Privacy Policy
Last updated: September 2026
Velocity Text Expander ("Velocity", "we", "our", or "us") provides a cross-browser text expansion extension. This Privacy Policy describes what data we collect, how it is handled, and your rights as a user.
1. What We Collect
Device-local data (never leaves your device)
Velocity operates local-first by default. With no account, all snippet data is stored exclusively in your browser's IndexedDB (via Dexie), which is private to your device. The extension collects and transmits nothing until you opt in to Encrypted Sync.
The following are stored in chrome.storage.local / browser.storage.local and never sent to any server:
- Your snippet triggers and bodies (IndexedDB)
- Debounce and shortcut preferences
- Sync state flags (
sync_enabled,last_sync_ts)
If you enable Encrypted Sync (optional)
When you opt in to sync, the following is transmitted to Supabase (our infrastructure provider):
| Data | How stored |
|---|---|
| Email address (auth only) | Plaintext in Supabase Auth |
| Snippet triggers | Plaintext in Supabase (deliberate — required for query performance; documented design decision) |
| Snippet bodies | AES-GCM encrypted before leaving your device. We cannot decrypt them. |
| Encryption key metadata | Two-layer key wrap (PBKDF2 + AES-GCM). Your password and recovery codes never leave your device. |
We do not store your encryption password or recovery codes.
Website contact form
The public form at velocityexpander.com/contact is a drop-box, separate from the extension. If you submit it (including while logged out of the extension, or with no account), we store on Supabase:
- your message
- optional email address
- the consents you checked (
read_ok,contact_ok) - user agent (spam context only)
Legal basis: consent. This is not telemetry, analytics, or crash reporting. It is not snippet data and is not end-to-end encrypted (E2EE applies to snippet bodies in Encrypted Sync only). Submissions are not tied to a Velocity user id. Deleting a Velocity account does not wipe anonymous contact-form rows. To delete a submission, email privacy@rpuvvula.com.
2. Subprocessors
We use the following third-party subprocessors:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Supabase, Inc. | Authentication, encrypted snippet storage, and website contact-form storage | supabase.com/privacy |
| Vercel, Inc. | Hosting of this website and marketing pages | vercel.com/legal/privacy-policy |
| Stripe, Inc. | Payment processing (future billing — see §4) | stripe.com/privacy |
We do not use any analytics services, advertising networks, or data brokers. We have no deals to share or sell user data.
3. No Tracking or Telemetry
Velocity collects zero usage telemetry.
- No page views or event logging
- No crash reporting that leaves your device
- No heatmaps, session recordings, or A/B testing
- No third-party tracking pixels or SDKs embedded in the extension
The contact form is an explicit, optional message you choose to send. It is not telemetry.
4. Stripe Data Processing Disclosure
Velocity intends to introduce paid plans in a future version. If and when billing is introduced, payments will be processed by Stripe, Inc. Velocity will not store or have access to your card number or full payment details — these are handled exclusively by Stripe. Stripe's processing is governed by Stripe's Privacy Policy. We will update this policy before any billing feature is activated.
5. Your Rights (GDPR / CCPA)
| Right | How to exercise it |
|---|---|
| Export your data | Use the built-in JSON export in the extension's Options page. No account required. |
| Delete your data | Delete your Velocity account via the Settings panel. This triggers a hard-delete of all your rows in Supabase. Local IndexedDB data is cleared simultaneously. Anonymous contact-form rows are not attached to an account; email privacy@rpuvvula.com to delete those. |
| Access / rectification | Contact us at the address below. |
| Data portability | The JSON export format is open and documented. |
| Opt out of sale (CCPA) | We do not sell data. There is nothing to opt out of. |
For EU users: the legal basis for processing sync data is contract performance (fulfilling the sync feature you explicitly enabled). You may withdraw consent by disabling sync at any time — this will not affect locally stored snippets. The legal basis for the website contact form is consent.
6. Data Retention
- Local data: Retained until you clear your browser data or uninstall the extension.
- Sync data (Supabase): Retained until you delete your account. Soft-deleted snippets are permanently purged after 30 days.
- Website contact-form data: Retained until you ask us to delete it (privacy@rpuvvula.com), or until we no longer need it to handle your message.
- Auth tokens: Session-scoped; not shared with any third parties.
7. Children
Velocity is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children.
8. Changes to This Policy
We will update the "Last updated" date at the top of this page when changes are made. Material changes will be announced via the extension's release notes.
9. Contact
For privacy inquiries, data deletion requests, or DPA arrangements:
Email: privacy@rpuvvula.com
We aim to respond within 30 days.