Privacy policy

Who runs Velin

Velin is made and run by Fossa, a business in the United States ("we"). Velin is independent software, not affiliated with or endorsed by Roblox Corporation. Write to support@occlara.app with any question about this policy.

What stays on your PC

Velin keeps its data in %LOCALAPPDATA%\Velin, for your Windows account only:

• Your settings, graphics profiles, game library (with any notes you write) and cosmetic packs.
• A history of your play sessions, read from Roblox's own log files: for each visit, the experience, place and server ids, when it started and ended, and, when the log names it, the id of the Roblox account that played. Velin keeps the newest 20,000 visits. You can turn this off, or clear it, in Settings, Privacy.
• The Roblox accounts Velin has seen play on this PC, or that you signed in with, in accounts.json: each account's id, username, display name and picture address, when you signed in with it, and when Velin first and last saw it play. Velin never adds an account from a username. Velin keeps up to 20, and the ids of up to 50 accounts you removed, so their old log lines do not add them back.
• Your Roblox friends, in roblox-friends.json: for up to 20 of your accounts, each friend's id, username, display name and picture address, and when Velin looked them up. Where your friends are is never saved.
• Copies of game art and of the pictures on game pages, of Marketplace and group pictures, of your accounts' pictures and avatars, of your friends' pictures, and of the Velin profile pictures and banners you see; a copy of Roblox Player if you let Velin install one; and the lists Home shows as Trending, with the random id Velin uses for them (below).
• With Velin Pro, your own thumbnails for launch profiles and games, in thumbnails.json and as new pictures Velin makes from the ones you choose, without their metadata, and the games you chose for your profile, in profile-games.json.
• Saved private server links, your guides and checklists, and backups of the Roblox files Velin changes: its settings files, and the files a cursor, death sound, font or sky you choose replaces.
• One Velin session for each Roblox account you sign in with (up to 10) in account.dat, encrypted by Windows for your Windows account (DPAPI), with that account's Roblox id, when you signed in, and whether it had Velin Pro when Velin last asked. Signing out of an account deletes its session.
• Small error files. They can hold folder paths, which can include your Windows user name.

Velin never uploads these files. Clearing your play history in Settings, Privacy does not remove the accounts list or the pictures: sign out of an account in the account menu, or close Velin and delete that folder to remove everything. Uninstalling Velin leaves the folder in place.

What Velin reads on your PC

• Roblox's own log files, from the last day, to see which experience you joined, when you left, which Roblox account played, and which game server you are on. Velin keeps the ids and times, never the log text. It keeps the game server's address only in memory while you play, never saves it or passes it on, and finds the server's city in a table that comes with Velin, without asking anyone, to show it under the Velin mark, on Home and in a notification you can turn off. With play tracking off in Settings, Privacy, Velin reads no log.
• Roblox's settings files, to show and apply your graphics profile, and the Roblox files a cursor, death sound, font or sky you choose replaces, which Velin backs up first and puts back when you remove it.
• Whether Roblox is running, and where its window is and whether it is in front, so the guide overlay and the Velin mark can sit on it and AFK mode can find it. The Velin mark is a small window Velin draws over a corner of Roblox's window. It is on at first, you can turn it off in Settings, and it shows in your screen recordings.
• While the Velin mark's frame rate line is on, which it is not at first, and Roblox runs, Windows' own event tracing tells Velin when each program on your PC shows a new frame. Velin counts only Roblox's, to show its frame rate, and keeps nothing else. The first time, Velin asks Windows, with an administrator prompt, to add your Windows account to the Performance Log Users group, which this needs. Velin leaves it there, and you can remove it in Windows.
• While AFK mode is on, how long it has been since you last touched the keyboard or mouse. Velin never reads which keys you press.
• Your processor's name and which Roblox launchers are installed, to show them in Velin.

Velin does not read the game's memory or inject anything into Roblox, and it opens your other files only when you pick them, such as a pack to import or a picture.

What goes to Roblox

Velin talks to Roblox's public web services from your PC, without your Roblox cookies and without signing in to Roblox. Like any request on the web, each one shows Roblox your IP address. Velin asks Roblox for:

• The names, icons and pictures of the games in your library, your favorites, your recent games and the games Home shows, up to ten pictures of a game when you open its page, and an hourly check for game updates, which you can turn off in Settings.
• Home's Trending and Popular lists, with a random id Velin made for these lists and keeps on your PC, and, for the games Velin suggests, the ids of up to three games you play most. Nothing else about you is sent for these lists.
• A game's description, creator and group, when you open its page, and the groups behind your library's games.
• In Market, what you search for, with the category, creator, price and order you pick, and an item's details and pictures when you open it.
• Your Roblox friends, for the Roblox account Velin shows as yours: its friends list every ten minutes, each friend's username, display name and picture about once a day, and once a minute whether each friend is offline, online, in a game or in Studio, and which game when Roblox says. Velin asks only while its window is showing.
• The names and pictures of the Roblox accounts in your accounts list, when Velin first sees one and then about once a day.
• While the Velin mark's ping line is on, which it is not at first, a small network echo (a ping) every two seconds to the game server you are playing on.
• The current version of Roblox Player and its files, when Velin checks for or installs its own copy.

What Roblox does with these requests is covered by the Roblox Privacy and Cookie Policy.

Other services Velin talks to

• The Velin service, which we run: for Velin friends and Velin Pro once you sign in (below), the sponsor card on Home, your avatar in 3D, a game's social links and app updates. The sponsor card, the 3D avatar, the links and the update check send no session, cookie or id of yours. A 3D avatar request names only the Roblox account whose avatar is shown, the account Velin shows as yours. Velin asks for a game's links, which the service reads from Roblox, only while you are signed in, and the request names only the game.
• Stripe, only when you buy or manage Velin Pro. Velin opens Stripe's own checkout or billing page in your web browser and you pay there, so Velin never sees your card. Stripe handles the payment under its own privacy policy.
• Trello, only when you add or refresh a guide from a public Trello board. Velin uses no Trello account and never writes to Trello.
• Discord, only if you turn on Discord status in Settings, which is off at first. Velin tells the Discord app on your PC what you are playing, over a connection that stays on your PC: the game's name and creator, when you started, its icon and a link to it on Roblox. Discord then shows it under its own privacy policy.
• Your web browser, for signing in and for links you open, such as a sponsor's site, a game's page or a game's social links, which open exactly as the game's creator set them.
• Microsoft: Velin's window is drawn by Microsoft Edge WebView2, part of Windows, which follows your Windows settings for Microsoft's own services, such as diagnostic data. Velin stops its window from loading anything from the internet.

Sign in with Roblox

Velin friends, your Velin profile and Velin Pro need a Velin account, which you make by signing in with Roblox. Your Roblox friends show in Velin without one. You sign in on Roblox's own page in your browser, so Velin never sees your password. Velin asks Roblox for two permissions only, openid and profile: your Roblox account id and your public profile, such as your username, display name and avatar picture.

The Velin service keeps your account id, username, display name and avatar picture. Roblox also returns tokens that could call Roblox for you: the service throws them away unread, so Velin can never act on your Roblox account. Velin then gives your PC a Velin session of its own, kept encrypted on your PC and stored on the service only as a one-way hash. If you sign in with more than one Roblox account, Velin keeps a session for each and asks the service whether any of them has Velin Pro under each account's own session in turn, so the service can see that those accounts are used on one PC. If Roblox refuses a sign-in, Velin reads Roblox's reason only to tell you in plain words, and never keeps it.

What the Velin service stores, and why

Only after you sign in or buy Velin Pro, and only what your friends are shown and what a purchase needs:

• Your account: your Roblox account id, username, display name and avatar picture (read again from Roblox about once a day), when you joined Velin and when you were last seen.
• Your favorites, only while Show favorites is on: your ten most played favorite games, or, with Velin Pro, up to ten games you chose for your profile, each by its Roblox id alone, in order.
• Your playtime, only while Show playtime is on: the time on each of those games and your total playtime.
• Your presence: while you are signed in and Velin runs, even in the tray, Velin tells the service once a minute that you are online and, only while Show what I am playing is on, the Roblox id of the game you are in. You show as offline two and a half minutes after the last update, and signing out clears it at once.
• Your Velin look: a built-in pack's name, colors and scene, or, for a theme of your own, only its two colors.
• Your profile picture and banner, with Velin Pro, only if you upload them. The service checks each picture, turns it upright, crops it and keeps only a new picture made from its pixels, 512 by 512 or 1500 by 500, without the original file's camera details, location, color profile or comments.
• Your friends, friend requests and blocks, and your privacy choices.
• Your Velin Pro purchases: Stripe's ids for each purchase, its plan, whether it is active, its dates, and the Roblox account it belongs to. For a code bought on the website, only a one-way hash of the code. Never anything about your card. The service also keeps the ids of Stripe's notices about purchases for 30 days, so none is handled twice.
• Your sessions: a one-way hash of each session, the label "Velin for Windows", and when it was made and last used. A session ends 90 days after its last use, and you can have 10.

Velin sends only what you show. When you turn a switch off, the service deletes what it held for it at once. With your profile set to Only me, Velin sends nothing about your games, your presence or your look. A profile picture or banner is sent only when you upload one. The service stores no game names, places or pictures, no session counts, no email address, no password and no Roblox token.

To mark which of your Roblox friends use Velin, while you are signed in and the Roblox account Velin shows as yours is the one you signed in with, Velin sends the service the ids of up to 1000 of that account's Roblox friends. The service checks them against that account's public friends list, which it reads from Roblox and keeps only in memory for ten minutes, and stores neither.

Who can see what

Your Velin profile is shown only to people signed in to Velin, never on a public web page. In Friends, Your profile, you choose:

• Friends, the setting a new account starts with: friends see your profile, and others see your name and avatar.
• Everyone: anyone on Velin can find you and see your profile.
• Only me: friends see only your name and avatar, and nobody else can find you.

Your profile shows whether you are online. It can also show your playtime, your current game and your favorites, and each of those has its own switch: what is off is not sent. A block hides the two of you from each other. A custom theme's name is never sent.

With Velin Pro, a Pro badge shows wherever your profile's details show, and so do your own picture and banner, in place of your Roblox picture and your pack's banner, to others only while you have Pro. With Only me, nobody else sees them.

Your Roblox friends who are signed in to Velin see a Velin mark beside you in their friends list, and a Pro badge if you have Pro, unless you choose Only me. Turn off Let my Roblox friends see I use Velin, which is on at first, or choose Only me, and the service tells nobody. It tells only people on your Roblox friends list, and never someone you blocked or who blocked you.

Logs and limits

The Velin service's request log records your IP address, the address asked for, the answer and the time. That address can hold a Velin user id, or the name you searched for. The log never holds your session, what you send in a request, or Roblox's sign-in codes. Requests for the sponsor card, 3D avatars, game links, app updates, downloads, these web pages, Velin Pro's checkout and the pages Stripe sends you back to, and Stripe's notices to the service write no request log line at all.

To stop abuse, the service counts requests for each IP address or account in memory, for one minute. Logs are kept by our hosting provider and deleted under its log retention schedule.

What Velin never collects

• Your Roblox password or cookies, or any Roblox token that could act for you.
• Your email address, real name, phone number or home address. When you buy Velin Pro, Stripe asks on its own pages for what a payment needs, such as your email address, and the Velin service does not keep it.
• Your card details: you pay on Stripe's pages, never in Velin.
• Your keystrokes, screen, microphone, camera or chat.
• The game's memory, or anything from inside Roblox while it runs.
• Your contacts, your browser's data, or files you did not choose.
• Analytics, telemetry, crash reports, advertising ids or device fingerprints. Velin counts no sponsor views or clicks, and adds nothing to a sponsor's link.

We do not sell your data, and we do not share it for advertising.

Who we share data with

• Other people on Velin, as your privacy settings allow.
• Our hosting provider, which runs the Velin service and stores its database, the profile pictures and banners members upload, and its logs for us, in the United States or another country.
• Stripe, which processes Velin Pro payments for us. When you buy Velin Pro in Velin, the service gives Stripe your Roblox account id with the purchase, so Pro goes to the right account.
• Roblox, which the service asks for the public friends list of the Roblox account you signed in with, to mark which of your Roblox friends use Velin.
• Nobody else, unless the law requires it, such as a valid court order, or to protect someone from harm.

Requests Velin makes to Roblox, Trello and Discord go straight from your PC, as described above, and you pay Stripe on its own pages.

Retention and deletion

• On your PC: until you clear it. Settings, Privacy clears your play history; removing an account in the account menu removes it and its pictures (a 3D avatar Velin saved for it goes the next time you save the avatar settings); deleting %LOCALAPPDATA%\Velin removes everything. Signing out deletes your session and the pictures of Velin profiles Velin saved. Your Roblox friends' list and pictures need no sign-in and stay; the list of an account you removed goes the next time Velin saves the list.
• On the service: what a switch shares, until you turn it off; the rest for as long as you have a Velin account. Delete it in Velin under Friends, Your profile, Delete account, and your account, favorites, playtime, presence, profile picture and banner, friends, requests, blocks and sessions are deleted from the service at once. Signing out alone keeps your account. Accounts are not deleted for being unused. You can remove your profile picture or banner at any time, with Pro or without, and we may remove one that breaks the terms of service.
• Purchases: kept when you delete your Velin account, because Velin Pro belongs to your Roblox account and comes back when you sign in again, and because we keep purchase records for tax and accounting. Stripe keeps the payment itself under its own policy.
• Logs: as long as our hosting provider keeps them, as above.

You can also write to support@occlara.app to ask for a copy of your data, a correction or its deletion. We may ask you to show that the account is yours.

Children

Velin's online features are for people 13 and older. Signing in uses Roblox's sign-in for apps, which Roblox allows only for accounts of people 13 and older, and Velin's sign-in screen says so. Without signing in, Velin keeps everything on the PC. We do not knowingly keep data about children under 13: if you think a child under 13 has a Velin account, write to us and we will delete it.

Security

Velin reaches the Velin service over HTTPS. Sessions and licence codes are stored on the service only as one-way hashes, your session on your PC is encrypted by Windows, and no session, code or key is ever written to a log. Velin keeps as little as it can, because data that is not kept cannot leak. No system is perfectly secure: if we learn of a breach that affects your data, we will say so in Velin and on this site.

Changes to this policy

We will post any change here with a new date. If a change means Velin collects or shares more, we will say so in Velin before it applies.

Contact

Fossa, support@occlara.app. See also the terms of service.