Privacy

velt stores what it needs to run your page and nothing it does not. The one thing worth stating plainly, because this corner of the internet has earned the suspicion: we do not show anyone a visitor’s network address. Not the person whose page was visited, not in a dashboard, not through the API. Addresses are put through a keyed hash before they are written down, and the result cannot be turned back into an address.

The controller for this service is operator name and postal address, reachable at contact address.

• Your email address, display name, and password in hashed form, so you can sign in.
• Your handle and the content of your page, because that is the service.
• Files you upload, until you delete them.
• Which invite code you used and who issued it. This is how abuse is traced back, and it is kept for as long as the account exists.
• If you sign in with Discord: your Discord account identifier, and the accounts you chose to connect there, so your links can be filled in for you.

When somebody opens a page we record that a visit happened, roughly where in the world it came from at country level, what kind of device it was, and which site referred it. To avoid counting the same person repeatedly we need to recognise a repeat visit, and we do that without keeping the address:

• The address is shortened to its network prefix, so an individual device is not identified.
• That prefix is combined with the current date and a secret key and hashed.
• Only the hash is stored, and the raw address is never written to disk.
• Rotating the key breaks the link between old and new records, deliberately.
• Detailed visit records are deleted after 30 days. Only daily totals are kept after that.

The result is that we can tell you a thousand people visited and roughly where from, and we cannot tell you, or ourselves, who any of them were.

Showing what you are playing or listening to is switched off until you turn it on. It is personal information published on a page anyone can open, so it is your decision to make rather than a default. Turning it on requires joining our Discord server, because that is the only way our bot can see your status at all. Switch it off and the display stops immediately.

• Running your account and your page: performance of the contract between us.
• Keeping the service safe, tracing abuse, and rate limiting: our legitimate interest in a service that is not used to harm people.
• Live status display and optional emails: your consent, withdrawable at any time.
• Keeping records of reports and takedowns: a legal obligation.

The service runs on infrastructure operated by other companies, and they process data on our instructions under a contract: a hosting provider, a storage and content delivery provider, an email sender, and a payment provider for anyone who pays to join. Their names are listed at keep a current sub-processor list here. We do not sell anything to anyone.

• Account data: until you delete your account.
• Uploads: until you delete them, or 30 days after the account is deleted.
• Detailed visit records: 30 days. Daily totals: as long as the page exists.
• Reports, takedown notices, and the records attached to them: kept as long as the law requires, which for some categories of report is at least a year, even if the account is deleted.

A copy of everything held about your account is a download, on your account page, immediately and without asking anybody. It contains no passwords, no API keys and no webhook secrets, and nothing about the people who visited your pages.

You can also ask what we hold about you, ask for corrections, ask for deletion, object to processing based on legitimate interest, and withdraw any consent you gave. Write to contact address and we will answer within a month. You can also complain to a data protection authority; in Germany that is the one for the state where the operator is based.

There are no advertising or analytics cookies. The cookies this service sets are the ones it cannot work without: your session, a short-lived token proving you hold a valid invite while you finish signing up, and a preference recording that you have already entered a page so it does not ask twice.

General questions: contact address. Abuse and urgent safety reports: abuse@velt.lol.