Veydan Privacy Policy

#1. Scope and Data Controller

Rookbeam Technologies LLC (United States; the “Company,” “we,” “us,” or “our”) is responsible for processing personal information in the course of its own operations and the Veydan services it operates. For privacy inquiries, contact hello@veydan.net.

Veydan supports local storage and the use of infrastructure you choose. Running the app locally does not, by itself, mean that all of its data is sent to us. This Policy describes the data we may receive when you use our services or contact us.

We do not operate the independent servers, storage services, and external services you use. Their owners, operators, and administrators are responsible for their own actions and compliance with applicable law within the scope of the functions they actually perform. Their role in data processing depends on what they actually do and the applicable law.

Compatibility with Veydan does not make an independent operator our representative. We have no administrative access to servers that operate independently of us and cannot change their rules, provide access to their data, or force the deletion of that data. Providers we engage to operate our own services are distinct from these user-selected servers and are covered in Section 8.

#2. Data on Your Device

Messages, contacts, notes, passwords, files, settings, and keys may be stored on your device. Local storage does not give us remote access to that data.

Not all local data is protected by app-level encryption. Protection for files, databases, caches, exports, and backups depends on the product, the type of data, and the app and operating system settings. An app lock, a screen lock, and disk encryption are different protections. Enabling one does not, by itself, guarantee that the others are in place.

If your device is not locked and its storage is not properly protected, someone with access to the device may be able to access local data. You are responsible for controlling access to your device, safeguarding your keys, configuring security settings, and managing exports and backups. We do not administer your device. You manage, delete, back up, and restore local files using the tools available on your device and in the app. This does not exclude any obligations concerning the security of our own products that cannot be excluded under applicable law.

If you use synchronization through a folder, S3, or WebDAV as provided by Notes, Pass, or Space, the data is sent to the storage you choose. This synchronization data is encrypted on your device before it is sent to that storage. This does not mean that the original local files are protected by the same encryption. This type of synchronization is not, by itself, a Cloud service.

#3. Identity, Content, and Veydan Cloud

A chat identity uses an npub public key. Creating one does not require your real name, phone number, email address, or date of birth. A public key is not the same as your legal identity, but it may relate to a particular person when combined with other information.

When you create a chat identity using Veydan servers, a free Cloud account is created. To provide the service, we process your public identifier, account status, plan and activation information, quotas, and information about service operations.

Veydan Cloud provides synchronization across devices and temporary storage of encrypted files. It is not a substitute for permanently storing original files or keeping backups. Media and other objects are stored under the terms of your selected plan. A Cloud account is not automatically deleted solely because of inactivity; retention periods for individual objects are determined separately.

We do not hold your private keys or the keys we would need to decrypt end-to-end encrypted content ourselves. We cannot read this content on our servers. Content is decrypted on the devices of users who have the appropriate keys. In conversations and groups, recipients and authorized participants may hold those keys.

Receiving, transmitting, and storing encrypted objects are still technical data operations. The inability to access the content does not mean that encrypted objects, identifiers, and other technical information needed to operate the service are not processed.

#4. Messages, Calls, Notifications, and Public Information

Servers transmit protected messages without us decrypting them. Operating the network may involve processing the connecting party's network address, request and object identifiers, public information defined by the protocol, timestamps, transfer sizes, and transfer outcomes. The specific data depends on the feature and the route selected. Information received while handling a connection is not necessarily retained in a long-term log.

Calls require an exchange of technical connection information. Depending on the connection method, network addresses may be visible to other participants and to servers involved in establishing or relaying the connection. Independent server operators set their own rules for processing the technical information available to them.

If notifications are enabled, a device identifier or push token may be used to deliver them. In Android builds that use the relevant notification mechanism, Google services participate in delivery. If you use Veydan Push with an independent server, we may receive that server's identifier or address and information about the notification delivery request. Choosing an independent relay does not, by itself, mean that other enabled features also stop using our infrastructure.

Public information in a profile, directory, or protocol event is available according to the purpose of the feature and your choices. Product settings determine whether presence, last-seen status, and read receipts are displayed. Information published openly, and copies already received by participants, may be retained by them outside our control.

If you send messages to an external service or bot, or grant it access as a participant, its operator may receive the corresponding content within the scope of the access you grant. End-to-end encryption does not prevent a recipient from saving or sharing data they have already received.

#5. Reports and Support

When you contact us, you provide the information you choose to include: a description of the situation, identifiers, contact information for a reply, and any attachments. Our staff may be able to read copies of specific messages submitted with a report. This does not involve sharing your private key or giving us access to the rest of your conversations.

Messages, including those written by other participants, may be attached to a report submitted from the app. In existing versions, the option to attach conversation content may be preselected when you report a specific message. Before sending a report, review the materials to be included and the available attachment settings. We receive the materials included in the report you submit; filing a report does not give us unrestricted access to the chat.

We use submitted materials to handle your inquiry or report, take protective measures, reconsider decisions, and meet related legal obligations. We request additional data only when necessary for these purposes. Illegal images or videos depicting child sexual abuse must not be sent through regular email; our Child Safety Standards explain how to report them.

#6. Website, Payments, and External Connections

When you use the website or servers we operate, we may process your IP address or the address of an intermediary node, technical information about your browser, device, and request, error and security logs, and session data needed for the website features you choose.

When you purchase a plan or use an activation code, we process the information needed to verify your authorization, link the purchase or activation to your Cloud account, validate the payment or code, and track the plan's term and status. The payment provider processes information according to its role and payment terms. This Policy does not mean that we receive all the details you enter through a payment provider.

Cloud payments are made through the official website. Whether activation by code is available depends on the method we provide and the product version.

When you use the built-in browser, a proxy, SSH, external storage, or other connections, information is sent to the recipients you choose according to your settings and the purpose of the connection. Processing outside our services is governed by the relevant operators' policies.

#7. Technical Purposes and Legal Bases

Data is transmitted over a network, which requires processing requests and operational information. We use the data we actually receive for the following purposes:

We do not treat legitimate interest as an unrestricted basis for all processing. Where consent is required, you are given the relevant choice. You may withdraw consent to optional processing; doing so does not affect the lawfulness of processing that took place before withdrawal. The specific legal basis depends on the nature of the operation and applicable law.

These purposes do not give us the technical ability to decrypt protected content.

#8. Access, Recipients, and Data Transfers

Our access is limited to the information we actually hold. Authorized staff are granted access as needed for a specific work task. This may include technical information, accounts, plans, payment statuses, and materials submitted with inquiries or reports. Server administrator privileges do not provide the keys needed to decrypt protected content.

We may use providers of server infrastructure, network security, notification delivery, and payment processing to deliver our services. They receive the data necessary for the functions they actually perform. Their obligations are governed by applicable law and the relevant contractual arrangements. Hosting an encrypted object does not, by itself, provide access to its content in readable form.

We do not sell personal information to advertisers. Cross-border transfers comply with applicable requirements for the legal basis and safeguards for those transfers.

We disclose information to government authorities and other authorized recipients only when there is a valid legal basis, and only within the scope of the relevant request and the data we actually hold. We verify the requesting party's authority and whether the request applies, and may seek clarification or challenge it through lawful means. A request cannot create keys we do not have, enable us to decrypt protected content, or recover data that no longer exists. Learn more: Law Enforcement Requests.

#9. Retention and Deletion

The retention period depends on the type of data and the purpose for which it is stored:

Storage periods or more specific criteria for temporary storage under the selected service and plan must be available to you before you use or pay for that service. The fact that an inactive account is not deleted does not mean that every object will be retained indefinitely.

Certain data is retained longer if required by law or a valid preservation request. Special rules and periods may apply to materials related to reports of child sexual exploitation. These exceptions do not provide a basis for retaining all account data indefinitely.

Account deletion is explained in Cloud Account Deletion. We can delete an encrypted object under our control without decrypting it. We cannot guarantee the deletion of copies held on independent servers or other users' devices. Data in system backups is removed according to the applicable cleanup cycle, subject to mandatory preservation requirements.

#10. Your Rights and Technical Limits on Fulfilling Requests

Where provided by applicable law, you may request access to your personal information, correction, deletion, portability, or restriction of processing; object to processing; withdraw consent to processing based on consent; or contact the relevant supervisory authority. Each right, and the conditions for exercising it, is governed by the applicable law.

These rights apply to data we process. We cannot decrypt protected conversations to fulfill a request, recover a missing key, or freely modify the contents of an encrypted file. This limitation does not apply to separate copies or information we have already received in readable form, including through an inquiry or report; disclosure of those materials is considered in light of applicable law and the rights of others. The absence of keys also does not prevent us from taking action on technical information, an account, or encrypted objects that can be deleted, when the action is supported and lawful.

Send requests to hello@veydan.net. We may ask for proportionate evidence that you are authorized to act in relation to the specific data. An npub public key or an email from an address not previously linked to the account does not, by itself, establish account ownership. We never ask you to send us your private key or recovery phrase.

If the information available to us is insufficient to securely match the request to the correct account or data, we will explain the difficulty and consider additional information you provide in accordance with applicable law. Where permitted by law, we are not required to collect new information about your real-world identity solely to be able to identify you. An inability to verify one request does not automatically mean that we will deny requests relating to other data whose connection to you has been established.

You control local data on your devices. Direct requests concerning independent operators to those operators. We respond to requests, including providing reasons for any denial, within the time limits set by applicable law.

#11. Minors' Data

When processing minors' data, we comply with applicable age requirements and requirements for the involvement of legal representatives. If information was received in violation of those requirements, we review the inquiry or report in light of applicable law and the data actually available to us.

For privacy inquiries: hello@veydan.net. To report child exploitation or a threat to a child's safety: childsafety@veydan.net. Learn more: Child Safety Standards.

#12. Changes to This Policy

We publish the current version on the official Veydan website with its date. If applicable law requires a separate notice of changes or renewed consent, we comply with that requirement. Changing the text of this Policy does not, by itself, constitute your consent to processing that requires separate consent.

© 2026 Rookbeam Technologies LLC.