Your data, your business.

01Who we are

ACACIA INNOVATIONS TECHNOLOGY FZE, a Free Zone Establishment incorporated in the United Arab Emirates (“we,” “us,” “our”). For EU/UK users, we act as the data controller for personal data processed in connection with Veloxa.

Contact: privacy@veloxa.me

02What we collect

Everyone, including the free tier

Every install is given an anonymous device identifier so the app works without an account. The following is sent to our servers and linked to that identifier, whether or not you ever sign up:

• Speed test results (download, upload, ping, jitter, packet loss) and the time they were run.
• Approximate location of each test — GPS coordinates captured at the moment you run a test, if you granted location permission. Used to build coverage maps and regional benchmarks. See Location below.
• WiFi network identifiers — the network name (SSID) and hardware address (BSSID) of networks you scan, plus the detected router vendor.
• Connection context: your ISP, mobile carrier, connection type, signal strength, and our inference of the underlying broadband technology.
• Device profile: model, OS version, Veloxa app version.
• Local scan results: how many devices were found on your WiFi. Individual device IPs and MAC addresses stay on your phone and are not sent to us.
• Country code derived from your IP address at the time of the request.
• Anonymous crash logs via Sentry.

When you create an account

• Everything above, now linked to your account instead of only to a device identifier.
• Email address (for authentication and billing notifications).
• Whether that email is verified, and which sign-in method you used (email, Apple, or Google).
• Subscription status (plan, expiry date) from Apple or Google IAP.

We do not collect your phone number. Veloxa has no phone or SMS sign-in, and there is no field for one anywhere in the app.

When you contact support

• Name, email, and the contents of your message.
• Diagnostic logs you choose to attach (these may include app version, OS, and anonymized speed test results).

03How we use it

04Location, specifically

Veloxa records location in two situations, both tied to an action you take:

• When you run a speed test — so the result can be placed on your history map and counted toward coverage benchmarks for your area.
• When the app detects a dead zone — a very weak signal reading, recorded with the spot it happened so operators can see where coverage fails.

What that means in practice:

• Location is never collected in the background, and never while the app is closed.
• Denying location permission does not disable speed tests — results are simply saved without coordinates.
• Authorised staff can see where each account last ran a test, on an internal dashboard, to support users and understand where the service is used. Every such view is written to an internal audit log.
• That location is shown only for tests where you allowed location access, and is removed when you delete your account.

You can revoke location permission at any time in your phone's system settings, and request deletion of everything already collected under “Your rights” below.

05What we don't do

• We do not read, intercept, or log your internet traffic (websites visited, files downloaded, messages sent).
• We do not sell your personal data to anyone, ever.
• We do not serve ads inside Veloxa.
• We do not track your location in the background or when the app is closed.
• We do not collect your phone number, contacts, photos, or calendar.
• We do not build advertising profiles about you.
• We do not share your data with your ISP.

06Data sharing

We share data with a small number of sub-processors to operate the service:

• Sentry — anonymous crash reporting. No personal data.
• Resend — transactional email delivery (billing receipts, trial reminders). They receive your email address for delivery only.
• Cloudflare R2 — file storage for data exports. Encrypted at rest.
• Neon / Railway — managed Postgres database hosting. All data encrypted at rest.
• Apple / Google — process subscription payments and provide IAP receipts. We never see your payment details.

All sub-processors are contractually bound to process data only as instructed by us and to maintain appropriate security standards.

07Advertising ID (IDFA / GAID)

We do not use your Advertising ID for advertising purposes. On iOS, we request App Tracking Transparency (ATT) consent only if you enable a feature that requires it (e.g., regional benchmarking). You can deny this request with no loss of core functionality.

On Android, we do not request the Advertising ID at all.

08Data retention

• Anonymous (no account) data: retained while the install is active, and deleted on request — see “Your rights” below.
• On-device data (individual scan results, device IPs and MAC addresses): never sent to us; stays until you uninstall the app.
• Account data: retained while your account is active + 30 days after deletion.
• Support emails: 2 years from last contact.
• Anonymized analytics (aggregated speed benchmarks): indefinitely.

When you delete your account, we initiate deletion within 7 days and complete it within 30 days, except where we're legally required to retain billing records (typically 5–7 years for tax purposes).

09Your rights

Depending on where you live, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Deletion — ask us to delete your account and associated data.
• Export — download all your data in JSON format from within the app.
• Opt-out — unsubscribe from marketing emails at any time (link in every email).
• Objection — object to processing based on legitimate interest.

To delete your account yourself, use Settings → Delete account in the app, or go to veloxa.me/delete-account — no app needed.

To exercise any of these rights, email privacy@veloxa.me. We respond within 30 days.

10Children

Veloxa is not directed at children under 13. We do not knowingly collect personal data from children. If we discover that we have inadvertently collected data from a child, we will delete it promptly. Contact us at privacy@veloxa.me if you believe this has occurred.

11Security

• No passwords anywhere — sign-in is a one-time emailed code, Apple, or Google, so there is no password to leak.
• All data in transit is encrypted with HTTPS/TLS.
• Sign-in and session tokens are stored only as hashes, never in plaintext.
• Data at rest is encrypted by our managed database provider.
• No payment details ever reach us — Apple and Google process all payments.
• Access to individual user records in our admin tools is restricted and written to an audit log.

If you discover a security vulnerability, please email security@veloxa.me. We respond within 48 hours.

12UAE PDPL, GDPR, and CCPA

We comply with the UAE Personal Data Protection Law (PDPL Federal Decree-Law No. 45 of 2021), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

For EU/EEA residents: the legal basis for processing personal data is contract performance (subscription), consent (marketing), and legitimate interest (crash analytics, fraud prevention).

For California residents: we do not sell personal data. You have the right to know, delete, and opt-out. To exercise CCPA rights, email privacy@veloxa.me.

13Changes to this policy

We'll notify you of material changes via email (if you have an account) and by updating this page with a new effective date. Continued use after the effective date means you accept the changes.