognized bots, and Do Not Track requests are excluded. Counts begin when analytics are enabled and can be affected by blockers and automated traffic.

Third parties

Vaylino does not require cloud object storage or analytics trackers. The server operator may use infrastructure providers and email delivery services disclosed in its final policy. Card payment processing has not been activated.

Your choices

You control whether artwork appears publicly and what your published pages display. Data export, account deletion workflows and formal privacy request handling remain launch requirements.