Privacy Policy

Velliu ("we," "us," or "our") operates the personal finance application available at velliu.com, including Velliu, Velliu Junior, Velliu Teen, and Velliu Pro (collectively, the "Service"). We are based in Canada and serve a primarily Canadian audience.

By using our Service, you agree to the collection and use of information as described in this Privacy Policy.

We collect information you provide directly to us and information generated through your use of the Service.

Account information:

• Email address (required to create an account)
• Password (stored as a secure hash — we never see your plain-text password)
• Beta access code (if applicable)

Financial data you enter:

• Income, expense, and budget entries
• Savings goals, transaction records, and notes
• For Velliu Pro: invoices, kilometre logs, and business expense records

Payment information:

• Subscription status and payment history
• We do not store your credit card details. Payments are processed by Stripe, which handles all card data under their own privacy and security standards.

Usage data:

• General app usage patterns (pages visited, features used)
• Device type, browser, and operating system
• IP address and general geographic region

We use the information we collect to:

• Provide, operate, and maintain the Service
• Sync your financial data across your devices
• Process payments and manage your subscription
• Send transactional emails (account confirmation, password resets, payment receipts) via Resend from hello@velliu.com
• Respond to your support requests
• Improve and develop our products
• Detect and prevent fraud or misuse

We do not sell your personal information. We do not use your financial data for advertising purposes.

Your account and financial data is stored using Supabase, with servers located in Canada (Canada Central region). Your data does not leave Canada.

We use the following security measures:

• All data is transmitted over HTTPS/TLS encryption
• Passwords are hashed and never stored in plain text
• Database access is protected by Row Level Security (RLS) — you can only access your own data
• API keys and service credentials are stored as environment secrets, never in client-side code

While we take security seriously, no system is completely immune to risk. We encourage you to use a strong, unique password for your Velliu account.

We share your information only with the following trusted service providers, and only as needed to operate the Service:

• Supabase — database and authentication infrastructure (Canada Central)
• Stripe — payment processing and subscription management
• Resend — transactional email delivery
• Cloudflare — website hosting and delivery

Each provider has their own privacy policy governing their use of data. We do not share your personal information with any third party for marketing purposes.

We may disclose your information if required by law, court order, or to protect the rights, property, or safety of Velliu, our users, or the public.

Velliu uses browser local storage and session cookies to:

• Keep you logged in between sessions
• Store your preferences and app state
• Remember your premium subscription status

We do not use third-party advertising cookies or tracking pixels. If you clear your browser's local storage, you will need to log in again.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Withdraw consent for certain uses of your data (though this may affect your ability to use the Service)
• Request deletion of your account and associated personal data

To exercise any of these rights, email us at hello@velliu.com. We will respond within 30 days.

The main Velliu app and Velliu Pro are intended for adults (18+). Velliu Junior and Velliu Teen are designed for use under parental supervision — a parent or guardian creates and manages the account.

We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe a child has provided us with personal information without consent, please contact us at hello@velliu.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you by email or by displaying a notice in the app.

Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

For privacy-related questions, requests, or complaints, please contact us: