Privacy Policy

This policy says what information Venoly collects, why, who sees it, how long we keep it, and what you can do about it. It is written to match what the software actually does. Where we found a gap between this page and the code, we changed the page — and where we are still closing a gap in the code, we say so rather than pretend.

It covers every way you can use Venoly: the website and web app, the desktop app, the Android app, the public API, and bots. It does not cover other companies' services that you connect to or link from Venoly.

We do not sell your personal data, and we do not show advertising. Nothing on this platform is funded by your data. We collect what we need to run the service and keep it safe.

Related documents: Subprocessor list · Automated processing & forensics disclosures · Data Processing Agreement for business customers · Transparency report · The Law of Venoly.

When you create an account we ask for:

• Email address — used to verify the account, reset your password, and send security and service notices. We do not send marketing email.
• Username and display name — the username is public and unique; the display name is what other people see and you can change it any time.
• Password — stored only as a bcrypt hash. We cannot read it, only reset it.
• Date of birth — used to check that you are at least 13 and to keep your age group up to date. Other people on Venoly never see it; a few Venoly staff can see it when they need to, for example to handle a report. It is the only age check we perform: there is no identity-document check.
• Age group — we store your age group, under 16, 16–17 or adult, worked out from your date of birth, so we can apply under-18 protections. Nobody else can see it, except Venoly staff handling a report you're part of.

If you sign in with Google or Discord instead, that provider sends us your name, email address, provider user ID and avatar. We never receive your password from them. These are the only sign-in providers we support.

Everything here is optional and editable in Settings → Profile:

• Avatar and banner — images you upload.
• Bio, pronouns and custom status — free text you write.
• Connections — links you add to your profile for services like Discord, GitHub, X, YouTube, Twitch, Kick, TikTok, Instagram, Spotify, Steam, Reddit, LinkedIn, Bluesky, Mastodon, Patreon, Ko-fi or a website. These are links you type in: we store the username or URL you enter and show it on your profile. We do not connect to those services or pull data from them.

What is visible on your profile, and to whom, is controlled in Settings → Privacy & Safety.

• Messages and files — everything you send is stored so it can be delivered and shown in the conversation. Message content — in server channels and in direct messages — is sealed at rest under a per-record key (SMUSH v1: AES-256-GCM, with ChaCha20-Poly1305 as an alternate suite; keys live in a keyring file the database never holds), row-bound so a sealed value can't be moved to another record; so are email addresses, support-ticket contents and two-factor secrets. Message search uses a blinded index — it can reveal term-frequency patterns but never the underlying words. Uploaded files are stored as ordinary files. Venoly can still technically read any of it — there is no end-to-end encryption, deliberately. See the Law of Venoly, Article 19.
• Servers, channels and roles — which servers you are in, which channels you can see and which roles you hold. This is what permissions run on.
• Voice and video — relayed through our own media server in the Netherlands and not recorded.
• Session data — when you sign in and out and when you were last active, which powers online/offline status.
• Error reports — when something breaks in the app, the app sends us the error message, a stack trace, the page you were on and a random per-tab session ID so we can fix it. That is the only telemetry the client sends. We do not track page views, clicks or scrolling, and we run no analytics.

• IP address — seen on every request. Used for rate limiting, to block flooding addresses temporarily, to detect suspicious sign-ins, and in security logs. When one of the founders reviews an account for abuse, the approximate location of an IP address may be looked up through a third-party geolocation service (ip-api.com); that lookup sends the IP address to them.
• Browser and client version — the user-agent string and Venoly app version, for compatibility and debugging.
• Browser fingerprint — a composite identifier derived from your browser's canvas and WebGL rendering, hardware concurrency, device memory, languages, screen size, timezone and touch support. We use it for one purpose: to detect ban evasion and people running several accounts. It is collected when you sign in or register. You are shown a disclosure and can object (Section 11); if you object, we stop storing the raw signals but keep a hashed identifier so that an existing ban still holds.

Additional collection on the desktop app

The desktop app (Windows, Linux) can see hardware identifiers that a browser cannot. It reports them automatically on the first authenticated launch of each session, for fraud and ban-evasion detection only:

• MAC addresses of physical network interfaces (virtual interfaces are filtered out).
• Hardware UUID exposed by the operating system.
• Machine ID — the per-installation identifier your operating system generates.
• Hostname — your computer's name.
• Device hash — a SHA-256 hash over the items above, which is what we actually compare between accounts.

Legal basis: our legitimate interest in preventing fraud, ban evasion and abuse (GDPR Article 6(1)(f)). We do not use this data for anything else. The desktop app asks you in a native prompt before it reports the identifiers themselves, and our server stores them only if you have accepted the fingerprinting disclosure — otherwise it keeps the device hash alone. If you do not want to share even that, use Venoly in your browser at venoly.nl, which never sees hardware identifiers. Retention is in Section 10.

Venoly stores the following on your device. All of it is functional; none of it tracks you.

• Sign-in cookies — an access token and a refresh token, both HTTP-only and secure, so you stay signed in. The desktop and Android apps hold the token in app storage instead.
• Your cookie choice — what you picked in the cookie banner, so we do not ask again until the banner changes.
• Preferences and interface state — theme, layout, collapsed panels, last-visited channel, notification settings cache, and unsent drafts, in browser local storage.
• A random error-report session ID in session storage, cleared when the tab closes (Section 4).

We use no advertising cookies, no third-party tracking cookies and no cross-site trackers. Section 15 has the detail.

• Running the service — delivering messages, calls, servers, profiles, notifications.
• Keeping it safe — rate limiting, flood blocking, malware scanning of uploads, detecting ban evasion, and reviewing reports.
• Fixing it — reading error reports and logs to find bugs.
• Telling you things you need to know — verification emails, password resets, security alerts, maintenance notices, changes to these documents.
• Meeting legal obligations — responding to valid legal process, keeping records the law requires.
• Support — answering your questions and investigating problems you report.

Venoly's production systems are run by the founder in Emmen. The co-founder, based in the United States, has no access to user data, the database or the codebase. Message content can be opened in Venoly's staff tools only by the founder and by staff whose rank carries moderation, safety or legal duties, and only to handle a report or an appeal, to comply with a legal order or notice, or to investigate a specific safety concern under a case the founder opens. Each time staff open message content in those tools, the access is written, with its reason, to an append-only access log that the staff tools can't change or delete. It is kept for two years. Your data export lists the times your messages were opened and why, except while telling you would harm an investigation: reads for a child-safety report or under a safety case the founder opened are left out. We do not profile you, we do not build advertising audiences, and we do not run behavioural analytics.

• Contract (GDPR Article 6(1)(b)) — account data, your content, server membership, session data, notifications: everything needed to give you the service you signed up for.
• Legitimate interests (Article 6(1)(f)) — security logging, rate limiting, abuse detection, browser fingerprinting and desktop hardware identifiers, error reports. We have written a legitimate-interests assessment for the fingerprinting, and you can object to it (Section 11).
• Consent (Article 6(1)(a)) — only where the law requires it, for instance non-essential storage on your device if we ever introduce any. You can withdraw consent at any time.
• Legal obligation (Article 6(1)(c)) — keeping payment records, statements of reasons, and responding to lawful orders.

We do not sell personal data. It leaves our hands in these cases only:

• Other users — your messages, profile and presence are shown to the people you share them with, as the product requires. Your privacy settings control who can see your profile and contact you.
• Integrations a server owner sets up. A server owner can link a channel to a Telegram chat or a Discord channel (a "bridge"), or register an outbound webhook. When they do, the display name and text of every message posted in that channel — and for webhooks, member join and leave events — are sent to the destination the owner chose, and that service's own policies apply from there. A bridged channel shows a "Relayed to …" marker in its header so you can see it before you post. We do not choose or vet those destinations.
• Processors that help us run the platform. Named, because a list you can check is worth more than "trusted providers":
  • Cloudflare carries all traffic to our API through its network and therefore sees the IP address and request metadata of every API request. It also keeps cached copies of uploaded files at its edge for up to 30 days (Section 10).
  • Vercel hosts the web application and sees the IP address and request metadata of anyone who loads it.
  • Resend delivers our email and receives your address and the content of emails we send you.
  • Google and Discord handle sign-in when you choose them. Google (Firebase Cloud Messaging) delivers push notifications to Android devices; browser push notifications go through your browser vendor's push service.
  • Groq, a hosted AI provider in the United States, receives the text an AI feature needs when you invoke it — the support assistant, catch-up and thread summaries, smart-reply suggestions, translation, search-query expansion, image descriptions, voice-clip transcription and the AI server-template and bot generators — and, when an AI character replies in a channel, that character's persona prompt and the last 15 messages of the channel. When a server owner runs FAQ auto-capture on a channel, it receives that channel's recent messages; when a member presses Find matches in Meet People, it receives the interest blurbs of the members of that server who opted in. While you have live captions on in a call, it receives short clips of your own microphone, and nothing from anyone who has not turned captions on (Section 18).
  • Pollinations.AI receives the short description a server manager types when they use "Generate with AI" to draw a server emoji. Nothing else is sent.
  • ip-api.com receives an IP address when a founder looks up its approximate location during an abuse review (Section 5).
  • PayPal will process payments when in-app checkout launches. Today no payment data passes through the platform.
  Voice and video, the database and file storage run on our own hardware in the Netherlands. Uploaded files are kept there, but they reach you through Cloudflare, which caches them as described above. The full list is on the Subprocessors page.
• Authorities — only under written legal process under Dutch law that names a specific account and a bounded period, after we have verified the requesting authority through an official channel we look up ourselves; the content of communications only on a judicial order; foreign authorities only through a European Investigation Order, a mutual legal assistance treaty or a Dutch court; the minimum the order covers; every request logged and counted in the Transparency report; and you are told first unless the law forbids it. The full process is in the Law of Venoly, Article 22.
• Safety — where we believe in good faith that disclosure is necessary to prevent serious harm to a person, including reports of child sexual abuse material to the appropriate authority.
• Incorporation or transfer — on incorporation your data passes to Venoly B.V.; in a later merger or acquisition it would pass to the successor under the same obligations, with notice to you.

• Your account — kept while the account exists. When you delete it, it is deactivated immediately and permanently purged within 30 days. During those 30 days you can ask us to restore it. If you want it gone sooner, email support@venoly.nl and we purge it directly. An account we terminate for a breach is deactivated but not purged while the ban stands: the record is what enforces the ban and what your appeal against the statement of reasons is decided on. A granted appeal, or a founder who lifts the ban, restores the account.
• Messages you delete — removed from the conversation immediately. Copies remain in backups until the backups rotate.
• Backups — the database and uploaded files are backed up every six hours to hardware we control in the Netherlands. Each database backup is deleted after about 15 days, and a file deleted from Venoly is kept in the file backup for about 15 days, then deleted.
• Cached copies of uploaded files — uploaded files are served with a 30-day cache lifetime, so a file you delete can still be served from Cloudflare's cache, and from browsers that already loaded it, for up to 30 days. Apart from those cached copies, deleted data is gone from our backups within about 15 days.
• Security logs, sign-in history and error reports — up to 12 months.
• Browser fingerprints and desktop hardware identifiers — up to 2 years after the device was last seen. When an account is deleted, the link to the account is removed but the identifiers themselves are kept until the 2-year window ends, so that a ban cannot be evaded by re-registering. A daily automated purge enforces this cap.
• Ban records — until a founder lifts the ban.
• Appeals — an appeal, what you wrote in it, and the decision and its reasons are kept while your account exists. If your account is purged, what you wrote, the reason you were given and the decision's reasons are erased; only the bare record (what kind of decision it was, the dates and the outcome) stays, without any link to you, so that the appeal figures in the Transparency report stay accurate.
• Legal records — statements of reasons, payment records and anything else we are required to keep, for as long as the law requires.

These apply to every user, wherever you live:

• Export your data — Settings → My Account → Data Export → Request Data. We email you a verification code first, then a copy of your messages, friends and settings in machine-readable form.
• Delete your account — Settings → My Account → Danger Zone → Delete Account. Section 10 explains the 30-day window.
• Correct your data — edit it in Settings; for anything you cannot edit yourself, email us.
• Object to fingerprinting — a disclosure is shown when you sign in; you can object there, or by emailing us. We then stop storing the raw signals and keep only a hashed identifier (Section 5). A self-service switch in Settings → Privacy & Safety is being added.
• Restrict or object to other processing based on legitimate interests — email us and we will stop unless we have compelling grounds tied to an active abuse case.
• Withdraw consent — at any time, without affecting what was done before.
• Log out everywhere — Settings → My Account → Lock Account revokes every session on every device.

For anything not self-service, email privacy@venoly.nl. We answer within 30 days and will ask you to confirm you own the account first. We never release account data by phone, chat or social media, nor to someone claiming to act for you without written authority and identity checks.

Venoly is not for children under 13, and we do not knowingly collect their data. The date of birth you give us is the only age check we have. Accounts that existed before we asked everyone for a date of birth are asked once; an account that then says it is under 13 is put on hold while a person reviews it. If you believe a child under 13 has an account, email privacy@venoly.nl; we will disable the account and delete its data.

Under Dutch law, people under 16 cannot consent to data processing on their own. For users aged 13 to 15 we rely on the contract and on our legitimate interests for the processing needed to run the service. We do not show advertising to anyone, so there is no profiling-based advertising to minors to opt out of.

Your data lives on servers Venoly owns and operates in Emmen, the Netherlands. It is not stored in a public cloud. The only data that leaves the European Economic Area is what the processors in Section 9 need: Cloudflare and Vercel route requests through their global networks, Google and Discord handle sign-in from the United States, Groq processes AI requests in the United States, Pollinations.AI (Germany) draws AI-generated emoji, and ip-api.com receives IP addresses during abuse reviews. Nobody at Venoly accesses personal data from outside the EEA: the co-founder, based in the United States, has no access to user data or production systems.

For those transfers we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and, where the provider is certified, the EU–US Data Privacy Framework. We do not use your consent as a transfer mechanism.

What is actually in place, rather than what a checklist would like us to say:

• In transit — TLS on every connection.
• At rest — message content (server channels and direct messages), email addresses, support-ticket contents, two-factor secrets, integration credentials and the IP addresses/user agents in security logs are sealed under SMUSH v1: a per-record key derived under HKDF, an authenticated cipher (AES-256-GCM, with ChaCha20-Poly1305 as an alternate suite), a fresh random salt every time, and an envelope cryptographically bound to its own row. Keys live only in a keyring file kept outside the database — not in the database, not in the database backups (which are themselves sealed the same way), never committed to source control; without the keyring file or the owner's offline recovery bundle there is no practical recovery of the sealed data. Values that must still be looked up by equality (an email address, an IP address) use a separate keyed index instead of the plaintext. Of the desktop hardware identifiers, MAC addresses and the hostname are sealed the same way; the device hash, hardware UUID and machine ID are not, because they are compared exactly. Usernames, profile text and uploaded files are not encrypted at rest.
• Credentials — bcrypt password hashes; access and refresh tokens hashed at rest; HTTP-only, secure cookies in the browser.
• Your account — two-factor authentication and passkeys are available in Settings → Security; Lock Account revokes every session at once.
• Uploads — uploaded files are scanned for malware; infected files are quarantined and escalated to a founder.
• Abuse defence — rate limits on every endpoint, automatic time-limited blocking of flooding addresses, and a rule engine that screens risky requests.
• Audit — an append-only, hash-chained log of administrative actions.
• Access log — every time staff open message content in Venoly's staff tools, the reason is recorded in an append-only log, kept for two years.
• Backups — every six hours, on hardware we control in the Netherlands, rotated after about 15 days. The database backup is sealed the same way as live data. Uploaded files are copied as they are, without encryption, because they are not encrypted at rest either.
• Access — production systems are run by the founder in Emmen. Staff whose rank carries moderation, safety or legal duties can open message content in the staff tools to handle a report or an appeal, and each opening is logged. The co-founder has no access to production data or systems.
• Review — a full internal security audit was completed in August 2026 and its findings are being worked through.

If the database or a backup were stolen without the keys, the encrypted fields would be unintelligible to whoever holds them — brute-forcing a 256-bit key is beyond any computing power that exists or is foreseeable — and GDPR Article 34(3)(a) recognises that. We would still treat it as a breach: notify the Dutch data-protection authority within 72 hours where required, and tell you exactly which unencrypted categories were exposed. Encryption at rest does not protect against someone who fully compromises the running server, which holds the keys; the rest of this list is what guards against that. No system is perfectly secure. Use a unique password and turn on two-factor authentication.

Strictly necessary — cannot be switched off because the service does not work without them:

• accessToken and refreshToken cookies — HTTP-only, secure. The access token expires after 15 minutes and is renewed from the refresh token, which expires after 7 days of inactivity — or 30 days if you ticked Remember me at sign-in. Each renewal extends the session; expired sessions are deleted within six hours.
• Cookie-consent choice — what you picked in the banner.

Functional storage — browser local storage, only readable by Venoly:

• Theme, layout and interface state.
• Unsent message drafts.
• A cached copy of your notification settings.
• A random error-report session ID in session storage (cleared when the tab closes).

Analytics and marketing — the cookie banner shows these categories because the law requires us to be able to ask. Both are unused. Venoly sets no analytics cookies, no advertising cookies, no third-party pixels and no cross-site trackers, and does not participate in any ad network. If that ever changes we will ask you again before anything is set.

The browser fingerprinting described in Section 5 is not a cookie and is not used for advertising; it exists to detect ban evasion and is covered by the objection right in Section 11.

Venoly is established in the Netherlands and applies the GDPR to everyone, wherever you live. You have the same rights of access, correction, deletion, portability and objection as an EU user, exercised the same way (Section 11). We do not sell personal data to anyone, so there is nothing to opt out of under laws such as California's CCPA; Venoly does not currently meet the thresholds at which that law applies, but the commitments on this page hold regardless.

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR (or its UK equivalent) gives you these rights, all of which we honour:

• Access (Article 15) — a copy of your data and information about how we process it.
• Rectification (Article 16) — correction of inaccurate data.
• Erasure (Article 17) — deletion, subject to the exceptions in Section 10.
• Restriction (Article 18) — pausing processing while a dispute about the data is resolved.
• Portability (Article 20) — your data in a structured, machine-readable format.
• Objection (Article 21) — to processing based on legitimate interests.
• No solely automated decisions (Article 22) — no decision with legal or similarly significant effect on you is made by a machine alone; a founder decides.

Contact privacy@venoly.nl. We respond within one month, extendable by two further months for complex requests. If you are not satisfied you can complain to the Autoriteit Persoonsgegevens (the Dutch data-protection authority) or to the authority in your own country.

Venoly uses AI in the places listed below. Here is what happens to your data in each.

• AI characters are named personas that can reply in the channels of a server they are a member of — when someone mentions them and, now and then, on their own — and only in channels they can see and post in. When one replies, its persona prompt and the last 15 messages of that channel — including other people's — are sent to Groq, a hosted AI provider in the United States, which generates the reply on our instructions as a processor. Venoly keeps no separate copy of those messages for the character. Characters carry a persistent, visible AI label and you are shown a disclosure before you first interact with one — our obligation under Article 50 of the EU AI Act. We will never present an AI as a person. Characters are on by default; the server's owner, or anyone with Manage Server, can switch them off for that server in Server Settings, and Venoly can switch them off for a server.
• Features you invoke — the support assistant, catch-up and thread summaries, smart-reply suggestions, translation, search-query expansion, image descriptions, voice-clip transcription and the AI server-template and bot generators (the description you type, and a test message you send to a bot you generated) — send the text (or image, or clip) they need to Groq in the same way. Nothing is sent unless you use one of them: opening Home or the catch-up page shows your unread channels without sending anything, and AI summaries are made only when you press Catch me up. Summaries and any content flagged for safety review are stored so that moderators can act on them and decisions can be audited.
• Features someone else in a server invokes. With FAQ auto-capture, a server owner can send the recent messages of a channel they pick (up to 120 messages, with the authors' display names) to Groq, which drafts question-and-answer pairs that are then kept in that server's FAQ. Meet People is opt-in: once you opt in on a server, your interest blurb is sent to Groq together with other opted-in members' blurbs whenever you or another member of that server presses Find matches.
• Live captions in voice channels, stages and calls are per person. Only while you have captions on, short clips of your own microphone are sent to Groq to be transcribed, and the server refuses clips from anyone who has not turned captions on. Someone else turning captions on never sends your voice; on a stage, a listener who shows captions sends nothing, and only speakers who turned captions on are transcribed. The text is sent to the people in the call (for a call in a direct or group message, to every member of that conversation) and shown live only to those who have captions on. It is not saved: there is no transcript. If you translate a caption line, that line's text is sent to Groq; the line and its translation are then kept in the server's memory, never written to disk, until the server restarts or the cache fills, so the same line is not translated twice.
• AI-generated emoji. A server manager can describe an emoji and have it drawn by Pollinations.AI, a free text-to-image service; only the description they typed is sent.

Legal basis: performance of our contract with you (GDPR Article 6(1)(b)) when you use an AI feature, and our legitimate interest in keeping the platform safe (Article 6(1)(f)) for moderation triage. AI characters take part only in servers they are members of, and the people who run a server can switch them off there.

What we do not do:

• We do not train, fine-tune or improve any AI model on your messages. Groq's terms state that API inputs are not used to train their models.
• We do not use AI to build advertising or marketing profiles of you.
• We do not suspend, terminate or penalise an account by automated means alone (GDPR Article 22).

AI output can be wrong. It is not advice and not a statement by Venoly. For how automated systems are used in moderation and security more broadly, see the Automated Decision-Making & Forensics Disclosures.

When we change this policy we update the date at the top. For a change that reduces your rights or expands what we collect, we give at least 30 days' notice through an in-app notice and either an email or a banner on the website, before it takes effect. Corrections and clarifications take effect on publication.

Every previous version is kept in our source-control history and is available on request.

• Privacy and data-rights requests: privacy@venoly.nl
• Security concerns: security@venoly.nl
• Everything else: support@venoly.nl

These addresses reach the two founders directly. We answer privacy requests within 30 days. If you believe your account has been compromised, put "URGENT" in the subject line.

If you are in the EEA and are not satisfied with our answer, you can complain to your local data-protection authority; for the Netherlands that is the Autoriteit Persoonsgegevens.