Velinoya Mobile Privacy Policy
Last updated: 27 October 2026
Version:
mobile-privacy-2026-10-27
This Policy covers the Velinoya mobile app and its iOS App Clip. The Telegram bot and Mini App have a separate policy. Using one edition does not automatically link your accounts on different platforms.
Operator: Savelenko Vasilii (Савеленко Василий Викторович), an individual based in Russia. Correspondence address: 22 Kerey Zhanibek khandar Street, Office 315, Yesil District, Astana, Republic of Kazakhstan. This is a mailing address, not a statement of where data is processed. The Operator also serves as Data Protection Officer (DPO). Data inquiries: privacy@velinoya.com; support: support@velinoya.com.
1. What the app does
Velinoya produces entertainment interpretations of your own palm photo, compatibility and forecasts. Pretrained models process photos in the Operator's infrastructure; photos are not sent to an external generative AI service. We do not use your photos, results or other user data to train or evaluate models. Results are not intended for identity verification, medical diagnosis or decisions materially affecting a person's rights.
We also store a digital template of palm structure and patterns and compare repeat photos within the account to distinguish the same palm from a different one and keep results consistent. This is biometric image matching, not palm-based sign-in, verification of legal identity or searching for a person across other accounts. The template is linked to the account and is deleted as derived palm data.
2. Data and purposes
- Sign-in and profile. The full app uses Firebase Authentication and your chosen Apple or Google sign-in. These services process account identifiers, authentication information and available name/email, including Apple's private relay email. Your Apple or Google password is not sent to our server. Our server verifies the Firebase token and stores an internal identifier, sessions, sign-in method, language, time zone, technical client information and nickname. The server initially assigns a poetic name in the interface language; you can change it. A released name may later belong to another account, so a nickname is not proof of identity.
- Palm and history. We receive the image you select or take, its format and size, task parameters, time and technical identifiers. We keep the source photo, visualization files, palm features, processing status, results and history to process the image, retry failed work and display the result without another photo. Camera use requires system permission; camera permission alone is not consent to every later use of the data.
- Compatibility and invitations. We retain an invitation code/token, participant relationships, shared results and visibility settings. Another participant may see your display name and shared compatibility result, but not your palm photo or personal reading. When the interface offers to join an invitation, consider the identified participant and shared visibility. Screenshots or messages you independently share are also held by their recipients.
- App Clip without sign-in. We create a random guest identifier, a restricted access token, language and time records, and records of your 18+ confirmation and processing permission with the notice version. The photo and result belong to that guest. We use the IP address to prevent abuse; rate-limit counters are linked to a protected hash of the address. After installing the full app and signing in, an available guest reading automatically transfers to your account. The photo, derived data and result are retained until account deletion under the normal history rules. Replacing an existing reading requires a separate confirmation.
- Operation and support. The server receives IP addresses, times, client information, errors and request/task identifiers. Support correspondence includes your email, text, attachments and replies. Never send passwords, login codes, tokens or banking details. Ordinary logs are not intended to contain photos or authentication secrets.
- On your device. Language preferences, sign-in state, photo/result caches, App Clip transfer records and a deletion receipt are stored locally to operate the app, restore readings and check deletion after restart. Uninstalling the app is not a request to delete the server account.
Purchases and subscriptions are disabled in this free edition; it does not request payment information or use RevenueCat for purchases. The app does not integrate advertising SDKs, Firebase Analytics or Crashlytics, and does not use data for advertising tracking across services. Telegram's own product analytics are described in its separate policy; opening the mobile app does not constitute consent to those analytics.
Sign-in services also have their own technical telemetry. Firebase collects device, OS and SDK-version information that is not linked to a user identifier to assess platform adoption. Google Sign-In may process user/device identifiers, technical information, SDK usage and an approximate region inferred from IP for security and SDK analytics. This does not mean that we receive GPS coordinates or use this data for advertising.
3. Recipients and processing countries
| Recipient | Data and purpose |
|---|---|
| DigitalOcean | Server-side palm processing, databases, queues, logs, photos/derived files in private object storage, and backups. Primary app infrastructure and DigitalOcean Spaces are in Singapore (SGP1). |
| Google / Firebase Authentication | Authentication/account information, name/email when provided, IP and client information for security. Firebase Authentication processes data in the United States; palm photos are not sent to Firebase for analysis. |
| Apple; Google if you choose Google sign-in | Independent processing for the selected sign-in service and platform. Apple can supply an email alias. Their rules do not replace our responsibility for Velinoya data. |
| Proton Mail (Proton AG, Switzerland) | Support/privacy correspondence and delivery data. Mail infrastructure is in Switzerland, Germany or Norway; ordinary email between providers is not necessarily end-to-end encrypted. |
| Another participant and a recipient you select | Display name and shared compatibility results; material you explicitly share. |
| Lawful recipients | Minimum necessary information for a justified legal obligation, protection of rights or lawful authority request. |
The Operator administers the service from Russia. Singapore hosting does not mean Singapore-only processing. Applicable contractual and other binding safeguards are used for transfers; where law requires prior consent or additional information about an overseas transfer, these must be provided before that transfer. This Policy does not replace required separate consent. Ask privacy@velinoya.com about recipients and safeguards.
See Firebase Privacy, Sign in with Apple & Privacy, Google Privacy and Proton Mail Privacy.
4. Retention and deletion
| Data | Period or event |
|---|---|
| Velinoya profile, photos, derived files, history, forecasts and pairs | While needed for the account and available history. Eligible active data is deleted within 24 hours after a confirmed deletion request is accepted. A shared pair is removed for both participants. |
| App Clip guest reading | Available for 24 hours from guest-session creation, after which deletion is initiated. You can request deletion earlier from the result screen. Once transferred to a full account, normal history retention applies. |
| Application backups | Eligible data is removed within 30 calendar days after acceptance of a deletion request. |
| Firebase Authentication | Account deletion triggers deletion of the Firebase user and session revocation. Firebase states that associated authentication data is removed from its live and backup systems within 180 days; IP logs remain for a few weeks. This is a separate provider period, not palm-photo retention. |
| Ordinary operational logs | Up to 30 days; necessary information for an active incident or legal obligation may be retained separately. |
| Support/privacy correspondence | Until account deletion or 12 months after the case closes, whichever is earlier; only a justified minimum may remain longer for an active dispute or obligation. Proton's backups of deleted mail may remain for up to 30 days. |
| Deletion execution ledger | Encrypted identifiers and technical evidence needed for retries and prevention of data restoration, only while that need remains. These records are not anonymous and do not authorize reactivating the account. |
The 24-hour and 30-day periods are service commitments for our own data, not universal statutory periods for all data and providers. We review retention needs, including inactive accounts. Exceptions concern only necessary data, a specific basis and a necessary period.
5. Your choices and rights
In the full app, open Profile → Delete account, review the consequences and confirm. You may need to sign in again with the same method to protect the account. For Apple sign-in, the app revokes the sign-in authorization; the server deletes the Firebase user. Once accepted, sessions are revoked and deletion continues if you close the app. The screen distinguishes pending and completed deletion. Completion of the server operation does not mean that all provider backup periods have instantly elapsed.
In the App Clip, use the guest-reading deletion option. If you lose access, email privacy@velinoya.com with information that helps locate the account or guest reading, but no secret token. We proportionately verify that the request relates to you.
You may request access/a copy, correction, deletion, cessation of use or disclosure, and recipient information as provided by applicable law, and withdraw consent. Withdrawal does not invalidate earlier lawful processing; we explain the effect on the relevant feature. Reading this Policy is not blanket consent to all purposes. Camera permissions can be changed in iOS; this does not delete uploaded data. Hiding a result or signing out does not delete server data either.
We respond without undue delay and within applicable legal periods, explain lawful limitations and protect others' rights. For Singapore PDPA access/correction requests that cannot be completed within 30 days, we communicate an expected response date within that period. You can contact your country's data-protection authority, including Japan's PPC or Singapore's PDPC. Mandatory rights where you live remain available.
6. Security, age and changes
Transmission uses HTTPS; server safeguards include access restrictions, encryption of operational objects and backups, and a deletion ledger. No security is absolute. We notify affected people and authorities of notifiable incidents as required by applicable law.
The service is for people 18 or older, using only their own palm. Do not upload another person's or a minor's photo. Report such data to privacy@velinoya.com for review and removal.
Changes are published with a new version; we notify you of material changes when required. This Policy does not automatically authorize new purposes. Operator contacts are above; Terms of Use are separate.