Privacy policy

1Who we are

Veolan is provided by Quantum Encoding Ltd, a company registered in England and Wales (company number 16575953), with its registered office at 33 Oxford Street, Coalville, LE67 3GS, United Kingdom. We are the controller of the personal data described on this page.

For anything about your data, email support@veolan.com. You can also write to us at the address above, or email the company at info@quantumencoding.io.

2The short version

• Your screens, what you type, your clipboard, your files and your session logs never reach our servers. Your devices connect to each other, encrypted end to end.
• Our servers keep what it takes to run your account: your email address, how you sign in, and the devices you link to it.
• There are no analytics, advertising or tracking cookies on veolan.com, in the account portal or in the apps.
• Veolan has no AI features. Nothing you do in Veolan is analysed by AI or used to train it.

3Your Veolan account

Your account lives at account.veolan.com. To run it we keep:

• Your email address. We use it to create your account, sign you in and send you sign-in codes, and we note when you confirmed it.
• An account record. An internal ID, when the account was created and changed, and whether it is active or suspended. Each account also gets a workspace record, which is named with your email address.
• Sign-in codes. A code we email you works for 10 minutes. We store only a hash of it (a one-way fingerprint that can’t be turned back into the code), with a hash of a token that ties the code to the browser that asked for it. A routine clean-up deletes these records once they have been expired for a day.
• Passkeys. For each passkey: its public key and ID, the name you give it, whether it is synced between your devices, how it connects, a use counter, and when it was added and last used. The private part of a passkey stays on your device or in your password manager. We never receive it.
• Two-step sign-in, if you turn it on. Which second step you prefer; the authenticator secret, stored encrypted; recovery codes, stored only as salted hashes; and, if you choose text messages, your mobile phone number. We store the number encrypted, show only its last digits, and use it only to send you sign-in codes.
• Sessions. When you sign in we keep a hash of your session token (never the token itself), when the session started, when it was last used and when it expires, and the IP address and browser details (the user-agent string, which names your browser and operating system) it started from. You can see your sessions on the Security page of your account and sign any of them out.
• A security log. We record security events: sign-ins, failed attempts, sign-in codes sent by email or text message, changes to passkeys, phone numbers and two-step sign-in, sign-outs, and actions our administrators take on accounts. Each entry has the time, the account involved, the outcome, the IP address, and details that can include the email address used, a passkey’s ID, or the country code and last two digits of a phone number (never the whole number).
• Rate-limit counters. To stop people guessing codes, flooding the service or running up text-message costs, we count requests per IP address, email address, account, device ID or phone number over windows of one minute to one day. Phone numbers are counted under a fingerprint computed with a secret key, never the number itself. The same clean-up deletes counters a day after their window ends.

Our administrators can see account details and the security log, to support you and to deal with misuse.

4Devices you link to your account

When you link a device to your account, the Veolan app sends its device ID (the public half of a key pair the device made for itself), the name you’ve given the device and its operating system family, for example macOS, Windows or Android. It proves it holds the matching private key by signing a one-time link code. Link codes work for 10 minutes and we store only their hashes.

For each device we keep its ID, name and platform, when it was added, approved or revoked, and when it last asked for a relay pass. A device you don’t approve within 10 minutes is removed, and so is one you reject. A device you revoke stays on your list, marked as revoked.

Once the apps use our own relays, a linked device will ask your account for a relay pass that lasts an hour, and hand it to our relay service. For that we briefly keep the one-time challenge the device signed, as a hash with the device ID; the challenge expires after a minute and its record is then cleared out. Our own relays are now running, in London, and the apps are moving to them.

5What stays on your devices

Most of what Veolan knows stays on your own devices:

• The device key. Each device makes its own key pair the first time it runs. The private key is a file on that device and never leaves it.
• Trusted devices and settings. The list of devices a computer trusts (their IDs and names, the access each is allowed, when it was added and last seen) and the app’s settings are kept on the device.
• The session log. Each computer keeps a log of the sessions it hosts: which device (its ID and name), view or control, when the session started and ended and how long it lasted, whether someone was at the computer, why it ended, and counts of activity, such as mouse moves, clicks, keys pressed, characters typed and bytes copied to and from the clipboard. These are counts only: what you type and what you copy are never recorded. The log is a file on that computer. The apps never send it to us, and they don’t trim it, so it stays until you delete it.
• Your sessions themselves. Screens, keystrokes, clipboard contents and files travel only between your devices, encrypted end to end. They never reach our servers.

The apps contain no analytics, crash reporting or telemetry.

A help code, the code someone gives you so you can help them, contains their computer’s ID and network addresses, including its IP addresses, so your device can reach it. It goes from them to you directly, not through us, and the person you give a code to learns those addresses.

6Relays and finding your devices

To find each other and get through firewalls, devices use relays and an address lookup service. During early access these are the public relays and address service (dns.iroh.link) of n0 (number 0), the company behind iroh, the open-source networking software Veolan is built on. They run in the United States, Europe and Asia.

A relay forwards traffic that is already encrypted between your two devices. It holds no keys, so it can’t see your screen or what you type. Like any network service, it can see the device IDs and IP addresses involved, when connections happen and how much data passes. Each device also tells the address service its ID and which relay it uses, so other devices can find it.

We plan to move to Veolan’s own relays, and we’ll update this page when we do.

7This website

veolan.com is a static website. It sets no cookies, runs no analytics, and loads no scripts, fonts or embeds from anyone else. Cloudflare hosts it, and like any web host it processes your IP address and the details of each request in order to deliver the pages and protect the site from attacks.

8Emails and text messages

We send sign-in codes; a security alert when a way of signing in is added to or removed from your account, saying what changed, when, and from which browser and IP address, so you can act if it wasn’t you; and, now and then, a message from our team with a link to sign in, for example when helping you back into your account. They come from no-reply@veolan.com and are sent through Cloudflare’s email service. We don’t send newsletters or marketing.

If you choose text messages for two-step sign-in, we send your sign-in codes to your mobile number through Twilio Verify, only when you add the number or ask for a code, and only to numbers in the UK and the European Union. Twilio creates and checks each code; we never see or store the codes.

If you email support@veolan.com, we use your message and email address to reply to you, and keep the conversation for up to 12 months.

9Cookies

veolan.com uses no cookies. The account portal uses only the cookies it needs to sign you in, plus one that remembers the language you chose:

• __Host-qe_session keeps you signed in. It lasts up to 90 days, and stops working sooner if the session ends.
• __Host-qe_bind ties a sign-in code to the browser that asked for it. It lasts 10 minutes.
• __Host-qe_mfa carries a sign-in through the second step of two-step sign-in. It lasts 10 minutes.
• veolan-lang remembers the language you chose when you arrived from a veolan.com page. It lasts a year.

None of them is used for analytics or advertising, which is why there is no cookie banner.

10Why we use your data

Under the UK GDPR and the EU GDPR we rely on these legal bases:

• To provide the service you asked for (contract). Your account, signing in (including sign-in codes by text message, if you choose them), linking devices and sending sign-in emails.
• Our legitimate interests. Keeping your account and the service secure and stopping abuse: the security log, security alerts when a way of signing in changes, the IP address and browser details kept with sessions, rate-limit counters, and the request logs described below. We keep this to what security needs, and you can object to it (see Your rights).
• Legal obligations. Where the law requires us to keep or disclose information.

We don’t sell your data, use it for advertising or build profiles of you, and we make no decisions about you by automated means alone.

11How long we keep it

• Your account, passkeys, two-step sign-in (including your phone number, if you added one) and linked devices: for as long as you have an account. Removing your phone number or turning off two-step sign-in deletes the number straight away.
• Sessions: a session ends after 30 days without use, and after 90 days at most. Its record is deleted when you sign out, and otherwise by the routine clean-up once it has ended.
• Sign-in codes, link codes and relay challenges: they work for minutes, and their records are deleted by routine clean-ups after they expire.
• Rate-limit counters: deleted by the routine clean-up a day after their window ends.
• Request logs: Cloudflare keeps the account portal’s request logs, which include IP addresses, for up to 7 days.
• The security log: entries are kept for 12 months, including after an account is deleted, so that misuse can be investigated, and are then deleted by the routine clean-up.

To delete your account, email support@veolan.com from the address you sign in with. We will delete your account and the data linked to it, apart from the security log described above. You can remove passkeys or your phone number, turn off two-step sign-in, sign out sessions and revoke devices yourself in your account at any time.

12Who handles your data for us

• Cloudflare, Inc. hosts veolan.com and the account portal, runs the account database, sends our emails and keeps the request logs.
• n0 (number 0) runs the public relays and address service the apps use during early access, as described above.
• Twilio Inc. sends sign-in codes by text message (Twilio Verify) if you choose them for two-step sign-in. It receives your phone number and the language for the message, creates and checks the codes, and keeps records of the messages it sends under its own retention and anti-fraud rules.

We don’t share your data with anyone else, unless the law requires us to.

13International transfers

Cloudflare runs a global network, so your data may be processed outside the UK and the European Economic Area, including in the United States. Cloudflare’s data processing addendum includes the standard contractual clauses approved for the UK and the EU, and Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK extension.

n0’s public relays and address service run in the United States, Europe and Asia, so connection details (device IDs, IP addresses and timing) can pass through those places. Your session content can’t: it stays encrypted end to end.

Twilio may process your phone number outside the UK and the European Economic Area, including in the United States. Twilio’s data protection addendum includes the standard contractual clauses approved for the UK and the EU, and Twilio is certified under the EU-U.S. Data Privacy Framework and its UK extension.

14Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict how we use it, to receive it in a portable format, and to object to processing based on our legitimate interests. Email support@veolan.com and we will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in Spain, the Agencia Española de Protección de Datos (aepd.es); elsewhere in the EU, the authority where you live.

15Children

Veolan is not meant for anyone under 16, and we don’t knowingly hold data about children under 16. If you think a child has given us their data, email support@veolan.com and we will delete it.

16Changes to this policy

When this policy changes, we will update this page and the date below. If a change affects what we collect or how we use it in a significant way, we will tell account holders by email before it applies.