Privacy Policy

Last updated: November 7, 2026

The short version

Your messages, files, server contents and calls are end-to-end encrypted. We can't read them.
We keep what's needed to run your account: your username, public profile, an encrypted backup of your keys, and some technical data.
You don't need an email or phone number to use Vaelor. We only have your email if you joined the waitlist.
No ads, no ad profiles, no selling or sharing your data with advertisers or data brokers, no tracking you around the web.

Who we are
What we can't see
What we collect
What stays on your device
How we use information
When we share information
How long we keep it
Security
Your choices and rights
Children
Where your data is stored
Things we don't do
Changes to this policy
Contact

1. Who we are

Vaelor is a chat app for friends and communities. This policy explains what information the Vaelor apps, website and servers (the "Service") handle, and why. It goes with our Terms of Service. When we say "we" or "us", we mean the people who run Vaelor.

2. What we can't see

Vaelor is built so that the most private things never reach us in readable form. These are encrypted on your device before they're sent, with keys we don't have:

The text of your messages in servers, group chats and direct messages, including edits and reactions.
Images, files and attachments you send.
Server and channel names, topics, roles, server icons and banners you upload, and other server settings.
Voice and video in calls.
Your private keys and your password. Your password never leaves your device; we only receive a value derived from it that we hash again before storing.

Our servers store and pass along this data in encrypted form. Because we can't decrypt it, we can't read it, search it, hand it over in readable form, or recover it if you lose access.

3. What we collect

When you create and use an account

Account details: your username, a unique account ID, your public keys (used so others can verify messages are really from you), the date you joined, and the invite code you used.
Public profile: your display name, avatar, banner, bio, pronouns, server tag and badges. These are visible to other Vaelor users.
Login security: a hashed password verifier, and an encrypted backup of your keys and settings that only your password can unlock. If you turn on two-factor authentication, we store the secret your authenticator app uses and scrambled (hashed) copies of your backup codes.
Social features: your friends list, friend requests and blocks, your online status (online, idle, do not disturb or invisible), and that you have unread direct messages waiting (not what they say).
Server membership: which servers (by random ID) you're a member of, when you joined, your permission level in each, bans, and invites (who made them, when they expire, how many times they've been used). We need these to let the right people in and keep banned people out. Invite codes themselves are never sent to us; we only receive a scrambled lookup value.
Encrypted content: the encrypted messages and files described above, plus basic details we can't avoid seeing to deliver them, such as their size, when they were sent, which server and channel ID they belong to, and which account sent them.
Official Server applications: what a server owner writes in their application (server name and description). This is sent to us unencrypted so staff can review it.
Moderation records: warnings, suspensions and bans on your account, reports we receive, and a log of actions taken by Vaelor staff.

When you join the waitlist

Your email address, the date you joined, whether you asked for Vaelor news emails, and the status of your spot (waiting, invited, joined) including the invite code we gave you.

Technical information

IP addresses: our servers see your IP address when you connect, like any website. We use it in memory to deliver data and to limit abuse (for example, too many login attempts). It may also appear in short-lived server logs used to keep the Service running and secure.
App details: your app version, used to offer updates.

We don't use analytics trackers, advertising SDKs or third-party cookies.

4. What stays on your device

The Vaelor app stores some things on your own device so it works quickly and privately: your keys, your list of servers, unread markers, settings and preferences, notes and nicknames you give people, and the invite codes you created. These stay on your device and aren't sent to us, except as part of your encrypted account backup where noted in the app.

Voice chat uses your microphone, only while you're in a voice channel or call, and only after you allow it.

5. How we use information

To provide the Service: creating and securing your account, delivering encrypted messages and calls, showing profiles, managing servers, invites and friends.
To keep Vaelor safe: preventing spam and abuse, enforcing our Terms, reviewing reports and appeals, and protecting people from harm.
To run the closed beta: managing the waitlist, sending you your invite code and getting-started information.
To send optional Vaelor news, only if you asked for it. You can ask us to stop at any time.
To fix bugs, plan capacity and improve Vaelor.
To meet legal obligations.

Where laws like the GDPR apply, we rely on: performing our agreement with you (running your account), our legitimate interests (security, abuse prevention, improving Vaelor), your consent (optional news emails), and legal obligations.

We don't sell your personal information, and we don't share it with advertisers or data brokers. We only share information:

With other users, as you'd expect: your public profile, your online status with friends and server members, and the encrypted content you send to them.
With service providers that help us run Vaelor, such as our server hosting and domain name providers. They can only use it to provide their service to us.
For legal reasons, when we believe in good faith that the law requires it, such as a valid court order. We check each request carefully. Because of end-to-end encryption, the most we could provide is account information and encrypted data we can't read. Where the law allows, we'll tell you before sharing.
To prevent serious harm, if we believe it's necessary to protect someone from death or serious injury, or to report child sexual exploitation as required by law.
If Vaelor changes hands, for example if it's reorganized or acquired. Anyone who takes over must keep the promises in this policy or give you notice and a choice first, including deleting your account.

7. How long we keep it

Account information is kept while your account exists. After you ask us to delete your account, we delete it from our servers, except for records we must keep by law or to stop abuse (such as a note that an account was banned).
Encrypted messages and files are kept until they're deleted by their sender (or a moderator), the server is deleted, or the server's storage limit means the oldest files are removed.
Waitlist emails are kept until you join, ask us to remove it, or the waitlist ends.
Moderation records and staff logs are kept as long as needed to keep Vaelor safe and handle appeals.
Server logs with IP addresses are kept for a short time and then deleted or overwritten.

Backups of our servers may hold copies of deleted data for a short time before they're replaced.

8. Security

End-to-end encryption is our main protection: even if someone broke into our servers, they'd find encrypted data they can't read. On top of that, connections use HTTPS, password verifiers are hashed with a slow algorithm, two-factor authentication is available, updates to the desktop app are digitally signed, and access to our servers is restricted. No system is perfect, so please use a strong, unique password and turn on two-factor authentication. If we learn of a breach affecting your information, we'll tell you as the law requires.

9. Your choices and rights

Edit your profile and privacy settings any time in Settings.
Control who can reach you: choose who can send you friend requests, and block people.
Delete things: delete your messages, or delete servers you own.
Leave the waitlist or stop news emails: contact us and we'll remove your email.
Access, correct, export or delete the information we hold about you by contacting us. We'll respond within one month, or sooner where the law requires.

Depending on where you live (for example in the EU, UK or California), you may have legal rights to access, correct, delete or receive a copy of your personal information, to object to or restrict some uses, to withdraw consent, and to complain to a data protection authority. We'll honor those rights, and we won't treat you differently for using them. We don't "sell" or "share" personal information as California law defines those terms.

10. Children

Vaelor isn't for children under 13 (or the higher minimum age where you live). We don't knowingly collect information from them. If you believe a child under the minimum age is using Vaelor, please contact us and we'll delete the account.

11. Where your data is stored

Our servers are currently located in the European Union. If you use Vaelor from elsewhere, your information will be transferred there. Wherever it's stored, this policy applies, and the most sensitive parts are end-to-end encrypted.

12. Things we don't do

We don't read your messages. We can't.
We don't show ads, build ad profiles or sell your data.
We don't require your email, phone number, real name, ID or face to use Vaelor.
We don't track you across other websites or apps, or fingerprint your device.
We don't record your calls.
We don't use your content to train AI models.

13. Changes to this policy

We'll update this policy as Vaelor changes. If we make a significant change, we'll let you know in the app or by email before it takes effect, and we'll update the date at the top.

14. Contact

Questions or privacy requests: email [your contact email]. Please include your Vaelor username (or the email you used for the waitlist) so we can find your information.