Privacy Policy

Last updated: 2 July 2026 · VELUM, published by MAC4

Information we do NOT collect

• No email address
• No phone number
• No real name (you choose a display name — it can be anything)
• No contacts upload from your phone
• No profile photos
• No advertising identifiers
• No analytics or usage tracking
• No location data

Information the app does process

Anonymous account ID. When you first open VELUM, an anonymous account is created via Firebase Anonymous Authentication — a random identifier not linked to any personal information.

Your VELUM ID and display name. A random 8-character ID and the display name you choose, so other users can start a chat with you.

Public encryption key. Your device generates a key pair; only the public key is stored on the server. Your private key never leaves your device.

Encrypted messages. Messages are end-to-end encrypted on your device (ECDH P-256 + AES-256-GCM) before being relayed, and are automatically and permanently deleted after 24 hours. We cannot decrypt them.

Encrypted media. Photos, videos and files you send are relayed via Firebase Storage for delivery and are subject to the same deletion policy.

Calls (voice and video)

Voice and video calls use WebRTC peer-to-peer connections. The audio and video stream directly between the two devices and are never recorded, stored, or routed through our servers. We only relay the small connection-setup messages needed to establish the call, which are deleted after the call ends.

Camera, microphone, and storage permissions

• Camera — used only during video calls and to scan a QR code. Never used in the background.
• Microphone — used only during voice/video calls.
• Photos/Media — used only when you choose to attach a file to a message.

Permissions are requested at the moment the feature is used, and the app functions without them (you simply can't use that specific feature).

Data storage and security

• Messages and media are stored encrypted and auto-deleted within 24 hours.
• Your private key and PIN are stored only on your device in encrypted storage.
• Screenshots and screen recording are blocked inside the app.
• We use Google Firebase as our backend infrastructure provider, governed by Google's privacy policy.

Children

VELUM is not directed at children under 13 (or the minimum age in your country).

Your choices

You can stop using the app and clear its data at any time from your device settings. Because we hold no personal information tied to you, there is no personal profile to request or delete beyond your anonymous account.

Contact

For privacy questions, contact tontonvalencci@gmail.com.