Privacy Policy

Last updated September 17, 2026.

Who we are

velements (velements.store) is an online editor for motion graphics. This policy explains what personal data we process when you use the site, why, and the choices you have.
Questions or requests about your data can be sent to support@velements.store.

Account details: your email address and, if you provide them, your name and profile photo. With Google sign-in these come from your Google account.
Password: if you create an account with email and password, your password is stored by our authentication provider in hashed form. We never store it ourselves.
Verification and reset codes: we email you 6-digit codes to confirm your address or reset your password. We only keep a keyed hash of each code, and it expires after 10 minutes or once used.
Messages you send us, for example when you contact support.

Token balance and history: your balance, the 5 free credits given to new accounts, purchases, downloads and any manual adjustments.
Orders: the number of tokens, price, payment currency, payment status and the payment provider's invoice reference.
Downloads and licenses: which preset you downloaded, when, and the license id issued in your name. The license shows your account name (or a generic customer label if none is set) and can be verified by anyone who has the license link.
Account activity: when the account was created and last signed in, and whether it has been disabled.
Emails we sent you, so the same message is never delivered twice.

Text, colors and settings you enter in the editor, and logos or images you add to an animation, are processed in your browser. They are not uploaded to our servers.
Video encoding happens on your device. We never receive the rendered file.

Token purchases are paid in cryptocurrency through NOWPayments. Wallet addresses and transaction details are handled by NOWPayments under its own privacy policy. We receive only the order status, amounts and currency.

We set one strictly necessary cookie, __session, which keeps you signed in. It is httpOnly, is only sent to our site and expires with your session token.
Our authentication provider stores sign-in state in your browser's local storage so you stay signed in between visits.
We do not use advertising or analytics cookies.

To create and secure your account, sign you in and verify your email address (performance of our contract with you).
To sell tokens, keep your balance, deliver downloads and issue licenses (performance of contract).
To send transactional emails: verification codes, password reset codes, a welcome email, purchase receipts and payment review notices (performance of contract).
To prevent abuse and fraud, for example by rate limiting codes and checkouts and disabling accounts that break our terms (legitimate interests).
To keep records required for accounting and tax (legal obligation).
We do not sell your personal data and we do not use it for advertising.

Google Firebase (Authentication and Cloud Firestore) stores account, balance, order, download and license records.
Resend delivers our transactional emails.
NOWPayments processes cryptocurrency payments.
Our hosting provider runs the website and its servers.
These providers process data on our behalf and only for the purposes above. Some are located outside your country, including in the United States, and transfers rely on the safeguards those providers offer, such as standard contractual clauses.

Account data is kept while your account exists. When you ask us to delete your account, we delete or anonymize it within 30 days.
Orders, downloads and license records may be kept longer where needed for accounting, tax, fraud prevention, or so that licenses you already issued can still be verified.
Verification and reset codes are deleted once used and become unusable after they expire.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent.
To use these rights, email support@velements.store from the address on your account. We reply within 30 days.
You can also complain to your local data protection authority.

Sessions are verified on the server for every protected request, authorization decisions are made server-side, passwords are handled by our authentication provider, and one-time codes are stored hashed and rate limited.
No system is perfectly secure. If we learn of a breach that affects your data, we will notify you as required by law.

velements is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you by email or on the site before it takes effect.