Privacy Policy — Veloda Pass

Last updated: October 11, 2026

Veloda Pass is a password manager. This page says what we can see, what we cannot, and where things are kept.

The short version

Everything you save is encrypted on your own device, with a key made from your master password, before it is sent to us. The master password and the Recovery Key never leave your device. We store what we cannot read, and we have no way to open your vault — for you, for ourselves, or for anyone who asks.

What we store

Your e-mail address, to identify the account and to send you sign-up codes and security notices.
Your encrypted items. We can see how many there are and how large each one is, never what is in them.
Files you attach to items, each one encrypted on your device before it is sent, and kept in Cloudflare storage inside the European Union. We can see how many there are and how large each one is, never what is in them. A file is removed when you remove it, when its item is deleted for good, and when you delete the account.
Encrypted copies of your vault key (one locked by your master password, one by your Recovery Key). They are useless without those.
Proofs of identity: salted hashes of two values your device derives from the master password and from the Recovery Key. They let us check who is signing in; they cannot be turned back into either secret and they open nothing.
Your signed-in devices: the device model name, when it signed in and when it was last used.
If you turn on two-step sign-in: the secret your authenticator app uses, and hashes of your backup codes.
If you use emergency access: a key pair for your account (its private half locked by your vault key), the e-mail addresses of the people you name, and for each of them a copy of your vault key sealed so that only that person's device can open it. We cannot open it. We send the person one invitation e-mail, hand them the sealed copy only after the waiting time you set has passed without your refusal, and e-mail you when they ask, a day before it opens, and when it opens.
If you ask for a subscription: the plan you chose, the number or account you paid from, the reference you typed and, until we have decided on your request, the picture of the receipt you uploaded; it is deleted when the request is decided. The date your subscription runs to is kept with your account.
Short-lived codes (as hashes) and counts of failed attempts, to stop guessing.

What we do not collect

No analytics, no advertising identifiers, no crash reports, no record of what you open or when. We do not sell or share your data.

Where it is kept, and who else is involved

Cloudflare runs our server and its database. The database is set to run and store its data inside the European Union. Like any host, Cloudflare processes the IP address and technical details of each request.
Resend delivers our e-mails (sign-up codes, security notices). It receives your e-mail address and the message.

Other places the app connects to

Have I Been Pwned, when the leaked-password check runs, which is each time the vault is opened unless you switch that off in Settings: the first five characters of a fingerprint (SHA-1) of each password are sent, never the password.
2fa.directory, only when you check which sites offer two-step verification: a public list is downloaded.
The sites of your saved logins, only while “Show site logos” is on in Settings: each site is asked for its front page and its own icon, as a browser would ask, with no account and no cookie, and with no third party in between. A login saved under a well-known name and no address asks the site that name stands for (facebook.com for “Facebook”). The icons are kept on your phone.
velodaapp.com, to see whether a newer version is published: a public list of versions is downloaded. When you choose to update from inside the app, the new version’s file is downloaded from dl.velodaapp.com, checked, and handed to Android, which asks you to confirm.

On your device

The app keeps an encrypted copy of your vault so that it works without a connection, plus your settings and how often you open each item (for the lists on the Home screen). These stay on the device and are removed when you sign out.

Keeping and deleting

You can delete your account in the app at any time; your items, keys and devices are removed from our database at once. "Start over" on the sign-in screen does the same when you have lost both your secrets. A device that has not been used for 90 days is signed out. Our database provider keeps point-in-time recovery copies for a limited period (up to about 30 days), in which deleted data — always encrypted — can remain until it expires. For disaster recovery we also make a daily backup of the database, encrypted before it is stored, and keep it with GitHub and with Backblaze (in the European Union) for up to about 90 days; data you deleted can remain inside those backups until then. Your saved items stay encrypted with your own key inside them, so we cannot read them there either.

Security, said plainly

Veloda Pass uses standard, widely studied building blocks (Argon2id, AES-256-GCM, HKDF) and is designed so that a breach of our server would expose only ciphertext. It is a new product from a solo developer and has not yet had an independent security audit.

Children

Veloda Pass is not directed at children under 13, and we do not knowingly collect their data.

Changes

If this policy changes in a way that matters, the date above changes and the app's privacy page is updated with it.

Contact

Questions about privacy? Email [email protected].