Skip to content

Privacy policy

Version 1.2 · in force from 6 November 2026

This policy describes the personal data Velravio handles. We collect little, so it is short.

1. Who is responsible

The controller is the Velravio project. The operating entity is being registered in the European Union; until it is on the public register we do not publish a registration number. Reach us through the contact form.

2. What we store

  • Account data: your email, your name and a hashed password.
  • Your files and folders: the content you upload, their names, sizes, SHA-256 hashes and timestamps.
  • Activity: a per-account journal of actions (sign-in, upload, share, delete).
  • Sessions and tokens: session records and the hashes of API tokens.
  • Messages: if you use the contact form or the waitlist, the details you enter.

We do not run analytics or advertising trackers and do not build profiles. The application does not receive your IP address, because traffic reaches it over a local connection from the gateway in front of it.

3. Why we store it

  • To provide the service (performance of a contract): your account, files and share links.
  • To keep the service secure and prevent abuse (legitimate interest): rate limits, the activity journal.
  • To answer you (legitimate interest or consent): contact and waitlist messages.

4. Where it is stored

In the zone you chose at sign-up. A Frankfurt account and its files are stored in the Frankfurt zone; a Warsaw account in the Warsaw zone. Zones do not copy data to each other.

5. How long we keep it

  • Account data and files: until you delete them or close the account.
  • Trash: deleted files are kept for 7 days, then removed.
  • Share links: until they expire, then removed by a background job.
  • Contact and waitlist messages: while we handle them and for a reasonable period after.

6. Who else sees it

The people who run Velravio, and the hosting provider for the zone, which stores the data on our behalf. We do not sell personal data and do not share it for advertising. A file you share through a link is available to anyone who has the link (and the access code, if set) until it expires.

7. Your rights

Under the GDPR you can ask for access, correction, deletion, restriction, portability and to object. You can do much of this yourself: edit your name, change your password, export your files and delete the account from the console. For anything else, write through the contact form. You can also complain to a supervisory authority in your country.

8. Contact

Questions about this policy go through the contact form. If we change the policy, the version line above changes and material changes are posted with a date.