Legal
Privacy Policy
This Privacy Policy explains what information Velnode Browser collects, how it is used, and the choices available to you. It is written to comply with the New Zealand Privacy Act 2020 and to reflect the principles of the European Union General Data Protection Regulation (GDPR) where applicable.
Velnode Browser (“Velnode”, “the Browser”, “we”, “us”, “our”) is developed and maintained by Dignity New Zealand Limited, a company incorporated in New Zealand. Velnode is an Electron-based desktop web browser with an integrated AI assistant named Vee.
On this page
Quick-read summary
The table below is a plain-language snapshot of our privacy posture. The full policy text governs; read it for complete details.
| Topic | What actually happens |
|---|---|
| Browsing history | Stays on your device only. Never transmitted to us. |
| AI conversations | Routed directly from your device to your chosen AI provider. We never see them. |
| Bookmarks, notes, timeline | Stored locally in your data/ folder by default. Turn on sync and they're uploaded only as encrypted blobs we can't read. |
| Browser import | Reads bookmarks and, if you choose, browsing history from the other browser — locally, never transmitted. See section 4.6. |
| Password import | User-initiated CSV export only — Velnode never reads another browser's password database. Imported credentials are sealed in the local encrypted vault and never transmitted. See section 4.7. |
| Crash reports | Off by default. You review the report and choose to submit each time. |
| Selling your data | We do not sell, rent, or trade Personal Information. |
| Velnode account (optional) | Creating an account is entirely optional. The browser works fully without one. If you create an account, we store your e-mail and a server-side authentication verifier. Your synced data is zero-knowledge — we cannot read it. See section 4.8. |
| Velnode Pro billing | Handled entirely by Stripe. We never see your card number. Stripe receives your email, plan, and payment details you enter on Stripe's hosted pages. See section 4.9. |
| Kids Mode | Forces local-only AI and locks all cloud toggles. |
1. Definitions
“You” or “User” means the individual installing, opening, or otherwise interacting with Velnode Browser on their own device.
“Personal Information” has the meaning given to it in section 7 of the New Zealand Privacy Act 2020 and includes any information about an identifiable individual.
“Local Data” means files written to your own device under the Velnode data/ directory, including but not limited to timeline.json, semantic-memory.json, bookmarks.json, notes.json, settings.json, command-pins.json, mindmap.json, and plugins-enabled.json.
“Velnode Account” means the optional registered account a user may create in Velnode. Creating an account is not required to use Velnode.
“Account Server” means the account service operated by Dignity New Zealand Limited on Cloudflare Workers, backed by a Cloudflare D1 database.
“AI Gateway” means the main-process module inside Velnode that routes every AI request, applies the policy layer (including Kids Mode and token caps), and selects between cloud providers or the optional local model.
“Vee” means the in-product AI assistant. “EchoVee” and “Vee Whisper” are internal modules of Vee and are not separate products.
2. Scope
This Privacy Policy applies to:
- The Velnode Browser desktop application for Windows, macOS, and Linux.
- Any official Velnode plugin distributed through the Velnode Plugin Manager.
- Direct correspondence between you and Dignity New Zealand Limited at the contact address below.
This Privacy Policy does not apply to:
- Third-party websites you visit using Velnode. Each website operates under its own privacy policy.
- Third-party AI providers you elect to connect via your own API keys. The provider's own privacy terms govern those interactions.
- Forks or unofficial builds of Velnode distributed outside Dignity New Zealand Limited's official release channels.
3. Our privacy posture in plain language
Velnode is built on a local-first architecture. The default position of every component is that your data stays on your device. We do not operate a central Velnode server that stores your browsing history, AI conversation transcripts, notes, bookmarks, or timeline events.
A Velnode Account is entirely optional. The browser works fully signed-out and offline. If you choose to create an account, the Account Server stores only the minimum identity information necessary to provide login, password-reset, and entitlement services (see section 4.8). Your personal data — bookmarks, history, notes, timeline, and vault contents — remains zero-knowledge: even if you have an account, the Account Server receives only encrypted blobs it cannot read.
When Vee makes a cloud AI request, that request is routed by the AI Gateway directly from your device to the AI provider you have configured. The request payload reaches Dignity New Zealand Limited at no point in the round trip. When the policy layer's Local-Only mode is enabled (Kids Mode forces Local-Only and locks the toggle), no outbound AI request can leave your device, regardless of any configured API key.
4. Information collected
4.1 Information collected locally on your device
Velnode writes the following information to Local Data on your own device. None of this is transmitted to Dignity New Zealand Limited.
| Local file | Content | Append-only |
|---|---|---|
timeline.json | Time-stamped record of browsing events, Vee interactions, and tab activity | Yes |
semantic-memory.json | Derived semantic memory rebuilt from the timeline | No |
bookmarks.json | Your bookmarks and bookmark folders | No |
notes.json | Sticky notes attached to tabs or URLs | No |
settings.json | Application settings, including Kids Mode lock state | No |
command-pins.json | Pinned Vee commands | No |
mindmap.json | Mindmap nodes and edges you have created | No |
plugins-enabled.json | The set of plugins you have explicitly enabled | No |
Velnode does not maintain a hidden telemetry file. Velnode does not transmit a usage heartbeat. There is no anonymous analytics pixel and no install ping. Crash reporting is off by default and is described separately in section 4.5.
4.2 Information sent to third-party AI providers
If you configure Vee to use a cloud AI provider (for example, by entering an API key in Settings), then when you ask Vee a question, the AI Gateway sends the following payload to the provider you chose:
- The prompt you typed, plus the context Vee needs to answer it (for example, the contents of the active tab when you ask “summarise this page”).
- The system prompt that defines Vee's personality and constraints.
- Recent conversation turns from the current Vee session, up to the token cap configured in Settings.
- No persistent identifier of you. Velnode does not append your name, e-mail address, machine identifier, IP geolocation, or any Velnode-internal user ID to the request.
The content and retention of that payload at the provider is governed by the provider's own privacy terms. Dignity New Zealand Limited is not a party to those terms and does not receive a copy of your conversation.
4.3 Information sent over the public internet by ordinary browsing
When you load a web page, Velnode behaves like any other browser. Your IP address is visible to the website operator, your bandwidth provider, and any intermediary network you traverse. Velnode does not interpose itself in that traffic and does not log it on a Dignity New Zealand Limited server.
4.4 Information you e-mail us
If you write to us at [email protected], we receive the contents of your e-mail, your e-mail address, and any information your mail provider includes in the message headers. We use this only to respond to you and to keep a record of the correspondence.
4.5 Opt-in crash reporting
Velnode includes a crash reporter that is off by default. You can enable it in Settings → Privacy → Crash Reporting.
When the crash reporter is enabled and a crash occurs, Velnode presents a summary of the report on screen before anything leaves your device. If you choose to submit the report, the following information is sent over HTTPS to a crash-intake endpoint operated by Dignity New Zealand Limited (hosted on Cloudflare R2):
- Velnode application version
- Operating system version
- A scrubbed tail of the application log
The report never contains passwords, vault data, page content, browsing history, bookmarks, notes, or absolute file paths. The raw crash dump (the minidump file generated by the operating system) remains on your device and is never transmitted.
If you close the crash-report dialog without submitting, nothing is sent. The crash reporter has no background beacon; it only activates when a crash has occurred and you explicitly choose to submit.
Submitted crash reports are stored on Velnode's own Cloudflare R2 storage. Cloudflare acts as a storage sub-processor for this data. It provides object storage only and does not perform crash analysis on behalf of Dignity New Zealand Limited. Crash reports are retained only as long as they are needed to investigate the crash, and are deleted when no longer required.
4.6 Browser data import (bookmarks and history)
Velnode can import bookmarks and browsing history directly from another browser you have installed on the same device (supported browsers: Chrome, Edge, Brave, Opera, and Vivaldi). Each import type is user-initiated separately. The following describes how both operations work from a privacy standpoint.
| Aspect | Detail |
|---|---|
| Trigger | User-initiated and explicit, per import type. Velnode never reads another browser's files automatically or in the background. |
| What is read | The other browser's bookmarks file and, when history import is used, its browsing-history database (read-only, on your device). Velnode does not read, access, or inspect that browser's passwords, cookies, extensions, or any other data. |
| Where processing happens | Entirely on your device. Bookmarks are written to Velnode's local bookmarks.json; imported history is written to Velnode's local history.json. History is parsed by an on-device, dependency-free reader — the source database is copied to a temporary file, read, and the copy is deleted. |
| Transmission | None. No part of the imported data or the source browser's file path is transmitted to Dignity New Zealand Limited or any third party. |
| Deletion | Velnode does not retain or reference the source browser's files after the import completes. The imported data becomes part of your Velnode Local Data and is governed by the same local-first posture as any bookmark or history entry you create in Velnode. |
4.7 Password import (CSV)
Velnode can import passwords that the user has exported from another browser (supported sources: Chrome, Edge, Brave, Opera, Vivaldi, and Firefox). The following describes how this operation works from a privacy standpoint.
| Aspect | Detail |
|---|---|
| Trigger | Fully user-initiated. The user opens the vault page or Settings and explicitly starts the import. Velnode never reads, accesses, or monitors another browser's password database. |
| Source file | A CSV file that the user exports themselves through the source browser's own interface. The source browser requires OS authentication (password or biometric) before producing the export. Velnode does not access the source browser's stored password data by any other means. |
| What is read | The CSV file the user selects. Velnode parses it on-device to extract site, username, and password fields. No other data from the source browser is read. |
| Preview | Velnode shows the user a count of logins and sites before any credentials are written. Passwords are never displayed during the preview. |
| Where processing happens | Entirely on the user's device. Parsed credentials are sealed using the vault's public key and written into the encrypted vault file. No master-password unlock is required at import time. |
| Duplicate handling | Any entry that matches an existing vault record by site and username is skipped. Velnode never overwrites an existing saved password. |
| Transmission | None. No credential data, no source file path, and no import metadata is transmitted to Dignity New Zealand Limited or any third party. |
| Source file deletion | After import, Velnode offers to remove the export CSV from the user's device by overwriting and then deleting the file. The user can decline. This is a best-effort file removal, not a forensic wipe. Dignity New Zealand Limited does not retain any record of the file location or its contents. |
| Storage | Imported credentials are held in the Velnode Password Vault, encrypted at rest under the same two-layer protection (OS keystore + master passphrase) as any other vault entry. They are governed by the same local-first posture described in section 3 and are not transmitted to any server. |
Note: the password import feature has undergone internal security review. An independent external security audit is in progress and remains a prerequisite for general public distribution of this feature.
4.8 Velnode Account (optional)
Creating a Velnode Account is voluntary. The core browser — browsing, bookmarks, vault, Vee with a user-supplied API key, and all features shipped in v1.x — remains fully functional without an account.
When you create an account, Velnode sends the following information to the Account Server, where it is stored in a Cloudflare D1 database operated by Dignity New Zealand Limited:
| Field stored | What it is |
|---|---|
| E-mail address | Normalised to lowercase. Used for login, email verification, and password-reset links. |
| Authentication verifier | A server-side re-hash of the authentication hash the client sends. The raw auth hash is never stored. The verifier uses PBKDF2-HMAC-SHA256 with a per-account server-generated salt. Your password is never transmitted or stored in any form. |
KDF salts (auth_salt, kek_salt, recovery_salt) | Random 16-byte values your device generated. Returned to your device at login to allow the client to re-derive the correct keys. |
| Opaque wrapped-data-key blobs | Two AES-256-GCM-encrypted blobs, each wrapping your randomly-generated account data key. The data key is wrapped client-side with a key the server never sees. The server stores only the opaque ciphertext. |
plan field | Your current plan (currently “free”). Used for entitlement checks. |
| Session tokens (hashed) | Only the SHA-256 of the bearer token is stored. The raw token is only ever in transit. |
| Email-verification and password-reset tokens (hashed) | As above — only the SHA-256 is stored; tokens expire and are one-time-use. |
What the Account Server never receives or stores: your password, your Key Encryption Key (KEK), the unwrapped account data key, any plaintext browsing history, bookmarks, notes, timeline events, vault contents, or other personal data. Synced data reaches the server only as encrypted blobs the server cannot read.
Cloudflare sub-processor. The Account Server is hosted on Cloudflare Workers with a Cloudflare D1 database. Cloudflare, Inc. acts as a data-processing sub-processor in its capacity as a hosting provider. Cloudflare processes this data only as instructed by Dignity New Zealand Limited. This processing is governed by Cloudflare's Data Processing Addendum, which incorporates Standard Contractual Clauses for transfers from the EEA.
Erasure. To delete your account and all associated server-side data, open Account settings in Velnode (or sign in at account.velnode.app) and choose “Delete account”. Dignity New Zealand Limited will delete the account row, sessions, email tokens, and wrapped-data-key blobs from D1 within thirty (30) days of the request. Local Data on your device is not affected; you delete that separately as described in section 7.
Pro tier and billing. Velnode Pro is an optional paid subscription. Billing information collected in connection with Pro subscriptions is described in section 4.9 below.
4.9 Velnode Pro — Stripe as payment sub-processor
If you subscribe to Velnode Pro, billing is processed entirely by Stripe, Inc. (“Stripe”), acting as payment sub-processor on behalf of Dignity New Zealand Limited. The checkout and subscription-management flows are hosted pages operated by Stripe under Stripe's own domain.
What Stripe receives directly from you:
- The e-mail address you enter at checkout (or your existing account e-mail, pre-filled).
- The payment details you enter on Stripe's hosted checkout page: card number, expiry, CVC, cardholder name, and billing address. These are entered directly into Stripe's secure form and transmitted from your browser to Stripe's servers. Velnode and Dignity New Zealand Limited's servers never receive or store your card number, CVC, or any other raw payment-card data.
What Dignity New Zealand Limited receives from Stripe: After a successful payment, Stripe notifies Dignity New Zealand Limited's account service via a signed webhook. The data we receive and store is limited to:
| Field | Purpose |
|---|---|
| Stripe customer identifier | Links your Velnode Account to your Stripe subscription |
| Stripe subscription identifier | Identifies the active plan and billing cycle |
| Plan name and status | Used to provision or revoke Pro entitlements |
| Invoice amount and currency | Required for GST/tax-invoice record-keeping |
| Subscription period dates | Used to calculate when entitlements expire |
We do not store card numbers, CVCs, bank account numbers, or any other payment-card data. Dignity New Zealand Limited's PCI scope is SAQ-A; cardholder data is fully outsourced to Stripe.
Zero-knowledge boundary. Billing data lives in the conventional identity layer (Stripe + our account server know your e-mail and plan). The encrypted sync data layer is separate and remains zero-knowledge: your browsing history, bookmarks, notes, timeline events, and vault contents are encrypted client-side and are not visible to Stripe, to our account server, or to Dignity New Zealand Limited.
Stripe's privacy policy. Stripe's handling of the data you enter on its hosted pages is governed by Stripe's Privacy Policy. Dignity New Zealand Limited is not responsible for Stripe's privacy practices in respect of data Stripe collects in its own right.
Retention. Billing records (Stripe identifiers, plan history, and invoice amounts) are retained for as long as required to manage active subscriptions and to meet our record-keeping obligations under New Zealand law, typically seven years from the date of the transaction.
5. How information is used
Local Data is used by Velnode to deliver features to you: to populate the timeline view, to remember your bookmarks and notes, to let Vee recall prior context within a session, to render the mindmap, and to honour your settings between launches.
Information sent to third-party AI providers is used by those providers to generate the response Vee returns to you.
E-mail correspondence is used solely to support you.
We do not sell Personal Information. We do not rent Personal Information. We do not exchange Personal Information for advertising consideration. Velnode does not run tracking-based or surveillance advertising, and does not profile you for ad targeting.
6. Legal bases for processing (GDPR users)
Where the GDPR applies to you, the legal bases on which we process the limited Personal Information described above are:
- Performance of a contract (Article 6(1)(b)) — to provide the Velnode Browser to you in accordance with the Terms and Conditions, and to manage your Velnode Pro subscription and entitlements.
- Legal obligation (Article 6(1)(c)) — to retain billing records for tax and accounting purposes as required by New Zealand law.
- Legitimate interests (Article 6(1)(f)) — to maintain the security and integrity of Velnode and to respond to your support correspondence.
- Consent (Article 6(1)(a)) — for any optional feature you explicitly enable, such as connecting a cloud AI provider, installing a plugin, or enabling crash reporting.
7. Data retention
Local Data persists on your device for as long as you keep Velnode installed. You can delete any Local Data file at any time using your operating system's file manager. Velnode will recreate empty defaults where required on next launch.
timeline.json is append-only by design. If you wish to clear it, delete the file; Velnode will start a new, empty timeline on the next launch. We recommend using the in-product “Clear timeline” action so the semantic memory is rebuilt cleanly.
E-mail correspondence is retained for as long as is necessary to support you and to meet our record-keeping obligations under New Zealand law, typically no longer than seven years.
8. Your rights
You have the right to:
- Access any Personal Information we hold about you. In practice we hold almost none — usually only past e-mail correspondence.
- Correct any inaccurate Personal Information.
- Delete any Personal Information we hold, subject to our legal record-keeping obligations.
- Object to processing in any way you choose. Because Velnode does not centralise your data, the most effective exercise of this right is uninstalling Velnode and deleting the Local Data directory.
- Lodge a complaint with the Office of the Privacy Commissioner of New Zealand at privacy.org.nz, or, if the GDPR applies to you, with your local data-protection authority.
To exercise any of these rights, contact us at the address below.
9. Children's privacy
Velnode ships a Kids Mode that, once enabled, forces Local-Only AI processing, restricts navigation to an allow-list, and locks the toggle behind a parental code. Kids Mode is a product feature, not a representation that Velnode is targeted at children. Velnode is intended for general audiences aged thirteen and over.
We do not knowingly collect Personal Information from children under thirteen. If you believe a child under thirteen has sent us Personal Information by e-mail, please contact us and we will delete it.
10. International transfers
Because Dignity New Zealand Limited operates from New Zealand and Velnode's local-first architecture keeps your data on your device, ordinary use of Velnode without an account does not involve an international transfer of your Personal Information by us.
Account users. If you create a Velnode Account, your e-mail address and account metadata are stored in a Cloudflare D1 database. Cloudflare infrastructure may be located outside New Zealand. New Zealand has been recognised as providing an adequate level of personal data protection by the European Commission (Commission Implementing Decision (EU) 2013/65). For transfers from the EEA to Cloudflare, Cloudflare's DPA incorporates Standard Contractual Clauses.
If you elect to use a cloud AI provider whose servers are outside New Zealand, your prompt will be transmitted to that provider's infrastructure. That transfer happens directly from your device under your own configuration; it is not a transfer by Dignity New Zealand Limited.
11. Security
Velnode applies the following security defaults, which materially reduce the surface area exposed to malicious web content:
| Control | Detail |
|---|---|
nodeIntegration: false | Renderer processes have no direct Node.js access. |
contextIsolation: true | Page scripts cannot access Velnode's internal APIs. |
sandbox: true | Each renderer runs in an OS-level sandbox. |
| IPC allow-list | All renderer-to-main communication is channelled through an explicit allow-list in preload.js. |
| Deny-by-default permissions | New permissions are denied unless explicitly granted. |
| Main-process API key storage | API keys never leave the main process; they are never stored in Local Data files accessible to page scripts. |
No system is perfectly secure, but these defaults form a strong baseline.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this document reflects the most recent revision. Material changes will be highlighted in the release notes of the version that introduces them. Continued use of Velnode after a change indicates your acceptance of the revised Privacy Policy.
13. Contact
Privacy questions, access requests, and complaints should be addressed to:
Document maintained by Dignity New Zealand Limited. Questions: [email protected].