Incomplete privacy notice, reviewed 26 September 2026. Account practices are described below, but verified controller identity, applicable lawful bases and data locations have not been supplied. This document is not a completed legal policy. Privacy requests: privacy@vampemail.com. Email delivery and monitoring remain unverified; signed-in export and deletion controls are linked below.
Legal
Privacy Notice
What a Vampelium account keeps, why it keeps it, and how long for. Written from
the system itself, with remaining operational and legal disclosures explicitly marked as unsettled.
Last updated
26 September 2026
Applies to
vampelium.com and your Vampelium account
Cookies we set
One, and only to keep you signed in
The short version
Six things worth knowing before the fine print.
This is a plain-language summary of current practices. The disclosure gaps in the numbered sections mean this is not yet a completed legal policy.
We ask for very little
An account starts with an email address, username and password hash. It can also hold a display name, profile picture, optional personal details and country, privacy settings, advertising interests and preferences, blocked advertisers, and recovery metadata.
We never store your password
It's turned into a scrambled value using scrypt. Nobody here can read it or recover it — including us.
One cookie. That's it.
It keeps you signed in. There is no advertising cookie, no analytics cookie and no third-party tracker, which is why you were never shown a cookie banner. Ads are matched to your account, never to a tracking cookie.
Your email is for your account
We use it to confirm the address is really yours and to reach you about your account. We don't sell it, rent it or trade it.
Signing in leaves a record
Each sign-in stores the time, the IP address the request came from, and what your browser says it is. It's how a sign-in that isn't you can be spotted.
Sessions run out on their own
A sign-in lasts up to 30 days, then stops working. Sign out and the record for that sign-in is deleted straight away.
Everything below says the same thing in more detail, and says what we don't yet know.
Where a fact belongs in a privacy policy but isn't settled, it appears as a marked gap
rather than a guess.
01
Who we are and what this covers
Vampelium Inc. runs the Vampelium account: the sign-in that sits in front of everything
we make. This policy describes what that account holds about you.
It covers the vampelium.com website, creating and signing in to a Vampelium account,
confirming your email address, and using your Vampelium account to sign in to another
application that supports it.
The organisation responsible for that information is
[TO BE CONFIRMED: the legal entity that acts as data controller],
trading as Vampelium Inc.
Scope not yet settled
Our other services are described on the About page. Whether they sit under this same
policy or carry their own notice has not been decided:
[TO BE CONFIRMED: whether this policy also covers VampStore, VampMessage, VampAI, VampSecurity, VampData and VampCompute, or whether each has a separate notice].
Until that is confirmed, treat this document as covering your account and the sign-in
that goes with it.
02
What we hold, and how it gets there
Almost all of it you typed in yourself. The rest is the small amount of technical
information a sign-in cannot work without.
Your account
When you create an account we store the core fields below. If you add them, we also store a profile picture and its metadata; personal details such as country and birth date; privacy settings; advertising interests and preferences; blocked advertisers; and recovery-phrase metadata. Held billing and payment records are described separately by the account and payment services.
Email address
The address you signed up with. We use it to confirm the account is yours and to reach you about it.
Username
The name you chose to sign in with.
Display name
Optional. If you leave it blank, nothing is stored in its place.
A scrypt hash of your password
Not the password. A one-way scrambled value produced by scrypt, along with the random salt used to produce it. It cannot be turned back into your password by us or by anyone who obtained a copy of it.
Whether your email address is verified
A yes/no flag, set once you enter the code we email you.
When the account was created and last changed
Two timestamps.
Staying signed in
Each time you sign in, we create a session — the thing that keeps you signed in as you
move between pages. A session record holds:
A hashed session token. Your browser holds the token; we keep only a hash of it, so a copy of our database does not hand anyone a working sign-in.
Timestamps. When the session started, when it expires, and when it was last used.
Your browser's description of itself. The "user agent" line browsers send, naming the browser and operating system.
The IP address the sign-in came from.
Sessions expire 30 days after they are created.
Confirming your email address
When we email you a six-digit code, we store a hash of the code, when it expires, when it
was created, and how many wrong guesses have been made against it. The code expires
10 minutes after we send it, and the record is deleted as soon as the code is used
successfully — or after too many incorrect attempts. Asking for a new code replaces the old one.
Keeping sign-up and sign-in from being attacked
To stop someone hammering the sign-in form, we keep a small counter. Each row holds a key
derived from your IP address — or, when you ask us to resend a verification email, from
your account — together with a count and the time the current counting window started.
No page you visit and nothing you type is recorded here.
Using your Vampelium account to sign in elsewhere
If you use your Vampelium account to sign in to another application, we store which
application you approved and which permissions you granted it, so you are not asked the
same question every time. Asking for a wider permission asks you again.
We also store the tokens that keep that connection working: the short-lived code that
completes the sign-in (hashed, valid for one minute, usable once) and, if the application
asked to stay connected, a refresh token — stored as a hash, valid for
30 days, and replaced each time it is used. The access token itself is not
stored at all; it is signed and self-contained.
What the other application actually receives depends on what you approved:
—Always: an identifier for your account.
—With the profile permission: your username and your display name (or your username again, if you didn't set one).
—With the email permission: your email address and whether it is verified.
Your password, and its hash, are never shared with any application.
Advertising
Vampelium shows ads. They are chosen and served by us, from data you gave us
here — there is no outside ad network involved, and you are not followed
across other websites.
When an ad is shown to you, we record exactly this and nothing else:
—Which campaign and which image was shown, and where on the page.
—Which account it was shown to, whether it appeared on screen, and whether you clicked it.
—Whether personalisation was switched on at that moment, and when it happened.
Your IP address is not recorded against an ad, and neither is
your browser, the page you came from, or any device identifier. That record is
deleted after 90 days.
Personalised ads are off unless you turn them on. While they are
off, choosing an ad does not read your interests or your country at all —
those are not fetched and discarded, they are never looked at. If you switch
personalisation on, we use only the interests you chose yourself and the country
on your account. Switching it off again erases the interests you had stored. You
can also block an advertiser or a campaign outright, and blocked advertisers are
excluded before an ad is chosen.
What we don't do
—No analytics or measurement product runs on this site.
—No third-party advertising network, pixel, beacon or tracker is embedded in these pages. Ads on Vampelium are served by Vampelium, from data you gave us here.
—We do not track you across other websites, and nothing about you is sold, rented or shared with advertisers.
—Personalised ads are off unless you turn them on. While they are off, nothing about your interests or country is read when choosing what to show you.
—We do not ask for a phone number, a date of birth, an address, or a payment card to create an account.
03
Cookies
We set exactly one cookie, and only once you sign in.
vmp_session
Keeps you signed in. It holds a random token and nothing else — no name, no email,
nothing readable. It is HttpOnly, so scripts running in the page cannot read it;
Secure, so it is only ever sent over an encrypted connection; and
SameSite=Lax, which restricts cross-site cookie use. The cookie can still accompany cross-site top-level safe-method navigations, such as following a link, and requests from same-site subdomains. It lasts
up to 30 days, and signing out clears it immediately.
Why there's no cookie banner
A banner exists to ask permission for cookies that aren't necessary — the ones that
measure you, follow you, or sell what they learn. We don't set any. The single cookie
we do set is strictly necessary to keep you signed in, and refusing it would simply
mean not being able to sign in at all.
You can delete it at any time in your browser settings. Doing so signs you out.
04
Why we hold it
The information above supports these purposes, including advertising:
To give you the account you asked for. Your email, username, display name and password hash exist so the account can exist at all.
To keep you signed in. Sessions and the one cookie.
To confirm you are reachable, and to protect the account. Verification codes, the sign-in record, and the rate-limit counters that blunt automated attacks.
To honour a choice you made. The record of which applications you approved, and for what.
Advertising: account-linked impressions and clicks measure delivery and engagement; optional interests and country support targeting, and blocked-advertiser preferences control which ads are shown. The applicable lawful basis for advertising, like the other purposes below, requires verification before this becomes a completed policy.
If you are somewhere with data protection law that requires us to name a lawful basis for
each of these, the mapping is:
[TO BE CONFIRMED: the data protection law(s) Vampelium is subject to, and the lawful basis relied on for each purpose above].
Where your information is stored and handled, and the arrangements covering any transfer
between countries:
[TO BE CONFIRMED: countries or regions where account data is stored, and the transfer mechanism relied on].
05
How long we keep it
The short-lived things are genuinely short-lived. These periods are the ones the system
enforces, not aspirations.
Retention at a glance
What
How long
What ends it
Account details
For as long as the account exists
Deleting the account
Session (incl. IP and browser)
Up to 30 days
Expiry, or signing out — which deletes the record
Email verification code
10 minutes
Deleted once used, once too many wrong guesses are made, or replaced when you request a new one
Rate-limit counter
Reset when the counting window passes
The next request after the window ends
Sign-in code for another app
1 minute
Expiry, or being used once
Refresh token for another app
30 days
Expiry, rotation, or revocation
Record of an app you approved
Until it is removed
Remove access in My apps, or delete your account
Ad impressions (which ad you were shown)
90 days
Deleted automatically after 90 days. Account deletion removes the user association; de-identified impressions remain for up to 90 days.
Ad preferences and blocked advertisers
Until you change them
You change them, or delete your account
Gaps we won't paper over
Expired sessions and spent rate-limit counters stop working the moment they expire, but
the routine that clears the rows afterwards is not something we can state precisely
yet: [TO BE CONFIRMED: the schedule on which expired session, verification-code and rate-limit rows are purged].
Deleting your account, and what happens to the records above afterwards:
You can schedule deletion in Security. It is scheduled, not immediate: for 14 days you can cancel and keep everything. After that a job running daily removes your account, your sessions, your codes, your connected-app permissions, your ad preferences and your profile picture. De-identified ad impressions can remain until their 90-day expiry. Retention rules for financial, audit and enforcement records require a separately verified legal schedule.
We don't sell your information or rent it. Vampelium does show ads, and it sells
that space to advertisers — but advertisers never receive your identity. They
see counts: how many times a campaign was shown, viewed and clicked. Never who.
Cloudflare
Vampelium runs on Cloudflare. Cloudflare hosts this site and the code behind it, stores
the account database, and delivers the emails we send you. That means your account
information is processed on Cloudflare's infrastructure on our behalf.
Email we send about your account — the verification code, for instance — is sent from the
vampelium.dev domain. Mail from us will arrive from
there rather than from vampelium.com.
Applications you choose to connect
When you approve an application, it receives the details listed in section 2 — no more.
Once your information reaches that application, how the application handles it is
governed by its own privacy policy, not this one.
Legal requests
We may have to disclose information where the law requires it. Our approach to those
requests, and whether we notify the person affected:
[TO BE CONFIRMED: policy on responding to legal and law-enforcement requests, and whether affected users are notified].
Beyond Cloudflare, we don't name other companies here, because no other company is
involved in running your account. If that changes, this section changes with it.
07
How we protect it
The design principle throughout: hold as little as possible, and hold the sensitive parts
in a form that is useless to whoever steals them.
Passwords are hashed with scrypt, each with its own random salt. scrypt is deliberately slow and memory-hungry, which makes guessing at scale expensive. We cannot recover your password, tell you what it is, or read it back to you — if you lose it, it has to be reset.
Session tokens, verification codes and refresh tokens are stored hashed, never in a readable form.
Traffic is encrypted in transit, and the session cookie is marked Secure so it is never sent over an unencrypted connection.
Sign-in attempts are rate-limited, and a wrong password takes the same time to answer whether or not the account exists — so the sign-in form can't be used to discover which email addresses are registered.
Signing out deletes that session's record immediately, rather than marking it inactive.
A reused connection token is treated as theft. If a refresh token that has already been exchanged shows up again, the whole connection it belongs to is revoked.
No system is perfect, and we won't pretend otherwise. If you believe you have found a
security problem, please write to
security@vampemail.com. Our timescales for
telling people about a breach:
[TO BE CONFIRMED: breach notification commitment and timescale].
08
Your choices and your rights
Depending on where you live, the law may give you specific rights over your information.
Whether or not it does, we'll act on these requests.
—See what we hold. Ask us for a copy of your account information.
—Correct it. Your display name, username and email address can be wrong, or simply out of date.
—Delete it. Ask us to close your account and remove it.
—Take it elsewhere. Ask for your information in a portable form.
—Withdraw an approval. Disconnect an application you previously allowed into your account.
—Object or complain. Tell us you disagree with something we're doing, and have a person look at it.
To make any of these requests, write to us at the address in section 11. We will ask you
to prove you control the account before we act on a request about it, because a privacy
request is also an attractive way to attack someone else's account.
The exact rights that apply to you, how quickly we must respond, and the regulator you
can complain to if we get it wrong:
[TO BE CONFIRMED: applicable privacy rights by region, statutory response deadline, and the supervisory authority or regulator for complaints].
09
Children
Vampelium accounts are not designed for young children, and we do not knowingly collect
information from a child below the age at which an account is permitted.
The minimum age for a Vampelium account, and what we do if we learn an account belongs to
someone below it:
[TO BE CONFIRMED: minimum age for a Vampelium account, per region, and the process when an underage account is identified].
If you believe a child has created an account, contact us and we'll look into it.
10
Changes to this policy
When this policy changes, the updated version is published on this page and the
"Last updated" date at the top changes with it. We won't quietly reduce your protections
and hope the date goes unnoticed.
How we tell you about a significant change, and how much notice you get before it takes
effect:
[TO BE CONFIRMED: notification method and notice period for material changes to this policy].
The law that governs this policy and any dispute about it:
[TO BE CONFIRMED: governing law and jurisdiction].
11
How to reach us
A privacy question should reach a person, not a form that goes nowhere.
[TO BE CONFIRMED: named privacy contact, and whether a data protection officer is required and appointed]
About the gaps in this document
Several details above are marked as unconfirmed. They are marked rather than filled in
because a privacy policy that states something untrue about a company is worse than one
that admits what is still being settled. Each will be replaced with a real answer, and
the "Last updated" date will move when they are.