Privacy Policy

The short version

No tracking, no analytics and no advertising in the app. Veldi doesn't report what you do with it.

Your files are read on your Mac and never uploaded — not to us, not to anyone.

To find updates for your apps, Veldi asks Apple, Homebrew and the apps' own update feeds about the apps you have installed. Those requests carry app identifiers, never anything about you or your files. Veldi also checks our servers for new versions of itself.

The free features need no account. Once accounts launch, subscriptions and the trial will need one, and we'll hold your email, the Macs you connect and your purchases — nothing about your files.

This website uses cookieless, aggregated analytics, so there's no cookie banner.

What Veldi reads on your Mac

To measure your disk, Veldi reads the names, sizes and dates of files and folders. With Full Disk Access — which you switch on yourself in System Settings and can switch off at any time — it can also measure protected places such as your Photos library, Mail, cloud folders, Desktop, Documents and Downloads. It reads sizes and dates; it doesn't open your documents, photos or messages to read what's in them.

For your Photos library, Veldi reads statistics (such as how many photos and videos there are and how much space they take) from the library's database, read-only, so looking never changes Photos.

To list, update and uninstall apps, Veldi reads each installed app's name, version, developer and identifier, and looks for the files apps leave behind. Its performance features read live figures from macOS: running apps, memory, CPU, battery and storage health, and the items that open when you log in.

All of this stays on your Mac. Veldi keeps its history of what it removed, and its settings, in its own folder on your Mac (~/Library/Application Support/Veldi), so you can put things back. Crash and hang diagnostics are off by default; if you turn them on, they are saved in that same folder and never sent — you can attach them to an email yourself.

What leaves your Mac, and where it goes

Updates for your apps. Shortly after Veldi opens, at most every few hours while it runs, when you open Apps › Updates if the last check is more than six hours old, and whenever you choose Check Again, Veldi checks for newer versions: for App Store apps it sends their bundle identifiers (such as com.example.app) and your region to Apple's public App Store lookup (itunes.apple.com); for apps with their own Sparkle update feed it downloads that feed from the app's developer; for other apps it fetches the app's public record from Homebrew (formulae.brew.sh). To show an update's size and date, it asks the developer's download server for the file's details without downloading it. If you choose to update an app from Veldi, the new version is downloaded from the address its developer's feed or Homebrew lists.

These requests go straight from your Mac to those servers — not through us — and carry no account, no identifier for you or your Mac and nothing about your files. Like any internet request, they show your IP address to the server that receives it, which handles it under its own privacy policy (Apple's, Homebrew's or that developer's).

Updates to Veldi itself. Veldi uses Sparkle to check for new versions of itself, automatically, or when you choose Check for Updates… in the app. The check downloads an update feed from our website or download server (see Who processes data for us). Like any web request it includes your IP address and Veldi's version, and no account or usage data.

Cloud files. When you make files online-only or download them again, Veldi asks macOS to do it, and macOS and your cloud provider (such as iCloud Drive) do the transfer under that provider's terms. Veldi doesn't see or relay the files.

Report a Problem. Help › Report a Problem… copies a short summary to your clipboard — Veldi's and macOS's versions, your Mac's model, whether Full Disk Access is on, the state of Veldi's helper and how many files your last scan counted, with no file names — and starts an email in your own mail app. Nothing is sent unless you send that email yourself.

That is the complete list. Veldi has no crash reporter, telemetry or analytics of its own.

Accounts, trials and Pro — once they launch

Today Veldi has no accounts and nothing is for sale, so we hold none of the data in this section. It describes what we will process when Pro launches, so you can read it before then; when it starts to apply we'll update the date above.

Your account. Your email address and a password, which we store only as a one-way hash, never the password itself. When you choose a password we check it against known data breaches through Have I Been Pwned: only the first five characters of a hash of it leave our servers, never the password. Two-factor sign-in with an authenticator app is optional. If a link with a campaign or referral tag brought you to us, we keep that tag with your account.

Your Macs. Pro works on up to 3 Macs per account. When you connect a Mac, we store its name (as set in System Settings), its model, its macOS and Veldi versions, when it was connected and last seen, and a device identifier that is a one-way hash derived from your Mac's hardware ID — we never receive the hardware ID itself. We use these to show you your Macs, to enforce the 3-Mac limit, and to allow one free trial per account and per Mac.

Your licence check. While you use Pro, Veldi checks your licence with our server when Veldi starts or wakes, about once a day while it runs, and before it starts a batch of changes, whenever it is online. The check sends the connected Mac's device token and identifier, and gets back what your plan includes. It sends nothing about your files or how you use Veldi. If you paste a one-time licence key on a Mac that isn't connected to an account, Veldi checks once a day whether that key is still valid, sending the key's ID and the Mac's device identifier.

Account milestones. We record a few events with their dates — connecting a Mac, starting a trial, starting and completing a checkout, opening billing — to understand how many people try and buy Veldi. Not what you do in the app.

Your purchases. Your email, the plan, the amount, currency and tax, dates, Stripe's payment and subscription references, any refund, the licence key we issue for a one-time purchase, and the moment you accepted the terms and the withdrawal-right acknowledgement at checkout. Your card details are entered on Stripe's checkout and handled by Stripe; we never see or store your card number.

Emails. We send emails about your account and purchases only: verification, your licence key, trial ending, renewal reminders, payment problems and a subscription ending. No marketing unless you ask for it.

Security. To prevent abuse of free trials and sign-ins, we limit requests per IP address and check whether an email address belongs to a disposable-email service. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects: if a trial or a sign-in is refused, email us and a person will review it.

Your controls. From your account you'll be able to remove a Mac, download a copy of your data, and delete your account, which cancels any active subscription first.

Why we use it (legal bases)

To provide your account, licence, Macs and purchases, and the emails about them: because it is necessary for our contract with you (GDPR art. 6(1)(b)).

To keep invoices and tax records: because the law requires it (art. 6(1)(c)).

To answer your emails: our legitimate interest in replying to you, or steps you ask us to take before a contract (art. 6(1)(f) and (b)). To tell you when Veldi launches, if you ask: your consent (art. 6(1)(a)).

To protect Veldi and its users from fraud and abuse, to keep the website and portal secure, and to count visits in aggregate: our legitimate interest in running a safe, sustainable service, which doesn't override your rights because the data is minimal and never used to profile you (art. 6(1)(f)).

Anything optional, such as hearing about new releases, only with your consent, which you can withdraw at any time.

Who processes data for us

Stripe — payments, subscriptions and invoices. If checkout uses Stripe Managed Payments, the Stripe company named at checkout sells Veldi to you as merchant of record and processes your purchase data as a controller in its own right, under Stripe's privacy policy.

Supabase — our database (once accounts launch), hosted in the European Union (Frankfurt).

Vercel — hosts this website and the account portal, and provides the website's analytics. Our server code runs in the EU (Frankfurt); Vercel's network serves pages from the location nearest to you.

Resend — sends our emails.

Google (Google Workspace) — hosts our hello@ferrix.ventures inbox, where support emails and launch requests arrive.

Cloudflare (R2) — stores and serves Veldi's downloads and update feed, and keeps encrypted backups of our database.

Sentry — error monitoring for the account portal, in its EU region; an error report can include the IP address and account ID of the request that failed.

Each of them processes data only on our instructions under a data processing agreement. Some are US companies: where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. We don't sell or share personal data with anyone else, and we don't use it for advertising.

The website

This website is hosted on Vercel, which processes standard request information (such as your IP address and browser) to serve pages and protect against abuse.

We count visits with Vercel Web Analytics, which uses no cookies and stores nothing on your device. It records the page, the referring site, your country and your browser, operating system and device type. Visitors aren't identified: Vercel tells visits apart with a hash of the request that it discards after 24 hours. We see only totals.

The site sets one cookie, NEXT_LOCALE, and only when you view it in a language different from your browser's — because you chose one, or followed a link to a page in it: it keeps the site in that language and expires when you close the browser. Because it only serves the page you asked for, it needs no consent. If you choose Light or Dark appearance, that choice is saved in your browser's local storage. Nothing else is stored on your device, and there are no advertising or tracking cookies.

If you email us — including to be told when Veldi launches — we keep your address and message to reply to you. A request to hear about the launch is deleted once we've sent the launch email; other emails are kept for as long as needed to support you, unless they belong to a purchase we must keep records of. You can ask us to delete them sooner.

How long we keep data

Account and device data: for as long as you have an account. A Mac you haven't used for 90 days stops counting toward your limit. When you delete your account, we delete your sign-in identity, your Macs and your account history.

Purchase, invoice and tax records: for as long as Spanish tax and commercial law requires (up to six years), even after you delete your account, so the record of a purchase is never lost. A one-time licence you bought stays valid.

Records of Stripe's notifications to us: 90 days in full, then only their outline. Encrypted database backups: 30 days. Hosting and error logs: a short period set by each provider.

Your files: never — we never have them.

Your rights

You can ask us for access to the personal data we hold about you, a copy in a portable format, correction, deletion or restriction of processing, and you can object to processing based on our legitimate interests. Email us at hello@ferrix.ventures; we'll answer within one month and may ask you to confirm it's you. Purchase records the law requires us to keep can't be deleted until that period ends.

If you think we've handled your data wrongly, please tell us first so we can fix it. You also have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the data protection authority where you live.

Children

Veldi is not directed to children. Buying Pro requires being old enough to enter a binding contract where you live, or the permission of a parent or guardian.

Changes to this policy

If we change this policy we'll update the date above, and for material changes we'll say so on this page and, once you have an account, by email before they take effect.

Contact

Questions about privacy? Email us at hello@ferrix.ventures. Veldi is made by Ferrix Ventures, Spain; our full details are in the Legal Notice (veldi.ferrix.ventures/legal).