Privacy Policy

VeloSend is operated by HRS Tech. References to "we", "us", or "our" in this policy refer to HRS Tech as the data controller for the VeloSend service accessible at velosend.net.

Contact us with privacy-related requests at: privacy@velosend.net

This Privacy Policy applies to everyone who uses VeloSend, whether or not you create an account. Free-tier users who transfer files without signing in are still required to comply with this Privacy Policy and our Terms of Service.

By using VeloSend anonymously — for example, to send or receive a file without logging in — you automatically accept this Privacy Policy and the Terms of Service, in the same way a registered account holder does by checking the acceptance box at sign-up. If you do not agree to this Privacy Policy, do not use VeloSend, even without an account.

VeloSend uses WebRTC to establish direct, encrypted, browser-to-browser connections. When you send a file:

• File data is encrypted inside your browser using DTLS (WebRTC's mandatory encryption layer).
• The encrypted stream travels directly from your device to the recipient's device.
• Our signaling server's only role is to help the two browsers find each other. It never sees your file data.
• Once the WebRTC connection is established, our servers are not in the path of the transfer.

Relay is temporarily unavailable while we upgrade its access controls. If a direct WebRTC connection cannot be established, the transfer stops with an error; VeloSend does not automatically upload the files to a Locker.

File Locker (Team plan) works differently and is opt-in: files you upload to a Locker are stored, password-protected, in Cloudflare R2 object storage until you delete the locker or your chosen retention period (1–15 days, adjustable after creation) expires. Access to a locker's files requires only its code and a password of at least 6 characters — no VeloSend account is needed on the recipient's side, so treat those credentials as you would any shared login. Locker files do not fall under the peer-to-peer description above — see sections 4 and 6 for details.

We aim to collect as little data as possible. Here is a precise breakdown:

Direct WebRTC file contents do not pass through our application server. We store room manifests and, for signed-in accounts, transfer-history metadata such as file names, counts, sizes, connection type and timestamps. Service providers process network addresses to deliver and protect the service. Locker content is stored separately as described below. Public marketing pages may send limited diagnostic events; transfer and Locker routes exclude optional error monitoring.

VeloSend does not use advertising cookies or third-party tracking cookies of any kind.

We use your browser's localStorage and IndexedDB to store:

• Your anonymous session token (used to track TURN quota — no personal information is used to generate this).
• Your UI theme preference (dark / light).
• Transfer resume state (in case your connection drops mid-transfer — cleared automatically on completion).
• Decryption keys for Lockers you unlock on this device, stored so files stay readable after a reload. Keys cannot be exported by page scripts, are removed when you log out, and expire with the Locker or at most 15 days after unlocking.

The local storage items above remain on your device. Separate account metadata, including transfer-history summaries for signed-in users, is stored on our servers and can be removed by deleting your account.

We use a minimal set of third-party services to operate VeloSend:

• Cloudflare (TURN relay):TURN relay is temporarily unavailable while access controls are upgraded. Cloudflare may process network addresses when providing our other services. See Cloudflare's privacy policy for details.
• Cloudflare R2 (File Locker storage, Team plan):Files uploaded to a File Locker are stored in Cloudflare R2 object storage, encrypted at rest by Cloudflare, and gated behind the locker's password. This encryption is managed by Cloudflare, not end-to-end — unlike our peer-to-peer transfers (Section 3), VeloSend and Cloudflare have the technical ability to access File Locker file contents. Files are deleted when you delete the locker or when your chosen retention period expires. See Cloudflare's privacy policy for details.
• Railway (Hosting):Our signaling server is hosted on Railway. Railway may collect server-level logs (e.g., connection timestamps). We do not access per-request logs.
• Creem (Payments & Billing, Pro/Team subscriptions):Creem (operated by Armitage Labs OÜ) acts as the merchant of record for all paid subscriptions and independently collects and processes billing information — including your name, email, payment details, and billing address — to complete your purchase, calculate tax, and provide customer support for billing issues. Creem acts as its own data controller for this information; see Creem's Privacy Policy for details. We never receive or store your card details ourselves — only your subscription status and Creem-assigned customer ID are shared back to us to manage your account access.
• Google Fonts:We load the Inter and JetBrains Mono fonts from Google Fonts. This means your browser makes a request to Google's servers with your IP address. You can block this in your browser if desired.

We do not use Google Analytics, Meta Pixel, or any behavioural advertising network.

WebRTC file data channels use DTLS encryption between browsers. Our signaling server communicates over HTTPS/WSS and controls peer discovery. The delivered browser application and signaling service remain part of the trust model. Account and room data are protected by database access controls.

We follow security best practices and conduct regular reviews of our infrastructure. While no system is perfectly secure, VeloSend is designed so that peer-to-peer transfer files are never stored on our servers, minimizing exposure even in the event of a breach. The one exception is File Locker (Team plan, opt-in): those files are stored, password-protected, in Cloudflare R2 until deleted, protected by Cloudflare's platform-level encryption rather than the end-to-end encryption used for peer-to-peer transfers. Signed-in account metadata, including transfer-history summaries and active sessions, is protected with access controls and database security measures.

VeloSend is not directed at children under 13. We do not knowingly collect any personal information from children under 13. If you believe a child under 13 has provided personal information to us, please contact us at privacy@velosend.net and we will remove it promptly.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate personal data.
• Deletion: Request that we delete your personal data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to specific types of processing.
• Withdrawal of Consent: Withdraw any consent you have previously given.

To exercise any of these rights, contact us at privacy@velosend.net. We will respond within 30 days. For free-tier users with no account, most of your data exists only in your own browser — you can delete it directly by clearing your browser's site data.

Session data (room IDs, ICE candidates) is held in server memory only and deleted immediately when a room expires or is closed. We do not write session data to disk or any persistent storage.

Account data for Pro subscribers is retained until you delete your account. After deletion, we purge all associated personal data within 30 days.

File Locker files are retained for the 1–15 day period you choose when creating the locker, and are permanently deleted — with no possibility of recovery — the moment that period expires or you delete the locker manually, whichever happens first. If your Team plan lapses, existing locker files are not deleted early on that basis alone, but you will lose access to the Locker management dashboard until you resubscribe.

Our infrastructure may be located in various regions. If you access VeloSend from outside the country where our servers are located, your data (including temporary signaling data) may be transferred internationally. By using VeloSend, you consent to such transfers.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated to Pro subscribers via email. Your continued use of VeloSend after changes constitutes your acceptance of the updated policy.

For any privacy-related questions, requests, or concerns: