Privacy Policy

Yave Networks (the "Company") operates Yave Tools (tools.yave.net, the "Service"). This policy explains how we collect, use, keep and delete personal information, in line with the Korean Personal Information Protection Act and, for users in the EEA and UK, the GDPR.

Most tools run entirely in your browser. Files and text you put into the image, PDF, QR code, business card, document viewer, folder structure, batch file, token, developer, Pomodoro, mental math, contract and device check tools are never sent to our servers, and we cannot see them.

• When you sign in (Yave account): account identifier, email address, name, profile picture URL, language setting, whether your email is verified and whether two-step verification is on. We never receive your password.
• When you use features that store data on our servers: files you share and their details (name, size, type, expiry, download count, a hash of the link password), documents you save to the server (notes, settlements), teams, folders, members and the email addresses you invite, and team activity records (who did what and when).
• Plans and payments: order number, plan, amount, payment and subscription status and period, and usage. Card and other payment details are handled by our payment processor (YavePay); we do not receive or store them.
• URL inspector: addresses you inspect are used only to follow their redirects and are not stored. Screenshot images are not stored either; we only count daily renders for plan limits.
• Generated automatically: session data that keeps you signed in, request counts for abuse prevention (by IP address for requests made while signed out), and an encrypted hash of the reporter's IP address to deduplicate abuse reports on shared links.

• To sign you in and provide the features you ask for (file sharing, document storage, team collaboration, URL inspection) — performance of a contract
• To apply plans and process and record payments and refunds — contract and legal obligation
• To prevent abuse and keep the Service secure, and to handle abuse reports — legitimate interests
• To answer your requests and send service messages such as team invitations and scheduled team dissolution notices

• Account information and the files and documents you store are kept until you delete your Yave account, and are then deleted without delay.
• Files and documents uploaded to a team's shared folders belong to the team, so they remain after you delete your account until the team deletes them or the team itself is deleted. A team's activity log is kept while the team exists, but when you delete your account your email address is removed from it (entries then show "Deleted user").
• Shared files are deleted when the expiry you set (within your plan's limit) passes.
• Sessions last at most 30 days and request counts at most 1 day. Pending team invitations are deleted, together with the invited email address, when they expire.
• Records that the law requires us to keep are kept for that period: contract, withdrawal, payment and supply records for 5 years, and complaint and dispute records for 3 years (Korean Act on Consumer Protection in Electronic Commerce).
• Electronic records are deleted in a way that cannot be recovered.

We use the following providers to run the Service and require them by contract to protect your data.

• Cloudflare, Inc. (United States) — hosting, database, file storage, screenshot rendering and cookieless visit statistics. Data may be processed anywhere on Cloudflare's global network.
• NAVER Cloud Corp. (Republic of Korea) — sending team invitation and notice emails (recipient address and message).
• The Yave account service — sign-in and account management. YavePay — payment processing.

• We use only two cookies, both strictly necessary for sign-in: __Host-yave_session (keeps you signed in, up to 30 days) and __Host-sso_state (protects the sign-in step against forgery, 10 minutes). We use no advertising or tracking cookies, so there is no cookie consent banner.
• Visit statistics (Cloudflare Web Analytics) use no cookies and do not identify individuals.
• Your language setting, tool settings (such as Pomodoro times), notes or settlements you write while signed out, text you type into the character counter, and your speed-test best scores are kept only in your browser's storage (localStorage) and are never sent to us. Clearing site data in your browser removes them.

• You can ask at any time to access, correct, delete or restrict the processing of your personal information, and you can withdraw consent by deleting your account.
• Export: download your files from the file sharing page and your documents with each tool's Export button at any time.
• Delete: delete files and documents directly on each page, or your whole account in your Yave account settings.
• For anything else, contact mail@support.yave.net or help.yave.net. We respond within the period required by law (in principle within 10 days).
• If you are in the EEA or UK you also have the right to object and to lodge a complaint with your local data protection authority.

• All traffic is encrypted with HTTPS, and sign-in tokens are encrypted at rest (AES-256-GCM).
• Link passwords are stored only as hashes, and a link is locked for a while after repeated wrong attempts.
• Access to personal information is limited to what is necessary.

The Service is not directed at children under 14 (or the minimum age in your country), and we do not knowingly collect their personal information.

• Privacy officer: Baek Seo-jin (Representative) · mail@support.yave.net
• You can report or seek advice on a personal information infringement from the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 within Korea), the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office (www.spo.go.kr, 1301) or the Korean National Police Agency (ecrm.police.go.kr, 182).

We announce changes on the Service at least 7 days before they take effect (30 days for changes that are unfavourable to you).