Privacy policy
RefVault desktop application | Last updated 16 October 2026
This Privacy Policy explains how Reflow processes information when you search for visual references, manage a local image collection, or connect Pinterest. It describes the desktop application version 0.4.0-dev.
1 Developer and scope
Developer: Daniil Sergeevich Sivukhin
Country and contact location: Moscow, Russia
Privacy contact: [email protected]
Application website: Reflow website
Reflow, also known as RefVault, is an independent desktop application for finding, viewing and organizing visual references and working with images in PureRef and Pinterest. It does not represent Pinterest or PureRef. External services are governed by their own privacy policies.
2 Information processed and purposes
Depending on the features you use, the application processes the following information:
Search queries, selected sources and interface settings, to perform searches and remember your preferences.
Selected images, captures of a selected screen area, file paths, thumbnails, project names and source links, to display and organize your collection.
A local search index and numerical image representations, to search for visually similar images on your computer.
Pinterest account information, including account ID, username, display name, avatar and information about accessible boards and Pins, including secret boards where permission is granted, to provide the connected account features.
Pinterest access tokens and developer application credentials you enter, to authorize API requests. The experimental Pinterest sign-in window also stores Pinterest session cookies.
Records of successful publications, to help prevent duplicate uploads, and local technical logs that may include file paths and error messages, to diagnose problems.
The application does not request your Pinterest password in its own form. When you sign in on a Pinterest page, Pinterest processes your password.
The reviewed version has no developer-operated server collecting user data, advertising SDKs or automatic analytics reporting to the developer. The application does not sell user information or use it for advertising profiling.
3 Information sent to external services
When you use online features, requests are sent directly to the relevant external services:
Yandex, Bing and Google receive search queries. When you search by image, the selected image is sent to the search provider used for that operation. In certain modes, query text is sent to Google for translation.
Pinterest receives authorization information and action parameters when you view boards and Pins, create boards or publish images. Publishing sends the selected images and accompanying information. Board settings and Pinterest rules determine who can see the published content.
ArtStation, Behance and other source websites may be searched through a search engine using a domain restriction. Loading previews or original images and opening source pages creates requests to those websites and their content delivery networks.
Model file providers receive download requests if the application needs to obtain a model for local search. Image processing with that model takes place on your computer.
Recipients of network requests also receive your IP address and technical connection information. External services may process information in other countries under their own policies and retention periods. The developer does not control their infrastructure.
The relevant third-party privacy policies are available at:
Pinterest: https://policy.pinterest.com/privacy-policy
Yandex: https://yandex.ru/legal/confidential/
Microsoft and Bing: https://privacy.microsoft.com/privacystatement
Google: https://policies.google.com/privacy
Adobe and Behance: https://www.adobe.com/privacy/policy.html
ArtStation: https://www.artstation.com/privacy
4 Managing your Pinterest connection
Connecting Pinterest is optional. API access is limited by the permissions granted by you and Pinterest. The application may request permission to read your profile and to read and create boards and Pins, including secret content where available to your account.
Boards are created and images are published in response to your actions. You can disconnect the API in the application. To revoke access on Pinterest itself, also remove the application authorization in your Pinterest settings.
Signing out of the experimental session removes its local authorization information. It does not end other Pinterest sessions in your browsers or on other devices.
5 Storage retention and protection
Application data is stored on your computer. The default folder for a source-code installation is %APPDATA%\RefVault. For a portable build, it is the RefVault Data folder beside the executable. The REFVAULT_DATA_DIR setting can change this location.
New files containing tokens and cookies are protected using Windows DPAPI, tied to the current Windows user account. Authorization files from older versions may remain unprotected until saved again. Images, settings, logs and the search index are not additionally encrypted by the application.
The collection, cache, settings and publication records remain until you delete them. The current version has no automatic retention period for these items. Token expiration does not necessarily delete the file containing the token. You control access to your computer, Windows account and backups.
6 Deletion and privacy requests
You can disconnect Pinterest, revoke authorization on Pinterest and delete local application data. To delete all local application data, close the application and remove its data folder. This also deletes the collection stored in that folder, so copy any files you want to keep beforehand.
Exported images, files in PureRef, backups and content published to Pinterest must be deleted separately in their respective locations. Removing the application or its cache does not remove Pinterest publications.
If you voluntarily email the developer with a support request or diagnostic files, the developer uses the information provided to respond and resolve the reported issue. Do not include passwords, tokens or cookies. Support materials are deleted after the request is resolved unless further retention is required by law or to resolve a dispute.
For requests concerning access, correction, deletion, restriction of processing or withdrawal of consent, where applicable, contact [email protected]. The developer can act on information in the developer’s possession but has no access to files on your computer. Applicable rights and legal grounds for processing depend on the laws relevant to you and the developer.
7 Children and changes to this policy
The application is not intended for children under 13. External services may impose additional age restrictions, and applicable legal requirements also apply.
This policy will be updated when application features or data handling practices change. The revision date appears at the beginning of the document. The current version is available on this page. You can also request a copy by emailing [email protected].
8 This website
This website includes a Reflow account area. Sign-in uses your email address and password, with email verification. Passwords are stored as hashes, not plaintext. Session records are used to keep you signed in. We store the site-specific user ID, email address, first sign-in time, trial expiration time and selected plan in the Reflow server database to provide account and trial management. Email delivery is provided by the configured mail service for verification and password recovery. These account records remain until you request deletion at [email protected]; trial eligibility records may be retained only as needed to prevent repeated trials. Checkout opens on Lava, which processes the information you enter there under its own terms and privacy policy. Reflow does not collect card details. When payment integration is enabled, Reflow sends your account email to Lava to create checkout, and stores invoice identifiers, payment confirmations and access expiry dates to manage PRO access. Contact [email protected] for access, correction or deletion of your website account data. This website does not include advertising analytics, tracking pixels or a contact form. Contact links open your email application. The hosting provider processes technical requests and may use access controls or cookies required to operate its hosting service. This website does not request Pinterest credentials.