Privacy

velt stores what it needs to run your page and nothing it does not. The one thing worth stating plainly, because this corner of the internet has earned the suspicion: we do not show anyone a visitor’s network address. Not the person whose page was visited, not in a dashboard, not through the API. Addresses are put through a keyed hash before they are written down, and the result cannot be turned back into an address.

The controller for this service is operator name and postal address, reachable at hello@velt.lol.

• Your email address, display name, and password in hashed form, so you can sign in.
• Your handle and the content of your page, because that is the service.
• Files you upload, until you delete them.
• Which invite code you used and who issued it. This is how abuse is traced back, and it is kept for as long as the account exists.
• If you sign in with Discord: your Discord account identifier, and the accounts you chose to connect there, so your links can be filled in for you.
• If you answer "how did you find velt?" when you pick your handle, your answer. It is optional, and only ever counted, to learn which kinds of promotion work.
• If you joined through a member’s link or the chip on their page, who that member was. They see how many people joined through them, never who.
• Whether you agreed to have your page featured on the front page and in our short videos, and when. It is no until you say yes on your account page.
• Which clans you are in. While you are in one, your page is listed on its page; leave and it is gone from there at once.
• Fonts you upload for your page, the places you name in tracked links, and which of those links brought each visit. The visits themselves are counted, never named.
• If you add a Roblox, Steam or Last.fm card: the name you gave it, and what that service shows publicly under that name (your profile picture, status, or latest track), fetched by our server and kept for a short time. Visitors to your page never contact those services.

When somebody opens a page we record that a visit happened, roughly where in the world it came from at country level, what kind of device it was, and which site referred it. To avoid counting the same person repeatedly we need to recognise a repeat visit, and we do that without keeping the address:

• The address is shortened to its network prefix, so an individual device is not identified.
• That prefix is combined with the current date and a secret key and hashed.
• Only the hash is stored, and the raw address is never written to disk.
• Rotating the key breaks the link between old and new records, deliberately.
• Detailed visit records are deleted after 35 days. Only daily totals are kept after that.

The result is that we can tell you a thousand people visited and roughly where from, and we cannot tell you, or ourselves, who any of them were.

Showing what you are playing or listening to is switched off until you turn it on. It is personal information published on a page anyone can open, so it is your decision to make rather than a default. Turning it on requires joining our Discord server, because that is the only way our bot can see your status at all. Switch it off and the display stops immediately.

If you choose to show your Discord avatar or avatar decoration, we keep a copy of each on our own storage and check Discord for changes every few hours, so your visitors never load anything from Discord. If you made your account with Discord, the avatar starts switched on, because your page already showed it. Switch either off, or disconnect Discord, and the copy is deleted.

If you react to a page or follow somebody, we store that you did, so the numbers are right and you can take it back with the same button. Only the numbers are ever shown: nobody, including the page’s owner, can see who reacted or who follows them. Closing your account removes your reactions and follows.

Pages with their owner’s own work on them appear on the leaderboard and on explore, counted from the same confirmed views as your page’s own number. Switch that off in your account and your page leaves both within a few minutes.

• Running your account and your page: performance of the contract between us.
• Keeping the service safe, tracing abuse, and rate limiting: our legitimate interest in a service that is not used to harm people.
• Live status display, featuring your page, and optional emails: your consent, withdrawable at any time.
• Keeping records of reports and takedowns: a legal obligation.

The service runs on infrastructure operated by other companies, and they process data on our instructions, each only for its own job. We do not sell anything to anyone.

• Hetzner Online GmbH, Germany: the server the service and your files run on.
• Cloudflare, Inc.: the domain’s name servers, and forwarding mail sent to our addresses.
• Resend, Inc.: sending the service’s email, such as sign-in links and notices.
• Google LLC: storing the nightly backups on Google Drive. They are encrypted on our server before they leave it, and Google cannot read them.

• Account data: until you delete your account.
• Uploads: until you delete them, or 30 days after the account is deleted.
• Detailed visit records: 35 days. Daily totals: as long as the page exists.
• Sign-up networks: when an account is made, a keyed digest of the network it came from (never the address, and not linked to the account) is kept for 30 days, so one person cannot open many accounts.
• Reports, takedown notices, and the records attached to them: kept as long as the law requires, which for some categories of report is at least a year, even if the account is deleted.

A copy of everything held about your account is a download, on your account page, immediately and without asking anybody. It contains no passwords, no API keys and no webhook secrets, and nothing about the people who visited your pages.

You can also ask what we hold about you, ask for corrections, ask for deletion, object to processing based on legitimate interest, and withdraw any consent you gave. Write to hello@velt.lol and we will answer within a month. You can also complain to a data protection authority; in Germany that is the one for the state where the operator is based.

There are no advertising or analytics cookies. The cookies this service sets are the ones it cannot work without: your session, a short-lived token proving you hold a valid invite while you finish signing up, and a preference recording that you have already entered a page so it does not ask twice.

General questions: hello@velt.lol. Abuse and urgent safety reports: abuse@velt.lol.