Privacy policy: what Faxvio receives, keeps, shares and deletes

Who is responsible for my data?

The data controller is Vast Flow, LLP, a limited liability partnership registered in Almaty, Republic of Kazakhstan, which publishes the Faxvio app and this website. In this policy “we”, “us” and “Faxvio” mean that publisher. Every privacy question, request or complaint goes to [email protected]; there is no other channel, and we answer within a reasonable time, normally within two business days and in any case within the period the law of your country allows. The person responsible for privacy inside the publisher, including for the purposes of laws that require a named privacy officer, is reachable at that address.

This policy covers two things: the app, where documents are handled, and the website, which handles nothing of yours except the ordinary traffic of a website and the analytics described below. Where the two differ, the section says so. It also covers the free tools on the website, which process what you type or drop into them entirely inside your browser.

What data does Faxvio process, why, and for how long?

The table is the whole inventory. Everything else in this policy explains a row of it.

Nothing else is collected. In particular, the app does not collect your name, your email address, your phone number, your contacts, your location, your photo library, your calendar, your health data, your Apple ID, or any advertising identifier, and it does not build a profile of you from anything above.

Who am I, as far as Faxvio is concerned?

You are an identifier. When the app first runs it generates a random account identifier on the device and stores it in the Keychain, marked as synchronisable, so the same identifier reaches your other Apple devices through iCloud Keychain. That is how one page balance follows you from iPhone to Mac without a login. The identifier is not derived from anything about you: not your Apple ID, not your phone number, not your name, not your device’s serial number. It is shown in the app under Settings → About, and it is the only key to anything we hold; keep a note of it if you ever expect to ask us about your balance.

Alongside the identifier, the app sends a device hash when it registers, and, once, an attestation from Apple’s App Attest service and, where the device supports it, a DeviceCheck token. These exist for one purpose: to grant the single first page that is on us, once per device and once per account, and to stop that grant being farmed by reinstalling. Apple’s attestation tells our server that the request came from a genuine copy of Faxvio on a genuine Apple device; it tells us nothing about who owns the device. We do not use it for any other purpose.

What happens on my device, and what needs a permission?

• Camera. The document camera is used only while you are scanning a page, and only after you have granted the camera permission the system asks for. Frames are processed on the device to find the page edges; the scan becomes a page in your draft and nothing is sent anywhere until you press send.
• Photos and Files. Importing a photo or a PDF uses the system pickers, which hand the app only the item you chose; the app never reads your library or your files as a whole.
• Contacts. Choosing a number from Contacts uses the system contact picker, which hands the app only the number you tapped and needs no permission, because the app never reads the address book.
• Share sheet. A document shared into Faxvio from another app is copied into the app’s own storage as a draft; nothing is uploaded until you send it.
• Notifications. Optional. Faxvio asks for permission once, on the first run, with a single Continue button that leads to the system prompt.
• Stored on the device only: drafts, the pages of a fax after it is sent (kept 7 days, 30 days or until you delete them, as you set), the receipt PDFs, History, recent recipients and the display copy of your balance. Deleting the app deletes all of it, and we hold no copy.

What does Faxvio receive when I send a fax?

To send a fax, our server has to receive the fax. When you press send, and only then, the app uploads: the document pages as a single PDF the app assembled from your scans, files or photos, up to 50 pages and 19 MB; the destination fax number in international form; the cover-page fields if you turned the cover page on, being the recipient name, your sender name, a subject and a note, which you typed for the purpose of printing them on the cover; the page count and the time zone used for the header line; and your account identifier, so the pages can be debited from the right balance. Our server records the IP address the request came from in its request log and applies the rate limits (currently 10 faxes per hour and 60 per day per account). It checks the destination against the app’s allow-list of 37 countries and territories and computes the page charge before anything is transmitted.

We never read, index, search, classify or analyse the content of a document, by a person or by software, and no artificial intelligence or machine learning of any kind is applied to it. The server treats the PDF as an opaque file to be handed to the carrier. The names on a cover page are part of the document you chose to send and are handled exactly like the pages.

Where does my document go, and who sees it?

A fax is a phone call between two machines, and somebody has to place the call. Faxvio hands your document and the destination number to its fax carrier, Telnyx, a US telecommunications provider, which dials the number, negotiates with the receiving machine and transmits the pages. The carrier reports back the state of the call — queued, sending, delivered, failed — and that report is what the app shows you. The sender number printed on the header line of every received page is the carrier’s line assigned to Faxvio; your own phone number is never used, never requested and never disclosed.

Between the app and our server, and between our server and the carrier, the document is encrypted in transit with TLS. The final leg is different, and we say so plainly: from the carrier’s network to the receiving fax machine the pages travel as a fax signal over the telephone network, which is not end-to-end encrypted and never has been. That is a property of fax, not of Faxvio, and it is the same for every fax ever sent by any means. If a document is too sensitive to be transmitted as a fax, it should not be faxed at all.

No party on this list receives your document except the carrier that has to transmit it and the hosting provider whose server hands it over. Each is bound by a contract to process data only on our instructions and only for the purpose in the table, and each publishes its own privacy commitments, which we have checked provide protection at least equal to this policy. We do not sell personal data, we do not share it for advertising, and we do not give any parent, affiliate or partner access to it, because there are none with access.

How long is my document kept?

As briefly as the transmission allows. The uploaded PDF sits in a holding area on our server, the spool, only until the fax carrier has accepted it for transmission. The moment the carrier confirms acceptance, the spool copy is deleted. As a safety net for anything the carrier never accepts — a rejected upload, a failure mid-request — a sweeper removes every spool file older than 24 hours. Documents therefore never survive on our server beyond a day, and in the ordinary case they survive for seconds. Documents are never included in any backup. Records of a fax are never written to a log with page content: our logs hold that a job existed, its state changes and any error the carrier reported.

The carrier holds its own copy for as long as the transmission needs, under its own published policy. We do not control the receiving machine or whoever operates it; a fax that has arrived is the recipient’s document from that moment, as it would be from any other sender.

What does Faxvio keep after the fax is done?

The fact that it happened. For each fax we keep the destination number, the page count and the pages charged, the states the carrier reported with their timestamps, the transmission identifier, and the error reason if it failed. This record lets the receipt be checked, lets a failed fax be refunded, and lets us answer a support question such as “did my fax of Tuesday afternoon go through”. It is deleted 90 days after the fax. Request logs, which hold the IP address and the timing of API calls, are deleted after 30 days. Attestation challenges expire after 10 minutes.

The ledger is different. Because pages never expire, the record of your purchases and page credits has to exist for as long as your balance does, and for as long as accounting law requires purchase records to be kept. The ledger contains your account identifier, the purchase transactions as reported by Apple, and every page credited or debited with its reason. It contains nothing that identifies you as a person. Where a backup of the ledger or the transmission records is taken, it holds no documents and follows the retention of the data it contains.

What about purchases?

Page packs are bought through Apple’s in-app purchase system. Apple charges your payment method under Apple’s own privacy policy, and we receive from Apple a receipt saying that a purchase of a given product happened; we never see a card number, a billing address, your name or your Apple ID. To credit the pages reliably, including when a purchase completes while the app is closed, we use RevenueCat, a purchase-validation service, which receives an anonymous app-generated subscriber identifier and the App Store receipt and returns whether the purchase is valid. Neither record contains a name or an email address. Refund requests for a purchase go to Apple; when Apple refunds a pack, Apple tells RevenueCat and us, and the pages are removed from the balance as described in the terms.

Does the app track me?

No. The app contains no analytics library, no crash-reporting library and no advertising SDK, it holds no advertising identifier (IDFA), and it shows no App Tracking Transparency prompt, because it has nothing to ask permission for. What it does do is measure our own advertising: when a purchase is validated, RevenueCat also receives the vendor identifier (IDFV, an id that is specific to this publisher and resets when you delete our apps), the IP address of that request, and Apple’s AdServices attribution token, which tells us that an install came from one of our own App Store ads and nothing about you. That is measurement of our own campaigns, not tracking: no data broker, no third-party ad network, no profile of you, and nothing is combined with data from other companies’ apps or websites. The App Store privacy label declares it as a Device ID used for the developer’s advertising or marketing, not linked to your identity. Beyond that the app does not fingerprint the device beyond the hash used at registration, and it sends no usage events of any kind. The network connections the app makes are, in full: to our server, to Apple’s App Store, notification, attestation and ad-attribution services, and to RevenueCat. There are no others. The App Privacy label on the App Store declares the categories above — identifiers, user content and purchases, used for app functionality and not linked to your identity — rather than claiming “Data Not Collected”, because a server that receives your documents does collect data, briefly, and the label is written to match this policy.

Push notifications are optional. If you allow them, Apple issues a device token that our server stores against your account identifier so it can send one notification when a fax is delivered or returned. The notification carries the outcome, the destination as the app displays it and the page count, and never the content of a page. If you decline, the app checks the status itself while it is open, and nothing is lost except the notification. If you turn notifications off later in iOS Settings, Apple stops delivering them and tells our server that the token is dead the first time it tries; the token is deleted at that point. “Delete all data on this device”, in the app’s Settings, removes it immediately.

What does the website collect?

faxvio.com is a static site. The free tools on it — the cover sheet generator, the cost calculator, the number formatter, the fax preview and the transmission time calculator — run entirely in your browser: what you type or drop into them is processed by the page and never uploaded, and there is no upload endpoint on the site. The website does not know your Faxvio account identifier and cannot connect a visit to a fax.

The site uses Microsoft Clarity, a session-analytics service, to understand how pages are used. Clarity records page views, clicks, scrolling and the movement of the pointer, and sets cookies to recognise a returning browser; Microsoft processes that data under its own privacy statement and may use it, as Microsoft states, to improve its products. Clarity is not loaded if you switch it off below, or if your browser sends the Global Privacy Control signal, which we honour as an opt-out. The site is served through Cloudflare, which sees your IP address as any host would and may set a short-lived security cookie. No other third party runs on the site: no advertising, no social plug-ins, no font servers, no embedded video.

Is my data transferred to other countries?

Yes, by the nature of the service. Our server is hosted in Germany; the fax carrier operates from the United States and terminates calls wherever the receiving machine is; the purchase-validation service is in the United States; the publisher is in Kazakhstan. A fax you send from Paris to a number in Tokyo crosses at least three jurisdictions before it reaches the machine. For transfers out of the European Economic Area, the United Kingdom and Switzerland we rely on the processors’ standard contractual clauses and, where a processor is certified under the EU–US Data Privacy Framework, on that certification; the data that crosses borders is the minimum needed for the purpose in the table. We have not appointed a representative in the EU or the UK under Article 27 of the GDPR, because our processing of data from those territories is occasional, does not involve monitoring, and is limited to what a single fax needs.

How is my data protected?

Every connection the app makes is encrypted with TLS, and the server refuses plain HTTP. Documents are held only in the spool and deleted on acceptance; nothing about page content is logged; the carrier’s and the purchase service’s keys live on the server and never in the app, so a copy of the app cannot be used to reach them. Access to the server is limited to the publisher, by key-based SSH, and the databases are readable only by the service account that runs Faxvio. The first-page grant is protected by Apple’s attestation rather than by anything you have to type. No security measure is perfect; if we ever learn of a breach affecting personal data we will notify the supervisory authority where the law requires it, within 72 hours in the EEA and the UK, and, because we hold no way to contact you individually, announce it in the app and on this page.

What are my rights, and how do I use them without an account?

Wherever you live, you can ask us what data we hold that relates to your account identifier, have it corrected, have it deleted, receive it in a portable form, object to its processing, restrict its processing while a dispute is settled, and withdraw any consent you gave — notifications, or website analytics — without affecting what was lawful before. Because there is no account, the only thing that ties data to you is your account identifier, which the app shows under Settings → About. To make a request, email [email protected] from any address and include that identifier; without it, we have no way to find your records, which is the price of not having an account. We may ask you to confirm the request from the app, for instance by sending a one-page fax we can match to the identifier, before acting on it, so that nobody can delete a balance that is not theirs.

Deletion. A deletion request removes the account record, its devices and push tokens, its transmission records and its ledger within 30 days, apart from the purchase records accounting law obliges us to keep, which are kept without the identifier. Deleting the ledger deletes any unused pages, and they cannot be restored afterwards; the request must say that you accept this. Deleting the app from your devices without a request deletes everything on the device but leaves the ledger, so that the balance is still there if you reinstall.

Automated decisions. The only automated decisions Faxvio makes are whether a destination is on the allow-list, whether a request exceeds a rate limit, and whether a device qualifies for the first page. None has a legal or similarly significant effect, and any of them can be reviewed by a person if you write to us.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to complain to your data protection authority. If you are a consumer elsewhere, the mandatory protections of your own country apply in addition to anything written here.

Notes for particular places

California and other US states. In the terms of the California Consumer Privacy Act, we collect identifiers (the account identifier, device hash and IP address), commercial information (purchases), internet activity on the website (analytics) and, transiently, user content (documents), for the business purposes in the table, from you and from the processors named. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we have not done either in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose other than sending your fax. You have the rights to know, to delete, to correct and to non-discrimination described above; a Global Privacy Control signal from your browser is treated as an opt-out on the website; an authorised agent may make a request with the account identifier and your written permission. The same applies under the comparable laws of other US states.

European Economic Area, United Kingdom, Switzerland. The legal bases are in the table. Where we rely on legitimate interests — abuse prevention and security — we have weighed them against your interests and limited the data to a hash, an attestation and a 30-day log. You may object at any time.

South Korea. The app is offered in Korean and sends faxes to Korea. The personal information above is processed for the purposes and periods in the table, is entrusted to the processors named for the stated work, and is transferred abroad to the countries stated; the person in charge of personal information protection is reachable at [email protected], and you may refuse the optional processing (notifications, website analytics) without losing the ability to send a fax.

Germany and Austria. Fax remains an ordinary channel for authorities and offices in both countries, and the app is offered in German; the transit disclosure above is the one shown in the app in German, and the German-language text of this policy, when published, is a translation of this English original, which prevails.

Is Faxvio for children?

No. The app is rated 4+ on the App Store because it contains nothing objectionable, but it is a tool for sending official documents and is not directed at children. We do not knowingly collect data from anyone under 13, or under 16 where local law sets that age for consent; if you believe a child has used the app to send a fax, email us with the account identifier and we will delete the records.

How will I know if this policy changes?

The effective date at the top of this page changes, and the version number with it. A change that reduces your protection, adds a category of data, a purpose or a recipient would be announced in the app before it took effect, and where the law requires it we would ask for your consent again. Older versions are available on request. Version 1.1 added the data inventory table, the cookie table and the analytics switch; version 1.2 (14 September 2026) added the Apple Search Ads measurement data — the vendor identifier, the request IP and the AdServices token handed to RevenueCat — and corrected two sentences about notifications.

Bottom line

Faxvio identifies you by a random identifier your device made; receives your document only when you press send; hands it to the fax carrier over an encrypted connection; deletes it from its server once the carrier has accepted it and at the latest within 24 hours; keeps the fact of the fax for 90 days and the purchase ledger for as long as your balance exists; never reads document content and applies no AI to it; runs no analytics and no tracking in the app, and measures only its own App Store advertising; and shares data only with the six processors named, for the purposes named. The website uses Microsoft Clarity, which you can switch off here. The controller is Vast Flow, LLP; requests go to [email protected] with the account identifier from Settings → About.