Last updated
Privacy Policy
This policy covers vpress.app: the marketing pages, creating an account, and the dashboard where you manage your websites. It does not cover the websites our customers publish with VPress — each of those has its own operator, and its own policy.
Who is responsible
Where this policy says “we”, it means the operator of vpress.app. For everything described below we are the data controller — with one exception, set out under “Websites published on VPress”, where a customer is the controller of their visitors’ data and we act on their instructions.
What we collect
Your account. The name and email address you sign up with, and your password — stored only as a salted hash, never in a form anybody here can read.
Your websites. The name, subdomain and any custom domain of each website you create, the plan it is on, and the people you have invited to it.
What you publish. Pages, posts, categories, menus and uploaded media. We store it so we can serve it, and for nothing else.
Account email. The messages we send you to confirm your address or reset your password, and the fact that they were sent.
Technical records. The request logs our infrastructure keeps in order to serve pages, stop abuse and find faults: IP address, user agent, the address requested, and the time.
Bot checks. Sign-in, sign-up and comment forms are checked by Cloudflare Turnstile, which examines the browser and the request rather than the person, and tells us only pass or fail.
What we do not collect
There is no advertising, no third-party analytics, no tracking pixel and no profiling on vpress.app. We do not sell personal data and we do not share it for anyone else’s marketing. If that ever changes, the cookie page will name what was added, and it will stay switched off until you switch it on.
Why we use it
To provide what you asked for: your account, your websites, and the pages we serve on your behalf. This is the performance of our contract with you.
To keep the platform up and safe — rate limits, bot checks, abuse handling, backups. This is our legitimate interest, and yours.
To answer you when you get in touch, and to tell you about changes that affect your account.
To meet obligations the law puts on us, such as keeping records for a paid plan.
Cookies
The site sets a handful of cookies and every one of them is necessary: one remembers your answer to the cookie notice, one keeps you signed in, and Cloudflare may set its own security cookie. Each is listed by name, purpose and lifetime on the cookie page.
Where your data is kept
VPress runs on Cloudflare: the application on Workers, the database on D1, uploaded files on R2, and email through Cloudflare’s sending service. Data is stored and served from Cloudflare’s network, which spans many countries; transfers out of your own are covered by the standard contractual clauses in Cloudflare’s data processing addendum. There is no second hosting provider.
Who else sees it
Cloudflare, as described above: hosting, database, file storage, DNS for custom domains, bot protection and account email.
Nobody else — unless the law compels us, or you ask us to.
Where a legal request reaches us we will tell you about it, unless we are forbidden from doing so.
Websites published on VPress
A customer’s website is theirs. The content, and any personal data its visitors leave — a name and an email address on a comment, say — belong to that customer, who decides what is collected and why. We process it on their behalf and under their instructions, and never for anything of our own.
One detail is worth stating plainly, because it is unusual: when a visitor leaves a comment we store the name, email address and website they typed, but not their IP address. What is stored instead is a salted hash of it, which lets a moderator see that ten comments came from one place without anyone ever holding the address itself.
If you visited a site published on VPress and want your data removed, ask that site’s operator — they control it. You can write to us too, and we will help them act.
How long we keep it
Your account and its websites: for as long as the account exists.
Content and media: until you delete it, or until you delete the website it belongs to. Deleting a website removes its records from the database at once; the uploaded files behind it are swept afterwards, because a deletion that turns out to be a mistake is only recoverable while the files still exist.
Technical logs: days rather than months, held by our infrastructure provider and never assembled by us into a profile.
Anything the law requires us to keep, for as long as it requires.
Your rights
Where the GDPR or a comparable law applies to you, you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to a particular use, or ask us to restrict one. Much of it needs no asking: the dashboard lets you edit your profile, export a website’s content under Tools → Export, and delete a website or your entire account.
Write to us at the address below and we will answer within a month. If our answer does not satisfy you, you can complain to the data protection authority where you live.
How it is protected
Passwords are salted and hashed. Nobody here can read yours, including us.
Sessions are signed cookies scoped to the dashboard’s own hostname, so a website published on the platform can never see them.
Every record carries the website it belongs to and every query is scoped before it runs: separation between customers is built into the schema rather than left to care.
Everything is served over HTTPS, with certificates issued automatically for every domain.
Children
VPress is a tool for running websites and is not directed at children. You need to be old enough to enter into a contract where you live in order to hold an account. If you believe a child has given us personal data, tell us and we will remove it.
Changes to this policy
When this policy changes, the date at the top of the page changes with it. A change that materially affects you is announced by email to the address on your account before it takes effect.
Contact
Questions about this policy, or about the data we hold, go to privacy@vpress.app.