XIUSoftPrivacy Policy
This policy explains how XIUSoft handles personal data when you use the XIUSoft website (xiu.kr) and the XIUSoft account (account.xiu.kr). Data of an individual product such as LiveSSH is also covered by that product's own privacy policy (LiveSSH: LiveSSH Privacy Policy).
This is the previous version (1.0). It applies until 2026-10-08; from 2026-10-09, version 1.1 applies.
Updated on 2026-10-09 without a new version number: daily encrypted database backups kept for 7 days (Sections 6, 9 and 10).
Summary
| Topic | Summary |
|---|---|
| Who is responsible | XIUSoft (시우소프트, Republic of Korea), contact@xiu.kr. Section 1. |
| Just visiting the website | Only server logs (IP address, request time and path, browser identifier) are kept, for 7 days. No analytics, no ads, no tracking cookies. Sections 2 and 3. |
| XIUSoft account | We store the email address and sign-in identifier from your Apple or Google sign-in, a display name, your language setting, your sign-in sessions and your product entitlements. There is no separate email and password sign-up. Section 2. |
| Contact | The contact form only opens your email app; the website does not store what you write. Emails you send us are kept so we can answer. Section 2. |
| Where data is processed | Our servers in Osaka, Japan (Oracle Cloud) and the providers in Section 4 (mainly in the United States). Sections 4 and 5. |
| Your rights and deletion | On the account page you can edit your profile, download your data, sign out devices and delete your account yourself. Anything else: contact@xiu.kr. Sections 7 and 10. |
| Minimum age | 16. Section 8. |
1. Controller
The controller is XIUSoft (Korean name: 시우소프트) in the Republic of Korea. Representative: Ga Ram Jung (정가람). Business registration number: 752-41-01398. Address: 901-401, 33 Dongtanjungsimsangga 1-gil, Dongtan-gu, Hwaseong-si, Gyeonggi-do, Republic of Korea. Phone: +82 507-1432-9182. Privacy questions and requests to exercise your rights: contact@xiu.kr.
Our privacy officer is the representative, Ga Ram Jung, reachable at the email address and phone number above. This person is also the point of contact for privacy matters for users and supervisory authorities.
If the GDPR or the UK GDPR requires us to appoint a representative in the EU or the UK, we will appoint one and publish their name and address here. Until then, please contact us at contact@xiu.kr.
2. What we collect, why, and on what legal basis
We do not collect anything that is not in the table below. The legal bases are given for users in the EEA, the UK and Switzerland (GDPR).
| Data | Details | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Server logs | For requests to xiu.kr and account.xiu.kr: IP address, request time, request path, response status and browser identifier (user agent). Requests that carry sign-in codes, such as the sign-in callback, are not logged. | Security, abuse prevention, troubleshooting | Legitimate interests (Art. 6(1)(f)): operating the service safely. Kept for 7 days only. |
| XIUSoft account | The name of the sign-in provider (Apple or Google) and its account identifier, the email address the provider passes to us (with Apple this can be a private relay address) and, if you allow it, your name. A random user ID, the creation time and whether the email address is verified. | Creating the account, signing in, protecting the account | Contract (Art. 6(1)(b)) |
| Profile | Display name (optional), language setting. | Showing them on the account page and in apps that display your name | Contract (Art. 6(1)(b)) |
| Sign-in sessions | For each session: creation time, last refresh time, browser or app identifier (user agent). | Keeping you signed in and letting you see and sign out your devices on the account page | Contract (Art. 6(1)(b)) |
| Product entitlements | Which XIUSoft products you can use, the status and expiry of your entitlements and, if you subscribed through a product, the subscription record (store, product, status, expiry, auto-renewal). We do not receive payment details. How these records are created is described in each product's policy. | Showing your products and subscriptions on the account page, checking access to paid features | Contract (Art. 6(1)(b)) |
| Account deletion record | When you delete your account we keep a one-way hash of your user ID (not your email), the deletion time and the deletion steps that completed. It cannot identify you. | Proving that the deletion took place and finishing failed steps | Legitimate interests (Art. 6(1)(f)). Destroyed after at most 3 years. |
| Contact | Emails you send us (including what you send from your email app after using the contact form) and our replies. The contact form itself stores and sends nothing; it opens your email app. | Answering and keeping a record of requests | Legitimate interests (Art. 6(1)(f)). Kept for at most 3 years after the request is closed. |
We do not sell your data, use it for advertising, or use it for automated decisions with legal effect or for training AI models. We do not collect special categories of personal data or location data.
3. Cookies and browser storage
The website uses no analytics, no ads, no third-party scripts or fonts and sets no tracking cookies. It only uses the following.
- Two preference cookies:
xiu_theme(display mode: system, light or dark) andxiu_lang(language). They are set only when you choose with the theme button or the language menu, never by just viewing a page. They last one year and can be read on the .xiu.kr domain so your choice carries over between xiu.kr, livessh.xiu.kr and account.xiu.kr. They contain no identifier. If you delete them, the defaults return (your device's display mode and your browser language). - Language hint: after we suggest the page in your browser's language once, only the fact that it was shown is stored in your browser's local storage, so it does not appear again.
- Account page: keeps your sign-in session and language choice in local storage and temporary sign-in values in session storage. The account page cannot work without them.
All of these are needed for features you ask for, so we do not ask for separate consent. You can delete them in your browser settings at any time.
4. Recipients (processors and other recipients)
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| XIUSoft servers (self-operated on Oracle Cloud Infrastructure; hosting provider Oracle Corporation) | Website, account, server logs | As in Section 2 | Osaka, Japan |
| Google Workspace (Google LLC), our email provider | Receiving and answering contact emails | Email address and email content | United States and other Google locations |
| Apple (Sign in with Apple), Google (Sign in with Google) | Sign-in. Each is an independent controller under its own policy. | Sign-in data | Worldwide |
Additional providers used by an individual product (for example LiveSSH's push notifications and subscription management) are listed in that product's privacy policy. We may disclose data to authorities, courts or advisers where the law requires it or to protect our rights, and to a successor if the business is transferred (we will tell you, and this policy will continue to apply).
5. International transfers
XIUSoft is in the Republic of Korea, our servers are in Japan and our email provider is in the United States and elsewhere, so your data crosses borders. Transfers happen over the network when you visit the website, create an account or email us, and the data is kept for the periods in Section 6.
For users in the EEA, the UK and Switzerland: transfers to the Republic of Korea and Japan rely on the European Commission's adequacy decisions (Korea: (EU) 2022/254, Japan: (EU) 2019/419) and the UK adequacy regulations. Transfers to the United States rely on the EU-U.S. Data Privacy Framework (Google LLC is certified) or the Standard Contractual Clauses ((EU) 2021/914) with the UK and Swiss addenda. You can request a copy of the safeguards at contact@xiu.kr.
For users in the Republic of Korea (Personal Information Protection Act): the recipients, countries, purposes and data are listed in Section 4. You can refuse the transfers by not creating (or by deleting) an account and by not emailing us; in that case those features are not available.
For users in Japan (Act on the Protection of Personal Information): our servers are in Japan. The Republic of Korea, where XIUSoft is located, has a comprehensive data protection law (the Personal Information Protection Act) enforced by an independent commission. Our providers in the United States, although the United States has no single comprehensive federal privacy law, are bound by their own privacy programmes and their contracts with us to protect the data and use it only for the stated purposes. You can ask us at contact@xiu.kr for more information about the foreign systems and the measures taken by recipients, and for disclosure, correction, suspension of use and deletion.
6. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, sessions, product entitlements | Until you delete your account. Deletion is immediate. We do not delete inactive accounts automatically. |
| Backups | The whole database is backed up once a day. Each backup is compressed and encrypted on our server in Osaka, Japan with a public key, so the server itself cannot decrypt it. Backups are kept 7 days and then deleted automatically. Data you delete, or that is deleted with your account, is therefore gone from every backup within 7 days. Backups are used only to restore the service after a failure or disaster. |
| Server logs | Rotated daily and deleted after 7 days. |
| Account deletion record (hash only) | Destroyed after at most 3 years. |
| Contact emails | Deleted at most 3 years after the request is closed. |
How data is destroyed: data whose retention period has ended or whose purpose has been met is destroyed without delay. Electronic files are deleted so that they cannot be recovered, and we keep no personal data on paper. If another law requires us to keep some data, we keep it separately from other data and only for that period.
7. Your rights
Depending on the law where you live, you have the right to access, correct and delete your data, to restrict or object to processing, to data portability and to withdraw consent. Unless the law provides an exception, we give these rights to every user, wherever they live.
How to exercise them: on the account page you can edit your profile, download your data, sign out devices and delete your account yourself. For anything else, write to contact@xiu.kr from the email address of your account. We may ask you to confirm your identity, and we answer within the period set by law and in any case within 30 days (within 10 days for requests under Korea's Personal Information Protection Act).
If you are not satisfied with our answer, you can complain to the data protection authority where you live. In the Republic of Korea you can ask the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office cyber investigation division (spo.go.kr, 1301) or the National Police Agency cyber bureau (ecrm.police.go.kr, 182) for help. Users in Japan can complain to the Personal Information Protection Commission (PPC), and users in the EEA, the UK, Switzerland, Brazil and elsewhere to their national authority, and where local law gives you stronger rights than this policy, local law applies.
8. Children
You must be at least 16 to create a XIUSoft account; if your country sets a higher age, that age applies. We do not knowingly collect personal data from anyone under 16. If you believe we have such data, please tell us at contact@xiu.kr and we will delete it without delay.
9. Security measures
- All connections use TLS (Let's Encrypt certificates).
- Row-level security in the database lets each account reach only its own data.
- Except for the HTTPS entry point, server ports are closed to the internet; administrative access is possible only over a private network.
- The account page enforces a strict Content Security Policy and loads no third-party scripts.
- Daily database backups are encrypted as they are made, with a public key; the private key needed to decrypt them is not on the server.
No system is perfectly secure. If a personal data breach affects you, we will inform you and the competent authorities without undue delay and within the legal deadlines.
10. Deleting your account
On the account page > Delete account, sign in again and type the confirmation word, and your account and the account data on our servers are deleted immediately. Copies in our encrypted backups, which exist only for disaster recovery, disappear within 7 days (Section 6). Deleting the account deletes it for every XIUSoft product that uses it; what each product deletes is described in that product's policy. Store subscriptions are not cancelled by deleting the account, so cancel them in the store first. If you cannot use the account page, write to contact@xiu.kr from your account's email address; after confirming it is you, we delete the account within 30 days.
11. Changes to this policy
We post each new version here with its date and provide earlier versions on request. We announce important or unfavourable changes, such as new kinds of data, purposes or recipients, at least 30 days before they apply, and other changes at least 7 days before, on the website or by email, and we ask for consent where the law requires it.
12. Contact
Privacy questions and requests: contact@xiu.kr. Phone: +82 507-1432-9182. Postal address: XIUSoft, 901-401, 33 Dongtanjungsimsangga 1-gil, Dongtan-gu, Hwaseong-si, Gyeonggi-do, Republic of Korea.