XIUSoftPrivacy Policy
This policy explains how XIUSoft handles personal data when you use the XIUSoft website (xiu.kr) and the XIUSoft account (account.xiu.kr). Data of an individual product such as LiveSSH is also covered by that product's own privacy policy (LiveSSH: LiveSSH Privacy Policy).
This is the previous version (1.1). It applies until 2026-10-12; from 2026-10-13, version 1.2 applies. Earlier version: 1.0.
Updated on 2026-10-09 without a new version number: daily encrypted database backups kept for 7 days (Sections 6, 9 and 10).
Summary
| Topic | Summary |
|---|---|
| Who is responsible | XIUSoft (시우소프트, Republic of Korea), contact@xiu.kr. Section 1. |
| Just visiting the website | Server logs (IP address, request time and path, browser identifier) are kept for 7 days. Pages on xiu.kr and livessh.xiu.kr show Google ads, and Google uses advertising cookies. No analytics. Sections 2 and 3. |
| XIUSoft account | We store the email address and sign-in identifier from your Apple or Google sign-in, a display name, your language setting, your sign-in sessions and your product entitlements. There is no separate email and password sign-up. Section 2. |
| Contact | The contact form only opens your email app; the website does not store what you write. Emails you send us are kept so we can answer. Section 2. |
| Where data is processed | Our servers in Osaka, Japan (Oracle Cloud) and the providers in Section 4 (mainly in the United States). Sections 4 and 5. |
| Your rights and deletion | On the account page you can edit your profile, download your data, sign out devices and delete your account yourself. Anything else: contact@xiu.kr. Sections 7 and 10. |
| Minimum age | 16. Section 8. |
1. Controller
The controller is XIUSoft (Korean name: 시우소프트) in the Republic of Korea. Representative: Ga Ram Jung (정가람). Business registration number: 752-41-01398. Address: 901-401, 33 Dongtanjungsimsangga 1-gil, Dongtan-gu, Hwaseong-si, Gyeonggi-do, Republic of Korea. Phone: +82 507-1432-9182. Privacy questions and requests to exercise your rights: contact@xiu.kr.
Our privacy officer is the representative, Ga Ram Jung, reachable at the email address and phone number above. This person is also the point of contact for privacy matters for users and supervisory authorities.
If the GDPR or the UK GDPR requires us to appoint a representative in the EU or the UK, we will appoint one and publish their name and address here. Until then, please contact us at contact@xiu.kr.
2. What we collect, why, and on what legal basis
We do not collect anything that is not in the table below. The legal bases are given for users in the EEA, the UK and Switzerland (GDPR).
| Data | Details | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Server logs | For requests to xiu.kr and account.xiu.kr: IP address, request time, request path, response status and browser identifier (user agent). Requests that carry sign-in codes, such as the sign-in callback, are not logged. | Security, abuse prevention, troubleshooting | Legitimate interests (Art. 6(1)(f)): operating the service safely. Kept for 7 days only. |
| XIUSoft account | The name of the sign-in provider (Apple or Google) and its account identifier, the email address the provider passes to us (with Apple this can be a private relay address) and, if you allow it, your name. A random user ID, the creation time and whether the email address is verified. | Creating the account, signing in, protecting the account | Contract (Art. 6(1)(b)) |
| Profile | Display name (optional), language setting. | Showing them on the account page and in apps that display your name | Contract (Art. 6(1)(b)) |
| Sign-in sessions | For each session: creation time, last refresh time, browser or app identifier (user agent). | Keeping you signed in and letting you see and sign out your devices on the account page | Contract (Art. 6(1)(b)) |
| Product entitlements | Which XIUSoft products you can use, the status and expiry of your entitlements and, if you subscribed through a product, the subscription record (store, product, status, expiry, auto-renewal). We do not receive payment details. How these records are created is described in each product's policy. | Showing your products and subscriptions on the account page, checking access to paid features | Contract (Art. 6(1)(b)) |
| Account deletion record | When you delete your account we keep a one-way hash of your user ID (not your email), the deletion time and the deletion steps that completed. It cannot identify you. | Proving that the deletion took place and finishing failed steps | Legitimate interests (Art. 6(1)(f)). Destroyed after at most 3 years. |
| Contact | Emails you send us (including what you send from your email app after using the contact form) and our replies. The contact form itself stores and sends nothing; it opens your email app. | Answering and keeping a record of requests | Legitimate interests (Art. 6(1)(f)). Kept for at most 3 years after the request is closed. |
We do not sell your data, use the data we hold (such as your account) for advertising, or use it for automated decisions with legal effect or for training AI models. Google ads on the website are described in Section 3. We do not collect special categories of personal data or location data.
3. Cookies, browser storage and advertising
The website uses no analytics and no third-party fonts. The only cookies and storage we set ourselves are the following; for advertising, see Website advertising below.
- Two preference cookies:
xiu_theme(display mode: system, light or dark) andxiu_lang(language). They are set only when you choose with the theme button or the language menu, never by just viewing a page. They last one year and can be read on the .xiu.kr domain so your choice carries over between xiu.kr, livessh.xiu.kr and account.xiu.kr. They contain no identifier. If you delete them, the defaults return (your device's display mode and your browser language). - Language hint: after we suggest the page in your browser's language once, only the fact that it was shown is stored in your browser's local storage, so it does not appear again.
- Account page: keeps your sign-in session and language choice in local storage and temporary sign-in values in session storage. The account page cannot work without them.
All of the items above are needed for features you ask for, so we do not ask for separate consent. You can delete them in your browser settings at any time.
Website advertising (Google AdSense)
Pages on the company website (xiu.kr) and the LiveSSH website (livessh.xiu.kr) show Google AdSense ads. The account page (account.xiu.kr) and the LiveSSH apps show no ads.
To show ads, Google uses cookies and similar technologies in your browser and, when you visit a page, automatically collects your IP address, browser and device information, the address of the page, cookie identifiers, and records of the ads shown and clicked. Google uses this to serve ads and measure their performance, to prevent click fraud and, where allowed, to show ads based on your interests (personalised ads). For this processing Google is an independent controller that processes the data for its own purposes; the Google Privacy Policy and How Google uses information from sites that use its services apply, and Google’s policies also set how long the data is kept. We receive no information from Google that identifies you, and we do not use XIUSoft account data for advertising.
Your choices:
- EEA, UK and Switzerland: a message from a Google-certified consent management platform asks for your choice. Until you consent, cookies are not used for advertising; if you do not consent, limited ads that do not use cookies may be shown. You can change your choice or withdraw consent at any time in the same message.
- Other regions: you can turn off personalised ads in Google My Ad Center and block or delete cookies in your browser settings. Ads still appear, but they are not based on your interests.
- Certain US states (such as California): Google’s processing for personalised ads may count as “sharing” personal information or “targeted advertising” under those states’ laws. You can opt out through the Google opt-out message shown on the page (“Do Not Sell or Share My Personal Information”).
- Republic of Korea (behavioural information): the party that collects and processes behavioural information is Google; the data, method, purposes, retention and how to refuse are as described above. Questions and complaints about behavioural information can be sent to contact@xiu.kr.
4. Recipients (processors and other recipients)
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| XIUSoft servers (self-operated on Oracle Cloud Infrastructure; hosting provider Oracle Corporation) | Website, account, server logs | As in Section 2 | Osaka, Japan |
| Google Workspace (Google LLC), our email provider | Receiving and answering contact emails | Email address and email content | United States and other Google locations |
| Google (Google AdSense; Google LLC, and Google Ireland Limited for users in the EEA and Switzerland) | Serving and measuring ads on the website. Independent controller (Section 3). | IP address, browser and device information, pages visited, cookie identifiers, ads shown and clicked | United States and other Google locations |
| Apple (Sign in with Apple), Google (Sign in with Google) | Sign-in. Each is an independent controller under its own policy. | Sign-in data | Worldwide |
Additional providers used by an individual product (for example LiveSSH's push notifications and subscription management) are listed in that product's privacy policy. We may disclose data to authorities, courts or advisers where the law requires it or to protect our rights, and to a successor if the business is transferred (we will tell you, and this policy will continue to apply).
5. International transfers
XIUSoft is in the Republic of Korea, our servers are in Japan, and our email provider and our advertising provider (Google) are in the United States and elsewhere, so your data crosses borders. Transfers happen over the network when you visit the website (including when Google loads ads), create an account or email us, and the data is kept for the periods in Section 6 (advertising data: under Google’s policies).
For users in the EEA, the UK and Switzerland: transfers to the Republic of Korea and Japan rely on the European Commission's adequacy decisions (Korea: (EU) 2022/254, Japan: (EU) 2019/419) and the UK adequacy regulations. Transfers to the United States rely on the EU-U.S. Data Privacy Framework (Google LLC is certified) or the Standard Contractual Clauses ((EU) 2021/914) with the UK and Swiss addenda. You can request a copy of the safeguards at contact@xiu.kr.
For users in the Republic of Korea (Personal Information Protection Act): the recipients, countries, purposes and data are listed in Section 4. You can refuse the transfers by not creating (or by deleting) an account and by not emailing us; in that case those features are not available. You can refuse advertising cookies as described in Section 3.
For users in Japan (Act on the Protection of Personal Information): our servers are in Japan. The Republic of Korea, where XIUSoft is located, has a comprehensive data protection law (the Personal Information Protection Act) enforced by an independent commission. Our providers in the United States, although the United States has no single comprehensive federal privacy law, are bound by their own privacy programmes and their contracts with us to protect the data and use it only for the stated purposes. You can ask us at contact@xiu.kr for more information about the foreign systems and the measures taken by recipients, and for disclosure, correction, suspension of use and deletion.
6. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, sessions, product entitlements | Until you delete your account. Deletion is immediate. We do not delete inactive accounts automatically. |
| Backups | The whole database is backed up once a day. Each backup is compressed and encrypted on our server in Osaka, Japan with a public key, so the server itself cannot decrypt it. Backups are kept 7 days and then deleted automatically. Data you delete, or that is deleted with your account, is therefore gone from every backup within 7 days. Backups are used only to restore the service after a failure or disaster. |
| Server logs | Rotated daily and deleted after 7 days. |
| Account deletion record (hash only) | Destroyed after at most 3 years. |
| Contact emails | Deleted at most 3 years after the request is closed. |
| Website advertising data | Not kept by us. How long Google keeps it is set by Google’s policies. |
How data is destroyed: data whose retention period has ended or whose purpose has been met is destroyed without delay. Electronic files are deleted so that they cannot be recovered, and we keep no personal data on paper. If another law requires us to keep some data, we keep it separately from other data and only for that period.
7. Your rights
Depending on the law where you live, you have the right to access, correct and delete your data, to restrict or object to processing, to data portability and to withdraw consent. Unless the law provides an exception, we give these rights to every user, wherever they live.
How to exercise them: on the account page you can edit your profile, download your data, sign out devices and delete your account yourself. For anything else, write to contact@xiu.kr from the email address of your account. We may ask you to confirm your identity, and we answer within the period set by law and in any case within 30 days (within 10 days for requests under Korea's Personal Information Protection Act).
If you are not satisfied with our answer, you can complain to the data protection authority where you live. In the Republic of Korea you can ask the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office cyber investigation division (spo.go.kr, 1301) or the National Police Agency cyber bureau (ecrm.police.go.kr, 182) for help. Users in Japan can complain to the Personal Information Protection Commission (PPC), and users in the EEA, the UK, Switzerland, Brazil and elsewhere to their national authority, and where local law gives you stronger rights than this policy, local law applies.
8. Children
You must be at least 16 to create a XIUSoft account; if your country sets a higher age, that age applies. We do not knowingly collect personal data from anyone under 16. If you believe we have such data, please tell us at contact@xiu.kr and we will delete it without delay.
9. Security measures
- All connections use TLS (Let's Encrypt certificates).
- Row-level security in the database lets each account reach only its own data.
- Except for the HTTPS entry point, server ports are closed to the internet; administrative access is possible only over a private network.
- The account page enforces a strict Content Security Policy and loads no third-party scripts.
- Daily database backups are encrypted as they are made, with a public key; the private key needed to decrypt them is not on the server.
No system is perfectly secure. If a personal data breach affects you, we will inform you and the competent authorities without undue delay and within the legal deadlines.
10. Deleting your account
On the account page > Delete account, sign in again and type the confirmation word, and your account and the account data on our servers are deleted immediately. Copies in our encrypted backups, which exist only for disaster recovery, disappear within 7 days (Section 6). Deleting the account deletes it for every XIUSoft product that uses it; what each product deletes is described in that product's policy. Store subscriptions are not cancelled by deleting the account, so cancel them in the store first. If you cannot use the account page, write to contact@xiu.kr from your account's email address; after confirming it is you, we delete the account within 30 days.
11. Changes to this policy
We post each new version here with its date and provide earlier versions on request. We announce important or unfavourable changes, such as new kinds of data, purposes or recipients, at least 30 days before they apply, and other changes at least 7 days before, on the website or by email, and we ask for consent where the law requires it.
12. Contact
Privacy questions and requests: contact@xiu.kr. Phone: +82 507-1432-9182. Postal address: XIUSoft, 901-401, 33 Dongtanjungsimsangga 1-gil, Dongtan-gu, Hwaseong-si, Gyeonggi-do, Republic of Korea.