Last updated: 22 August 2026
Veluna is a private, local-first app for couples. Your content lives on your own devices, encrypted, and we can never read it. This policy explains exactly what the app does and does not do with your data.
The two phones agree on a shared secret using an X25519 key exchange. The secret itself is never transmitted — each phone sends only its public half, and both compute the same result independently. Nobody who observes the exchange (us included) can derive it.
When you pair in person, the QR code carries that public half. When you pair remotely, the two phones meet at a temporary address on our relay and both then display the same six-digit code for you to compare out loud. That comparison is what rules out anyone interposing themselves; the relay never learns the secret either way.
Two services are involved, and neither can read your content.
A small service we run on our own hardware. It forwards sealed data between your two phones when they cannot reach each other directly — updates, and photos you have shared with your partner — and it routes push "wake" signals. Everything it holds is AES-256-GCM ciphertext for which it has no key.
To do this it necessarily sees some technical information: a one-way pair ID derived from your pairing secret (it cannot be reversed to reveal the secret or your identity), random per-installation device IDs, the size and timing of transfers, and the IP addresses your phones connect from. It never sees your content, your pairing secret, or anything identifying you as a person.
Our relay is reached through Cloudflare, which operates the network connection. Cloudflare therefore also sees that technical information — connection metadata — but likewise never your content.
Apple Push Notification service and Firebase Cloud Messaging are used only to wake your partner's app or show them an alert:
The app remains fully functional while your two phones are on the same network, even if these services are unavailable.
You can create an optional encrypted backup file, protected with AES-256-GCM using a password you choose (derived with PBKDF2, 600,000 iterations). You decide where it is saved; we never receive it. It deliberately does not contain your pairing secret. If you lose the password, the backup cannot be recovered.
Your content is stored on your device, so you can delete it at any time from within the app or by uninstalling it. There is no readable server-side copy for us to delete.
The sealed data our relay holds is transient by design:
Veluna is intended for adults (18+) and is not directed at children.
Settings → Send feedback composes an email and hands it to your own mail app. Veluna does not send it and keeps no copy — nothing leaves the app until you tap send in your mail client. Alongside your message the mail carries three technical lines, shown to you in full beforehand: the app version, your device's operating system version, and the language the app is displayed in. No names, photos, cards or any other content is attached.
We may update this policy; the "last updated" date above reflects the latest version.
Questions about privacy? Contact: info.schindi@bluewin.ch