Privacy Policy

1.1 Account Information

• Email address: For account creation, login verification, and important notifications
• Password: Stored encrypted and hashed — we cannot see your plaintext password
• Registration timestamp: For account management and statistics

1.2 Payment Information

• Order details: Plan type, amount, and order timestamp
• Payment processing: Handled by third-party platforms (Stripe, Alipay, WeChat Pay) — we do not store card numbers or payment credentials

1.3 Usage Data (Minimal Collection)

• Traffic statistics: Total data usage only, used for billing and abuse prevention
• Connection timestamps: Connect/disconnect times only — no content or destination records
• Number of simultaneous devices: Used to enforce device limits

1.4 Device Information

• Device type, OS version, app version: For technical support and device limit enforcement
• Device fingerprint: For abuse prevention only

1.5 What We Do NOT Collect

The limited information we collect is used solely for the following purposes:

• Providing services: Account authentication, service access, and technical support
• Billing management: Processing orders, calculating usage, and sending billing notifications
• Abuse prevention: Detecting abnormal traffic patterns and preventing account sharing or service abuse
• Service improvement: Anonymous statistical analysis to optimize server performance and user experience
• Legal compliance: Responding to legal requirements in limited circumstances (see Section 6)

3.1 Storage

• Account data is stored in secure data centers with multi-layer encryption and strict access controls
• All data transmitted between your device and our servers uses TLS/SSL encryption

3.2 Security Measures

• Data encryption: All sensitive data is encrypted at rest and in transit
• Access controls: Strict employee access restrictions on user data
• Regular audits: Periodic security audits and penetration testing
• Automated backups: Regular backups to prevent data loss

3.3 Data Retention

• Account information: Retained during account activity; deleted or anonymized within 30 days of account deletion
• Order records: Retained 3–5 years per legal financial audit requirements
• Traffic statistics: Reset monthly — no historical records kept
• Session data: Access tokens expire in 2 hours; refresh tokens expire in 30 days

To provide our services, we work with the following third-party providers:

Important: We do not sell, rent, or trade your personal information to any third party.

Our website uses the following categories of cookies:

• Essential Cookies: Maintain login state and core functionality — these cannot be disabled
• Functional Cookies: Remember your preferences such as language and theme settings
• Analytics Cookies: Collect anonymous usage data to help us understand how the site is used

You can manage your cookie preferences via our Cookie Consent settings or through your browser settings. Disabling certain cookies may affect some site functionality.

We may be required to disclose information in the following circumstances:

• In response to a valid court order or subpoena
• To comply with mandatory legal requirements
• To protect the rights, property, or safety of GalePass, our users, or the public

Important: Due to our strict no-log policy, even if we receive a legal request, we cannot provide browsing history, traffic content, or connection logs — because we simply do not collect this information.

Where legally permitted, we will notify affected users of any legal requests we receive.

Our services are intended for users aged 18 and older. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal information, please contact us at [email protected] and we will promptly delete the relevant information.

GalePass is operated by GaleLink Inc., a Canadian company. Canada has been recognized by the European Commission as providing an adequate level of protection for personal data (adequacy decision), meaning transfers of personal data from the EU to Canada benefit from this protection without requiring additional safeguards.

If you are located in other countries, your data may be transferred to and stored in Canada or other countries where our service infrastructure operates. Regardless of where your data is stored, we apply the same protections described in this Privacy Policy.

We may update this Privacy Policy periodically. When we do, we will post the new version on this page and update the "Last Updated" date. For significant changes, we will notify you via email or a site announcement. We recommend reviewing this policy periodically to stay informed about how we protect your information.

If you have any questions, concerns, or complaints about this Privacy Policy, or wish to exercise your privacy rights, please contact us through the following:

We respond to privacy requests within 15 business days (30 days for GDPR requests).