Privacy, explained.

Who we are and what this covers

Velorn is operated by Jaime Aguirre. You can contact us at hello@velorn.ai.

This notice covers Velorn’s mobile companion, the account and connection services it uses, and these related website pages. The companion lets you work with Velorn on your own computer. A Velorn account is not required for the desktop editor’s local editing features.

Services you choose separately—such as an AI provider, cloud generation service, or community website—also have their own privacy terms. This notice does not replace those terms.

Account and connection information

Sign-in is handled by Auth0. Depending on the sign-in method you choose, Auth0 processes your email address, profile information, authentication credentials, and sign-in records. Google or Apple sign-in, when used, is handled by that provider and Auth0. Velorn’s app and connection server do not receive your Google or Apple password. Authentication records can include an IP address, approximate IP-derived location, browser/device information and sign-in events; Google profiles may include a profile-picture URL.

Our connection service keeps an account identifier derived from your sign-in identity, your display name, session timestamps, and hashed session credentials. It also keeps the names and identifiers of computers and devices you register, their account association, and hashed connection credentials. This information lets us identify your computers, enforce access, and reconnect approved devices.

We use this information to provide the service, authenticate you, protect your connections, and respond to support requests. A hashed identifier is still account-related information; it is not treated as anonymous.

Your projects, conversations, and AI services

Your desktop computer holds your project files, media, and conversation history. The companion receives the information needed to display and control the project you open. The phone-to-desktop connection relay passes encrypted traffic between approved devices without storing readable chat messages or project media. That connection service is different from the optional funded AI service described below.

When you ask an agent to work, your desktop may send your message, relevant project context, selected media, and tool results to the AI or generation services configured there. Their processing and retention depend on the service and your account settings. A local model and a cloud provider do not handle data in the same way. Do not assume that using Velorn means every request stays on your device.

We do not operate an advertising system in the companion or sell its account information. The companion does not include an advertising-tracking SDK. External service providers’ practices are governed by their own terms.

Optional Velorn-funded Luna

The limited pilot offers GPT-6 Luna to approved Velorn accounts without a personal Codex login. When you choose this provider and send a request, your desktop sends your message, relevant conversation history, project context and enabled tool results to Velorn’s funded AI service, then to OpenAI. This can include names of files and projects, captions, transcript text, attached images, sampled project or video frames, and content returned by the tools you enable.

Transport is encrypted, but Velorn’s funded AI service can read this text and image content while processing and forwarding it. It is not an end-to-end encrypted connection that hides the AI request from Velorn or OpenAI. The provider supports text and images, including selected frames from project media, and the Velorn tools enabled on your desktop. Research tools may send queries to search services or fetch pages from external websites; those services receive the request and normal connection information. Full access, when explicitly enabled on the desktop, expands the available Velorn tools; it is not an unrestricted shell or access to unrelated external accounts. Raw audio and complete video files are not sent as direct model inputs by this adapter. Separate tools or generation services have their own permission, data-handling and spending steps.

Updated companion builds ask Share with Velorn and OpenAI? before sending. Cancel keeps the draft and sends nothing. Permission is limited to the displayed provider and connection; reconnecting or changing the sharing scope can require permission again. You can stop sending, disconnect or sign out, or choose another provider explicitly. A change does not withdraw information already sent. Velorn does not silently fall back to a personal Codex account or another provider.

What the services keep

The funded service processes request and response content in memory and does not write their contents to its allowance journal. Conversation history remains on your desktop. The journal holds keyed account and request identifiers, a keyed request fingerprint, timestamps, request status and reserved or settled usage amounts to enforce allowances and prevent duplicate spending. Those keyed identifiers are pseudonymous, not anonymous. Ordinary account and operational records are described elsewhere in this notice.

Velorn requests store:false from OpenAI so responses are not saved as retrievable application history. This is not Zero Data Retention. OpenAI may retain encrypted prompt-cache state for up to 24 hours, and image inputs have separate safety-review retention exceptions. OpenAI’s default abuse-monitoring retention can include prompts and responses for up to 30 days, with longer retention for legal or safety needs. OpenAI states that API content is not used to train its models unless the customer opts in; the pilot’s optional data-sharing settings are disabled. See OpenAI’s API data controls.

Allowance records and the limited record retained after account deletion are explained under funded-pilot retention. Pilot access and its allowance do not automatically renew, refill or pay for video generation.

Information on your phone or tablet

The iOS companion keeps sign-in and pairing credentials in the device Keychain. It stores display preferences, draft messages, and reading position locally. Signing out stops account access but is not the same as deleting the account or clearing every remembered setting.

Previewing or sharing media can create protected temporary files on the device. Exported copies you save to Files, Photos, or another app remain where you saved them. Velorn cannot remove copies from another app on your behalf.

Development builds may keep bounded, local diagnostic records for troubleshooting. The inspected companion implementation has no automatic diagnostic uploader. Please remove private content before choosing to send diagnostics or screenshots to support.

Website visits, service providers, and support

DreamHost provides our website and connection-server hosting and our support email service. Loading our website involves the host receiving normal connection information, such as an IP address and requested page. The main homepage loads fonts from Google Fonts and checks GitHub for the latest desktop release; those services receive the connection information needed to serve those requests. The privacy and support pages themselves do not load third-party fonts, analytics scripts, or a contact-form service.

Auth0, an Okta service, handles authentication; Google or Apple also processes sign-in information if you choose its sign-in option. See the Okta privacy information and DreamHost privacy information for their respective practices. The AI or generation services you select on your desktop process the requests described above under their own terms.

If you email us, we receive your email address and whatever you include. We use correspondence to answer your request and handle related follow-up; deleting the app account does not automatically identify and erase an email conversation. You can contact us about removing it. Please do not send passwords, API keys, recovery codes, or private project files unless we have agreed on an appropriate way to handle them. Public posts on GitHub or Discord are visible according to those services’ settings.

Information may be processed in countries other than your own. We may disclose information when legally required, to address security or abuse, or with your direction.

Retention and account deletion

Account and registered-device records remain available while needed to provide your account and connections. Session authorization expires, but expiry is not a promise that every stored record or backup is erased at that exact time. Files on your desktop and copies you export are under your control.

In iOS preview builds with account deletion, open Help & account → Delete account, sign in again to verify the same account, and explicitly confirm permanent deletion. You can choose Keep my account before that final confirmation. The flow removes your Velorn sign-in profile, server account sessions and saved connections, and then cleans up account-specific data on the device completing deletion. It reports Account deleted only after both server deletion and that device’s cleanup succeed.

An interrupted request can remain pending or need another status check. Keep the app installed and use its recovery screen; you do not need to submit deletion again. Other devices lose account access, but copies on offline devices cannot be remotely erased. A limited recovery record lets an interrupted app finish cleanup; completed deletion-recovery records no longer contain the account identifier or sign-in identity. The funded-pilot allowance journal is separate, as are log and backup expiry.

Velorn connection-service records

Operational service logs for our connection server have automatic expiry configured to retain them for up to 30 days. Private account-data rollback snapshots in the currently reviewed set have automatic expiry within eight days. Snapshot expiry is limited to that reviewed set; it does not automatically cover new snapshots or every file on the server. New account-data backup copies require a separate retention review. These limits do not apply to your desktop projects, files you export, or the provider-managed copies described below.

Funded-pilot allowance and eligibility records

While the pilot is active, its journal retains the usage and replay-protection records described above. Account deletion removes that account’s detailed request records and recorded per-account usage; it retains a keyed “not eligible” marker to prevent the same grant from being restored, and an overall pilot spend total. The marker is still pseudonymous account-related data. Account deletion does not automatically remove content from OpenAI’s separate retention systems.

Separate server eligibility settings hold the approved account identifier, allowance and access-expiry time. Deleting the account blocks that grant but does not automatically erase this eligibility record or its configuration and preparation copies. These records remain account-related information, not anonymous totals. They require separate removal as part of permanent pilot retirement; backup copies also need explicit retention review.

Pilot access lasts up to 30 days and ends no later than November 14, 2026 at 4:00 PM Pacific (November 15 at 00:00 UTC), before the dedicated key’s November 16, 2026 expiration, without automatic renewal. Within 30 days after the pilot is permanently closed, we remove its keyed account/request records and account-linked eligibility settings and preparation copies under our control, retaining only the overall spend total and non-account lifecycle/completion markers that prevent the closed pilot from reopening. Our operator-managed retirement procedure includes a review of copies under our control, including backup treatment. Access expiry stops new funded requests; an operator completes permanent closure and record cleanup. The current journal has no automatic age-based cleanup, and deleting or restoring it must never reset a live allowance. This procedure does not erase copies held by providers or other recipients under their separate retention policies.

Authentication-provider records

Auth0’s authentication-log retention depends on the plan. Its published periods range from one day on Free to 30 days on Enterprise; trial features may temporarily provide a longer period than the underlying plan. Deleting your Velorn account removes its active Auth0 profile and metadata. Auth0 states that deleted data remains in encrypted offline backups for 14 months. Those provider backups are separate from Velorn’s own account rollback snapshots. See Auth0’s log-retention plans and its deleted-user data guidance.

Website and email hosting

DreamHost documents a default seven-day period for website HTTP access and error logs. Its website-file and email backups have separate retention processes; we have not verified a fixed maximum deletion period for those provider-managed copies. They are not covered by Velorn’s own connection-server retention limits. See DreamHost’s website-log guidance and privacy policy.

Support conversations

We retain resolved support email conversations for up to 90 days after resolution. This policy covers support-mail copies under our control, including received, sent, archived, and deleted-item copies. We manage removal through a separate support-mail review, not an automatic consequence of deleting a Velorn account. It does not set the retention period for DreamHost’s backup copies, messages in your own mailbox, or copies held by other recipients. Contact hello@velorn.ai if you want us to review earlier removal of your support messages.

See the deletion steps, recovery behavior, and what is not erased. Signing out or removing the app does not delete your account. Deleting the Velorn account does not delete a Google or AI-provider account.

Your choices

You can sign out, manage approved computer connections, choose which projects and media to use, and choose the AI services configured on your desktop. You can contact us about access to, correction of, or deletion of personal information. We may need to verify that a request comes from the account holder.

Privacy rights depend on where you live. Where applicable, you may also have rights to object to processing, request restriction or portability, withdraw consent, or complain to a data-protection authority. This notice does not limit rights provided by law.

We will update the published notice when our practices change and identify its effective date. Material changes will be communicated as appropriate.

Questions about privacy?

Contact Jaime Aguirre, operator of Velorn, at hello@velorn.ai. Tell us what you need without including your password or sign-in codes.