VeltoPrivacy Policy
Velto ($VELTO) is non-custodial crypto software: Shield real-time fraud protection plus multi-chain trading. We built it to collect as little about you as possible. This policy explains what we collect, why, who we share it with, and the choices you have.
Summary
- We collect your basic sign-in profile (name, email, avatar) from Google or Facebook, support tickets you send us, and standard server logs.
- We never collect private keys or seed phrases, and we never take custody of your funds.
- If you use Claude features with your own Anthropic API key, the key stays in your browser and is sent only to Anthropic, never to Velto servers.
- We use only two first-party cookies, both needed to sign you in: a session cookie and a short-lived sign-in security cookie. We do not use advertising or cross-site tracking cookies.
- We do not sell your personal information and do not share it for cross-context behavioral advertising.
- You can request access to, or deletion of, your data at any time. See Data deletion.
Information we collect
| Category | What it includes | Source and purpose |
|---|---|---|
| Sign-in profile | Name, email address, profile picture (avatar) URL, and the provider's account identifier | Provided by Google or Facebook (Meta) when you choose to sign in. Used to create and secure your account and to contact you about it. |
| Support tickets | The messages, email address, and any attachments or details you choose to include | Provided by you. Used to answer your request and improve Velto. |
| Public wallet addresses | Public blockchain addresses you connect or enter to request quotes, balances, or Shield checks | Provided by you or your wallet. Used to fetch quotes and run security screening. Wallet addresses and transactions are public on their blockchains by design. |
| Server logs | IP address, timestamp, requested path, HTTP status, user agent, and error details | Collected automatically. Used for security, abuse prevention, debugging, and reliability. |
| Local browser storage | App preferences, watchlists, paper-trading state, and (if you add one) your Anthropic API key, held in session storage by default or local storage if you choose “Remember on this device” | Stored on your own device by the app. This data stays in your browser and is not uploaded to Velto unless a feature clearly says so. |
We do not ask for government IDs, bank account numbers, or card numbers. Velto does not process payments for trades; your wallet signs and sends transactions directly to the blockchain.
What we never collect
- Private keys and seed phrases. Velto never asks for them, and the app is designed so they never leave your wallet. If anyone claiming to be Velto asks for your seed phrase, it is a scam.
- Custody of funds. We never hold, move, or control your assets. Every transaction is reviewed and signed by you in your own wallet.
- Your Anthropic API key. See the next section.
- Precise location, contacts, camera, or microphone. Our pages disable these browser features.
Your Anthropic API key (bring your own key)
Some Velto features can use Claude, a model made by Anthropic. Velto uses a "bring your own key" (BYOK) model: you create an API key in your own Anthropic account and paste it into the app.
- By default the key is held in your browser's session storage for the current tab and is cleared when that tab session ends. Only if you tick “Remember on this device” is it kept in your browser's local storage on your device until you remove it.
- When you use a Claude feature, your browser sends the request, including the key, directly to Anthropic at
api.anthropic.com. The request does not pass through Velto servers, and Velto never receives, logs, or stores the key. - Your prompts and Claude's responses for those requests are handled by Anthropic under your own agreement with Anthropic and Anthropic's privacy policy.
- You can remove the key at any time from the app's settings or by clearing your browser's site data for veltorh.trade.
You can verify this yourself: our Security & Trust page explains how to confirm, with your browser's developer tools, that the key is only ever sent to api.anthropic.com.
How we use information
- To provide, maintain, and secure Velto, including sign-in and account management.
- To fetch market data, quotes, and Shield security checks you request.
- To respond to support requests and send service messages (for example, security notices or policy changes).
- To detect, prevent, and investigate fraud, abuse, and security incidents.
- To comply with law and enforce our Terms of Service.
We do not sell personal information, we do not use it for targeted advertising, and we do not use your support tickets or profile to train machine-learning models. Shield's models are trained on public on-chain and market data.
Third-party services
Velto relies on the services below. Each processes data under its own privacy policy. Where possible, Velto's server calls market-data providers on your behalf so that your IP address is not exposed to them.
| Service | Role | Data involved |
|---|---|---|
| Sign-in (OAuth); web fonts | Profile data you authorize; your IP address when your browser loads fonts | |
| Meta (Facebook) | Sign-in (Facebook Login) | Profile data you authorize |
| Anthropic | Claude features, called directly from your browser with your own key | Your prompts, context you choose to include, and your API key, sent from your browser to Anthropic only |
| LI.FI | Swap and bridge quote routing across chains | Token pair, amount, chain, and the public wallet address used for the quote |
| GoPlus Security | Token and address security screening for Shield | Token contract addresses and public addresses being checked |
| DexScreener | DEX market data and token search | Token names, symbols, or contract addresses being looked up |
| GeckoTerminal | Trending tokens and on-chain market data | Chain and token identifiers |
| Kraken | Public CEX price data (paper trading and analysis) | Trading pair identifiers only; no account data |
| unpkg (served via Cloudflare) | Content delivery network for two exact, version-pinned open-source libraries (charting and Solana wallet support) loaded by the app | Your IP address and user agent when your browser downloads these files |
| Cloudflare | Network delivery, DDoS protection, and TLS | Standard request metadata such as IP address and user agent |
Your wallet software and the blockchains you transact on are operated by others. Transactions you sign are public and permanent; Velto cannot change or delete on-chain data.
We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to the transferred information.
Cookies and local storage
Velto sets only two first-party cookies, both strictly necessary for sign-in. Neither is used for tracking or advertising, and Velto does not use third-party advertising or analytics cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
velto_sid | Session cookie that keeps you signed in | Expires after 30 days of inactivity and at most 90 days after sign-in, or when you sign out |
velto_oauth | Short-lived sign-in security cookie that ties a Google or Facebook login to the browser that started it, to prevent login forgery | 10 minutes, limited to the /auth/ path, and cleared when sign-in completes |
Both cookies are HttpOnly (not readable by page scripts) and SameSite=Lax, and they carry the Secure flag (sent only over HTTPS) when you connect over HTTPS. Deployment review: confirm production always marks these cookies Secure
The app also uses your browser's session storage and local storage for preferences and features that run on your device, as described above. Google and Meta may set their own cookies on their own sign-in pages, under their policies.
Because we do not track users across sites, we do not change our practices in response to "Do Not Track" signals; we honor Global Privacy Control (GPC) signals as a request to opt out of sale or sharing, although we do not sell or share personal information.
Retention
| Data | How long we keep it |
|---|---|
| Account profile | Until you delete your account; then removed within 30 days |
| Support tickets | Up to 24 months after the ticket is closed, or until you request deletion |
| Server logs | Up to 30 days, longer only when needed to investigate a specific security incident |
| Backups | Deleted data ages out of encrypted backups within 90 days |
| Local browser storage | On your device until you clear it; Velto cannot access or delete it remotely |
We may keep limited records longer when the law requires it or to resolve disputes, and we keep a deletion confirmation code so you can check the status of a request.
Your rights
Wherever you live, you can ask us to:
- Access the personal information we hold about you, in a portable format.
- Correct information that is inaccurate.
- Delete your account and personal information (see Data deletion).
- Withdraw the permissions you gave through Google or Facebook, which you can also do in those providers' account settings.
Send requests to [email protected]. We will verify the request, usually by confirming control of the email address on the account, and respond within 45 days.
California residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights:
- Right to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of third parties with whom we disclose it.
- Right to delete personal information we collected from you, subject to legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. Velto does not sell personal information or share it for cross-context behavioral advertising, and has not done so in the preceding 12 months.
- Right to limit the use of sensitive personal information. Velto does not use sensitive personal information for purposes that require this right to be offered. Account sign-in credentials are handled by Google or Meta, not stored by Velto.
- Right to non-discrimination for exercising any of these rights.
Categories collected in the last 12 months: identifiers (name, email, provider account ID, IP address, public wallet addresses); internet or network activity (server logs); and customer records (support tickets). Business purposes: providing the service, security, debugging, and customer support. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity. To exercise your rights, email [email protected] with the subject "California privacy request."
Children
Velto is not directed to children. You must be at least 13 years old to use the website and at least 18 years old (or the age of majority where you live, if higher) to connect a wallet or use trading features. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact [email protected] and we will delete it.
Security
We use encryption in transit (TLS), a strict Content Security Policy, minimal data collection, and access controls to protect the information we hold. Because Velto is non-custodial and never receives private keys, seed phrases, or your Anthropic key, a breach of our servers could not expose them. No system is perfectly secure; please report vulnerabilities as described on our Security & Trust page.
Where data is processed
Velto is operated from the United States, and information is processed in the United States. Some third-party services listed above may process data in other countries under their own safeguards.
Changes to this policy
We may update this policy as Velto changes. We will post the new version here with a new "last updated" date and, for material changes, notify signed-in users by email or in the app before the change takes effect.
Contact
Privacy questions and requests: [email protected]
Mailing address: [Velto legal entity name and US mailing address - to be completed before launch]