How I store, protect, and delete your data.

You own everything you put into Velo: proposals, invoices, project history, client records, time entries. I don't use your data for any purpose other than running the platform you signed up for. No training, no third-party analytics on the contents of your work, no sale to advertisers.

You can export all your proposals, invoices, and client records as CSV at any time from your account settings. Your data is never locked in.

If you delete your account, every record I hold for you is permanently removed within 30 days. That includes backups and the identifier I use to link your records together.

Every shared proposal is reached through a unique, cryptographic share token tied to that one proposal. The link can't be guessed or reused on another record, and abuse is rate-limited at the edge.

Clients now sign in to a free Velo account to view and approve, so every approval is logged against a verified email address with a timestamp. That trail is consistent with Australia's Electronic Transactions Act 1999. For high-value engagements I still recommend a separate signed contract.

Connections to Velo run over TLS, so every byte of data in transit between your browser and the servers is encrypted. At rest, your records live in a fully cloud-based, serverless PostgreSQL database in Australia with disk-level encryption.

The application itself runs on a globally distributed edge platform, fronted by a dedicated authentication provider. Session tokens are HttpOnly cookies, scoped to the Velo domain, with the standard set of CSRF and SameSite protections.

You can delete your account from Settings at any time. Deletion purges your records from the database and your auth provider, and all associated data is permanently removed within 30 days. I don't hold a shadow copy.

Found a security bug? Email jaineelk.dev@gmail.com with the details and a way to reach you. Don't share specifics on public channels until I've had a chance to fix the issue and tell the affected users.