Privacy Policy

Policy version 1.2 · Last updated: September 22, 2026

Vellure Chat ("Vellure", "we") is a free, anonymous, adults-only text chat. This page explains in plain language what we collect, why, who helps us run the service, and what you can do about it. We do not sell personal information, and we do not share chat content with third parties except as required by law or to protect someone's safety.

Who this is for

Vellure is for people who are 18 or older. Before you can chat, you enter a date of birth on a neutral screen. We check it on our server and do not store it. All we keep is the fact that you confirmed you are 18 or older. If someone is refused, we remember that in a short-lived cookie for 24 hours so the screen cannot simply be retried. If we learn that someone is under 18, we may suspend or delete their account.

Information we collect

• Guests: if you chat without an account, we give your browser a random guest ID and a made-up name. They live in a signed session cookie that lapses about 30 minutes after your last visit (the page renews it while it is open). No name, email or profile is needed.
• Accounts (optional): a username and a password, which we store only as a salted hash and never in readable form. An email address is optional; we use it for password-reset emails and to help with account problems you ask us about.
• Profile (optional): a bio, city, birthday (only if you choose to enter it), gender, favorite song and profile photo. Your profile photo, bio, city, favorite song and birthday (if you enter one) are shown on your public profile page, which anyone with the link can open (we ask search engines not to list it). The month and year you joined are also shown on your public profile page. Your gender and email are never shown.
• Account records we keep about you: when you confirmed you are 18 or older, your last-seen time, your last IP address and country (kept on our servers only, never shown to other users), the people you follow, and login tokens for the mobile app (stored hashed).
• Messages and photos: messages you send are stored on our servers so a conversation can be shown again when you reopen it. Photos are optional; you can turn sending and receiving them off in Settings. Photos sent in chats are stored privately and are only served to the two people in that conversation.
• Blocks and reports: who you block, and reports you file (see below).
• Feedback: if you use the feedback form, we store what you wrote, the category, the page you were on and your identity key (the guest ID or account it was sent from).
• Consent choices: your cookie-banner choice and when you made it.

IP addresses

We process IP addresses to apply rate limits, to detect and prevent abuse, and to work out an approximate country. The country lookup uses a database on our own servers, so your IP address is not sent to anyone else for that. When you block a guest, that guest's IP address is stored for 48 hours so the block stays effective.

How we use information

• To run the chat: sign you in, deliver messages and photos, and show your profile where you chose to share it.
• To keep people safe: apply rate limits, review reports, and act on accounts or content that break our Community Guidelines.
• To send password-reset emails, and to answer requests you send us.
• To read and act on feedback.

Legal basis for processing (EEA/UK visitors)

If you are in the European Economic Area or the UK, the law there requires us to say which legal basis we rely on for each way we use your information:

• Performance of a contract - creating and running your guest session or account, delivering messages and photos, and showing your profile where you chose to share it.
• Legitimate interests - keeping the service secure and working (rate limits, abuse prevention, approximate country lookups), reviewing reports, and reading feedback - interests we think are reasonably balanced against your rights, since they are about keeping the service usable and safe rather than about profiling you.
• Consent - any optional cookie we might add in future (see Cookies and browser storage below); nothing today needs this basis, since no optional cookies are currently used.
• Legal obligation - keeping records we are required to keep, and responding to a lawful request from an authority.

Blocking and reporting

Anyone can block someone; the blocked person is not told. Anyone can report a person who messaged them, choosing a reason and adding optional details. A report stores a copy of the most recent messages of that conversation as evidence, and we review it. Reports are kept for safety reasons. If you delete your account, reports you filed keep their content but lose the link to you, and reports filed about you are kept.

Cookies and browser storage

We only use what the site needs to work:

• a signed session cookie (your guest session or your login);
• a CSRF token that protects forms against forgery;
• a cookie that remembers your cookie-banner choice;
• a 24-hour cookie set if the age check was refused;
• local browser storage for your light/dark theme, and for a guest marker that lets us tell a guest their session has expired.

There are no advertising cookies, no analytics and no tracking pixels today. Optional cookies are off by default and none are currently used. If we ever add any, they will stay off until you turn them on, and you can change your choice any time from Settings.

Do Not Track: some browsers send a "Do Not Track" signal. There is no common standard for how a site should respond to it, so like most sites we do not currently respond to it differently - though as the Cookies section above says, we do not track you across other sites either way.

Who processes data for us

We do not sell personal information. These service providers process data on our behalf:

• Render hosts the application (United States).
• Neon hosts the database (US East).
• Cloudflare provides DNS, CDN and security proxying, and R2 file storage for photos.
• Resend sends password-reset emails.
• UptimeRobot checks that a public page of the site is up. It sees no user data.

We may also disclose information when the law requires it, or when it is needed to protect someone's safety, for example in a report to child-protection authorities.

International data transfers

Vellure is run from Canada, and the providers listed above are based in, or process data in, the United States. If you are in the European Economic Area, the UK, or another country with its own data-transfer rules, this means your information leaves your country and is processed somewhere with different privacy laws. We choose established providers who publish their own security and compliance information, and we limit what we send them to what each one needs to do its job (for example, UptimeRobot only ever sees that a public page responds, never your account data).

How long we keep things

• Guest conversations: a guest's chats become unreachable to that guest once the session ends. We do not yet delete them automatically. Today they are kept unless we remove them for safety reasons.
• Accounts: kept until you delete your account.
• Reports: kept for safety reasons, including after the reported or reporting account is deleted (see above).
• Blocked guest IP addresses: 48 hours.
• Age-refusal cookie: 24 hours.

Deleting your account

You can delete your account yourself in Settings (or from the mobile app). Deleting removes your profile, email, profile photo, follows, login tokens, blocks, consent and feedback records, and every conversation you were part of, including the other person's copy and any photos in those conversations. Copies may remain in our hosting providers' backups and logs until those age out. See how account deletion works.

Your rights and choices

You can view and update your profile in Settings and delete your account there. For anything else, such as a copy of your information, a correction, or a question about how your data is handled, email [email protected]. We aim to reply within 30 days.

Depending on where you live, privacy laws may give you rights over your personal information. In Canada this includes rights under PIPEDA to access your information, ask for corrections and withdraw consent, and to complain to the Office of the Privacy Commissioner of Canada. In the European Economic Area and the United Kingdom (GDPR and UK GDPR) and in California (CCPA) you may have similar rights, such as access, correction, deletion and objection, and a right to complain to your local regulator. We will handle requests as those laws require.

California privacy rights

If you are a California resident, the CCPA (as amended by the CPRA) gives you these rights over the personal information we hold about you, in addition to what's described above: to know what we collect and why (see Information we collect above), to delete it, to correct it, and to know whether we "sell" or "share" it. We do not sell personal information, and we do not share it for cross-context behavioral advertising - so there is no "Do Not Sell or Share My Personal Information" link on this site, because there is nothing to opt out of. We do not use or disclose sensitive personal information for any purpose beyond what is needed to run the service. We will not discriminate against you (for example, by degrading the service) for exercising any of these rights. To exercise them, email [email protected]; we will verify your request using your account or the information you can access from it before acting on it.

Separately, California's "Shine the Light" law lets California residents ask, once a year and free of charge, what personal information we shared with third parties for their own direct marketing use in the prior year. We do not share personal information for third parties' direct marketing, so there is nothing to disclose in response to such a request, but you are welcome to send one to the email above.

Other U.S. state privacy rights

Residents of several other U.S. states (including Colorado, Connecticut, Nevada, Oregon, Texas, Utah and Virginia) have privacy laws that give broadly similar rights: to know, access, correct, delete and (outside of what we already don't do - sell information or use it for targeted advertising) opt out. You can exercise any of these the same way as above: email [email protected].

Automated decision-making

We do not use your personal information to make decisions that have a legal or similarly significant effect on you (for example, decisions made solely by an algorithm with no human involvement). Actions like suspending an account for breaking the rules are made or reviewed by a person, based on a report or evidence, not by automated profiling.

Data breach notification

If a breach of security happens that puts your personal information at risk, we will notify affected users and the relevant authorities as required by the laws that apply to us, without undue delay.

Marketing communications

We do not currently send marketing emails. If we ever do, they will be optional, clearly identified, unsubscribe-able with one click, and separate from the account emails (like password resets) you cannot opt out of while keeping your account.

Security

We use HTTPS, store passwords only as salted hashes, apply rate limits and protect forms against cross-site request forgery. No system is perfectly secure, so we cannot promise absolute security.

Children

Vellure is not for anyone under 18, and we do not knowingly collect information from them. If you believe someone under 18 is using Vellure, please report them in the chat or email [email protected]. See our Child Safety Standards.

Changes to this policy

The version number and date at the top identify which policy was in effect at a given time. When we make a material change, we will update them here.

Contact

Privacy questions and requests: [email protected].

← Back to chat · Terms of Use · Community Guidelines