Draft Terms of Service

This document is a draft for the Vampelium account and website. A verified contracting entity, registration details and address have not been supplied. The Vampelium brand is not a substitute for those disclosures.

This draft is not offered for acceptance. A completed, legally reviewed agreement must identify the contracting party before it can be published as operative terms.

See the privacy notice for current data practices and remaining disclosure gaps.

The minimum age and any regional eligibility rules remain undecided and require legal review. This draft does not impose or claim to enforce an age limit. Account eligibility and signup enforcement must be aligned before operative terms are published.

Current account forms require a username and password and use email verification. Do not send another person's credentials or create an account using an email address you cannot access.

Your password is the thing standing between your account and everyone else. Protecting it is your responsibility, and it matters more than any other obligation in these terms.

• Choose a strong one. We require at least 10 characters and allow up to 200. We deliberately don't demand a capital letter and a symbol — length is what actually makes a password hard to guess, and fiddly rules just push people toward predictable substitutions.
• Don't reuse it. If a password you use elsewhere leaks from that other site, it becomes a key to your Vampelium account too.
• Keep it to yourself. Don't share it, and don't enter it anywhere other than a Vampelium sign-in page. No genuine app, and nobody at Vampelium, will ever ask you for it.
• You are responsible for what happens under your account while it is signed in, unless and until you tell us it has been compromised.

We store your password only as a hashed value, using a deliberately slow, memory-hard algorithm. We cannot read your password, and we cannot tell you what it is — not by email, not on the phone, not ever. Anyone who offers to is not us.

If you think someone else has your password or has been in your account, tell us as soon as you can at support@vampemail.com, and change your password if you can.

Changing a password, and recovering an account when the password is forgotten, works like this: Security to change a known password, or password recovery if you cannot sign in.

To slow down anyone guessing at passwords, we limit how many sign-in attempts can come from one internet connection in a fifteen-minute window. If you are briefly told to try again shortly, that is why, and it clears on its own.

Signing in creates a session that lasts 30 days. It is held in a cookie in the browser you signed in with, and it is what keeps you signed in between visits. After 30 days it expires and you sign in again.

• Signing out ends that session immediately — we delete it on our side, not just in your browser. A signed-out session cannot be resumed, even by someone holding the old cookie.
• Sessions are separate per browser and per device. Signing out on your laptop does not sign you out on your phone.
• Along with each session we record when it was created, when it was last used, the network address it came from and the browser it reported. We use this to protect accounts — see the privacy policy for the detail.
• Reviewing your active sessions and ending them individually: Security.

If you use a shared or public computer, sign out when you're finished. A session left open on someone else's machine is a session someone else can use.

You can use your Vampelium account to sign in to apps made by other people. When one asks, we show you an approval screen naming the app and listing exactly what it wants. Nothing is shared until you press Allow.

The screen names each item in plain words. These are the only things an app can be granted:

openid

Confirm who you are

profile

See your username and display name

email

See your email address and whether it is verified

offline_access

Stay signed in when you are not using the app

• An app never receives your password. It receives only the items you approved, and only for as long as your approval stands.
• It gets nothing beyond what was on the screen. If an app later wants something more, we ask you again.
• Access is short-lived and renewed quietly. The credential an app uses expires after an hour. If you approved “stay signed in”, it can renew without troubling you; if you didn't, it will have to ask you again.
• Apps built by us are labelled. The approval screen marks a Vampelium-made app as such, so you can tell ours from someone else's.
• You can withdraw approval at any time. When you do, everything that app is holding for your account stops working at once — not at the end of the hour, and not only the credential you revoked. Where to do this: My apps.

An app you connect is run by whoever made it, not by us. Once you approve it, what it does with the information it can see is governed by that app's own terms and privacy policy, and we are not responsible for it. Only approve apps you actually trust, and check the name on the screen before you press Allow.

If you build an app that uses Vampelium sign-in, you must also register it with us and use it honestly: don't misrepresent who you are, don't ask for more than your app needs, and don't pass on what you receive to anyone the person didn't expect.

Use the services the way they were meant to be used: for your own ordinary, lawful purposes. The rest of this section is the short list of things that are not allowed.

Don't use the services to harm people

• Breaking the law, or helping someone else break it.
• Harassing, threatening, stalking or abusing anyone.
• Impersonating another person or organisation, or pretending an app or message comes from Vampelium.
• Defrauding people, or running phishing, scam or malware campaigns.
• Sharing material you have no right to share, or that sexually exploits or endangers a child.
• Collecting other people's personal information in bulk, whether by scraping, automation, or by any other means.

Don't attack the services

• Trying to reach an account, a piece of data, or a system that isn't yours.
• Guessing at passwords or verification codes, whether by hand or with a tool.
• Working around our rate limits, sign-in checks or other protections — including by spreading requests across many addresses or accounts.
• Probing, scanning or stress-testing the services without our written permission, or interfering with anyone else's use of them.
• Creating accounts automatically, or holding accounts you don't use in order to reserve names.
• Reselling the services, or presenting them as your own.

Security research is welcome when it is done responsibly. If you find a vulnerability, report it to us at security@vampemail.com for review. A formal disclosure policy and safe-harbour terms have not been published. Don't access other people's data, don't degrade the service for others, and don't hold a finding to ransom.

You are responsible for anything you upload, send or store through the services, and for making sure you have the right to do so.

We would rather fix a problem than close an account. But we may suspend, limit or close an account if:

• it breaks these terms, and particularly the acceptable use section above;
• it is being used in a way that puts other people, their data, or the services at risk;
• we have good reason to believe it has been taken over by someone else, in which case we may lock it to protect you; or
• we are required to by law, or by a valid legal order.

Where it is reasonable and lawful to do so, we will tell you what happened and give you a chance to put it right before we act. Where the harm is serious, ongoing, or illegal, we may act first and explain afterwards.

If we close or suspend your account, active sessions end and any app you had connected loses its access. You may no longer be able to sign in or reach what was stored there.

If you think we got it wrong, you can ask us to look again: support@vampemail.com.

A service-withdrawal notice process and lead time remain undecided; this draft makes no advance-notice commitment.

The services are provided “as is” and “as available”. Beyond what the law requires of us, and beyond what we have promised you in writing, we make no warranties about them.

In particular, we do not promise that:

• the services will be uninterrupted, available at any particular moment, or free of faults;
• every error will be fixed, or fixed within any particular time;
• the services will meet a specific need you have in mind, or work with any particular device, browser or third-party app; or
• anything stored with us will never be lost or corrupted.

Please keep your own copies of anything you cannot afford to lose. It is the single most useful precaution you can take, with us or with any other service.

Nothing in this section takes away rights you have under consumer law that cannot be given up by agreement. Some places do not allow certain warranties to be excluded; where that is so, this section applies only as far as the law there allows.

No liability cap or allocation of legal risk has been adopted in this draft. These provisions require qualified legal review before publication as an agreement. Nothing on this draft page limits statutory rights or sets an enforceable cap.

Edits to this draft update the date at the top. There is no operative change-notice process or acceptance by continued use for this draft.

Before final terms are published, the notification channel, advance notice period and effective date must be defined and implemented. Those values have not been approved.

To end this browser's session, use Sign out. Sessions otherwise expire 30 days after creation.

To request account deletion, open Security and confirm with your password. Deletion is scheduled with a 14-day cancellation period; the daily cleanup processes it after that period. You can cancel the request in Security during the waiting period.

For retained records and de-identified advertising history, see the privacy notice. Account deletion does not erase information an independent connected app has already copied.

No governing law, dispute forum or mandatory pre-dispute procedure has been selected. These matters require legal review, including applicable consumer protections. This draft asks you to accept none of them.

Questions can be addressed to support@vampemail.com; this address is not designated here as a formal legal-notice service address.

Severability, transfers, third-party rights and entire-agreement provisions remain subjects for legal review. This draft replaces no existing agreement and is not itself the entire agreement.

For anything about these terms, your account, or a security problem, write to us at support@vampemail.com.

A verified postal address and formal legal-notice process have not been supplied. Email delivery and monitoring have not been verified by this review.