Privacy Policy

Veylo is built on the principle of minimal data collection. We collect only what is technically required to operate the realtime communication service:

• Temporary Session ID: A random anonymous identifier assigned to your browser session. This is never tied to your identity and expires when you close the tab.
• Anonymous Username: A randomly generated username (e.g. "ShadowFox247") assigned per session. You cannot set a permanent username.
• IP Address: Your IP address is processed transiently by our servers for rate limiting and abuse prevention only. It is never logged to disk or stored in any database.
• Room ID: The identifier of rooms you join — held in memory only for the duration of your connection.

The following data is never collected, stored, or logged by Veylo under any circumstances:

• The content of any messages (text, voice, or media)
• Your name, email address, phone number, or any personal identifier
• Your location beyond country-level (and even that is not stored)
• Images, videos, audio, or documents shared in chats
• Browsing history or cross-site tracking data
• Advertising identifiers or behavioral profiles
• Device fingerprints or persistent cookies

Veylo uses a ephemeral memory-only message architecture:

• Messages exist in browser memory only and are transmitted directly between peers.
• Our signaling server acts as a relay for connection establishment only — it never reads message content.
• When a session ends (tab closed, disconnect, skip), all associated data is immediately discarded.
• There is no message history, no archive, and no way for Veylo staff to read your conversations.

For voice, video, and media sharing, Veylo uses WebRTC (Web Real-Time Communication) — a browser technology for direct peer-to-peer connections:

• Once a WebRTC connection is established, data flows directly between browsers — our servers are not in the path.
• WebRTC connections are end-to-end encrypted by the browser using DTLS and SRTP protocols.
• STUN/TURN servers may be used during connection negotiation — these see connection metadata only, never content.
• Voice notes and media files sent via WebRTC are never stored server-side.

Veylo uses no tracking cookies. The only data stored locally is:

• Session Storage: Your temporary username, user ID, and preferences. This is stored in your browser's sessionStorage — it is cleared automatically when you close the tab.
• No persistent cookies are set by Veylo.
• We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts.

Media shared on Veylo (images, videos, audio, documents) is handled as follows:

• All media is transferred as temporary Blob URLs in browser memory — never uploaded to a permanent server.
• Files exist only in the recipient's browser RAM for the duration of the session.
• When the session ends, Blob URLs are revoked and the data is garbage collected.
• The "blur before view" feature is a client-side privacy guard — blurred images are never sent unblurred to our servers.

Veylo applies multiple layers of protection:

• Transport Layer: All HTTP traffic uses TLS 1.3 encryption.
• WebRTC: Peer connections use DTLS-SRTP (mandatory WebRTC encryption).
• Signaling: Signaling payloads are transmitted over HTTPS and are not stored.

Veylo does not share any user data with third parties. The only external resources loaded are:

• Google Fonts — for typography (this is a standard font CDN; Google may log font requests per their own privacy policy).
• No analytics services, no ad networks, no social media trackers.

Because we store no personal data, most traditional data subject rights are automatically satisfied:

• Right to Access: There is no data to access — we hold none.
• Right to Erasure: Data is already deleted on disconnect.
• Right to Portability: No data to export.

If you believe we have accidentally retained any data, contact us and we will investigate promptly.

For privacy-related concerns: Contact us here.

We aim to respond to all privacy inquiries within 48 hours.