VeloWrite Privacy Policy
How VeloWrite handles local Markdown files, account identity, Google sign-in, payments, analytics, retention, and deletion.
What VeloWrite collects
VeloWrite may collect a verified email address, Google account subject identifier, display name, session records, Paddle customer or transaction references, license plan and validity, activated-device identifiers, feedback or waitlist details that you submit, and basic operational analytics such as page path, status, referrer, user agent, and timestamp.
How account data is used
Google Sign-In requests only openid, email, and profile. This data is used only to authenticate a VeloWrite account, keep a session active, provide account support, and show the Paddle billing portal. VeloWrite does not request Gmail, Google Drive, Google Calendar, YouTube, contacts, photos, files, or other private Google content.
Google API policy and prohibited use
VeloWrite follows the Google API Services User Data Policy, including Limited Use requirements. Google user data is not sold, used for advertising profiles, or used for generalized AI or machine-learning training. VeloWrite does not use Google APIs to create, request, store, or distribute AI-generated non-consensual intimate imagery (AI NCII), sexual deepfakes, or similar abusive content.
Markdown files
Normal browser editing, preview, download, desktop editing, local history, and export do not upload Markdown document text to VeloWrite servers. Browser drafts remain in localStorage and desktop files remain on the user's computer. Signing in does not upload Markdown document text or change this local-file boundary.
Sharing and subprocessors
Google provides optional identity verification, Resend can deliver one-time email verification codes, Paddle processes checkout and billing, Loops.so processes feedback and waitlist contacts, and VeloWrite infrastructure and PostgreSQL store service records. Each provider receives only the information needed for its stated role.
Retention and deletion
Short-lived OAuth states and email verification codes expire within minutes. Account sessions are stored server-side as hashes. Users can sign out or delete the account at /delete-account. Deletion removes account identities and active sessions; Paddle, tax, fraud-prevention, dispute, backup, and legally required records may be retained.
Contact
For privacy, Google OAuth, payment, or deletion questions, use the VeloWrite feedback form. Do not submit passwords, payment-card numbers, OAuth secrets, or license secrets.