Privacy Policy & Data Protection (GDPR)

At VlahX, your privacy and personal data security are a fundamental priority. This document explains transparently what data we collect, how we use it, and how you can exercise your rights to access, rectify, and permanently delete (Right to be Forgotten) your data.

1. Data We Collect and Purpose of Processing

  • Classic Authentication (Email & Password): Your email address, name, and password. Passwords are stored exclusively as secure cryptographic hashes (PBKDF2-SHA256) and cannot be read by anyone.
  • Social Authentication (Google OAuth2 / Telegram Login): Unique identifier provided by the provider, email address, and profile name.
  • Optional Profile Data: First name, last name, phone number, bio, intent, and avatar image.
  • User Generated Content (UGC): Comments posted on articles and media files uploaded by you.

2. Cookies and Browsing Session

  • Session Cookie (`session`): Encrypted with HMAC to keep you logged in while browsing.
  • Language Preference Cookie (`vlahx_locale`): Remembers your preferred language.

3. GDPR Rights & 30-Day Grace Period for Account Deletion

⏳ 30-Day Grace Period & Permanent Purge

Upon requesting account deletion, your account enters a 30-day grace period:

  • During these 30 days, your account is deactivated and hidden from the public.
  • You can log back in anytime within 30 days to cancel deletion and recover your account with 1 click.
  • After 30 days, our system executes a permanent purge: physical deletion of all your comments, uploaded files/avatars from disk, and removal from the database.