Privacy Policy

Last updated September 24, 2026.

Who we are

  • velements (velements.store) is an online editor for motion graphics. You customize animation presets in your browser, buy tokens and download finished MP4 or WebM clips with a commercial license.
  • This Privacy Policy explains what personal data velements ("we", "us") collects when you visit velements.store, create an account, sign in with Google, buy tokens or download clips, how we use and share it, how long we keep it, and the rights and choices you have.
  • velements is the controller of the personal data described here. Questions, requests and complaints about your data can be sent to support@velements.store.
  • This policy applies to the website and its services only. Sites and services we link to, including our payment processors and Google, are governed by their own privacy policies.

Summary

  • We collect only what we need to run your account, sell tokens, deliver downloads and licenses, keep the service secure and understand how the site is used.
  • Text, colors, logos and images you put into an animation stay in your browser. They are never uploaded to our servers.
  • We do not sell your personal data, and we never read, store or share your Google contacts, files, calendar, email messages or any other Google account content.
  • You can ask us at any time to access, correct, export or delete your data.

Information you give us

  • Account details: your email address and, if you provide them, your name and profile photo.
  • Password: if you create an account with an email address and password, we store only a salted scrypt hash of your password. We never store or see the password itself in readable form.
  • Verification and reset codes: we email you 6-digit codes to confirm your address or reset your password. We keep only a keyed hash of each code, and it expires after 10 minutes or once used.
  • Messages you send us, for example when you contact support, together with the email address you write from.

Information we receive from Google

  • If you choose "Continue with Google", we use Google OAuth 2.0 and request only the basic sign-in scopes: openid, email and profile. We do not request access to Gmail, Google Drive, Calendar, Contacts, YouTube or any other Google API.
  • From Google we receive your Google account identifier (the "sub" value), your email address and whether Google has verified it, your name and your profile photo URL. Google does not share your Google password with us.
  • We receive this data once, at sign-in, inside a signed ID token that we verify on our server. We do not request offline access or refresh tokens, so we cannot access your Google account after you have signed in.

How we use Google user data

  • Your Google account identifier is used only to link your Google sign-in to your account, so that you reach the same account every time you sign in.
  • Your email address is used to create and identify your account, to match an existing account you created with the same address, to send you transactional emails such as purchase receipts, and to answer your support requests.
  • Your name and profile photo are used only to show who is signed in inside the site and to put your name on the licenses issued for clips you download.
  • We do not use Google user data to train artificial intelligence or machine learning models, or for any purpose unrelated to providing, securing and measuring the service. Its only advertising use is the one-way hash of your email address described under Advertising measurement, which Meta and TikTok use to tell whether a sign-up or purchase came from one of our ads.
  • We do not sell Google user data and we do not let humans read it, except where you ask us to (for example in a support request), where it is needed for security or abuse investigations, or where the law requires it.
  • velements's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we store, share and delete Google user data

  • Google user data is stored in our own PostgreSQL database, on servers we control, together with the rest of your account record. It is transmitted only over encrypted HTTPS connections.
  • We share Google user data only with the service providers listed below that need it to run the service (for example our email provider, to deliver messages to your address), with Meta and TikTok as a one-way hash for ad measurement, with anyone who can open a license link you share (your name on the license), and where required by law.
  • Google user data is kept while your account exists. If you ask us to delete your account, we delete or anonymize your Google account identifier, email address, name and profile photo within 30 days, except records we must keep for legal, tax or fraud prevention reasons as described below.
  • You can remove velements's access at any time in your Google Account under Security, "Your connections to third-party apps & services" (myaccount.google.com/connections). Removing access stops future Google sign-ins but does not delete data we already hold. To delete it, email support@velements.store.

Information created when you use the service

  • Token balance and history: your balance, any free credits given to new accounts, purchases, downloads and any manual adjustments.
  • Orders: the number of tokens, price, payment currency, payment status and the payment processor's reference.
  • Downloads and licenses: which preset you downloaded, when, and the license id issued in your name. The license shows your account name (or a generic customer label if none is set) and can be verified by anyone who has the license link.
  • Account activity: when the account was created and last signed in, which sign-in methods it uses, and whether it has been disabled.
  • Emails we sent you, so the same message is never delivered twice.

Information collected automatically

  • We count visits ourselves. For each page you open we record the page address, the site or campaign that sent you, your IP address, the approximate country, region and city that address resolves to, your device type, brand and model, operating system, browser, language and time zone.
  • A random identifier kept in your browser's local storage tells one visit apart from the next. It contains no name, email or account details, and you can remove it at any time by clearing site data.
  • To protect sign-in, code and checkout endpoints from abuse, our servers briefly use your IP address to rate limit requests. These counters are held in memory and are not stored.
  • Our hosting provider may keep standard server logs, such as IP address, time and requested URL, for security and troubleshooting.

Information that stays on your device

  • Text, colors and settings you enter in the editor, and logos or images you add to an animation, are processed in your browser. They are not uploaded to our servers.
  • Video encoding happens on your device. We never receive the rendered file.

Advertising measurement

  • When we run ads on Facebook, Instagram or TikTok, we use the Meta Pixel and Conversions API and the TikTok Pixel and Events API to learn which ads lead to sign-ups and purchases, and to show our ads to people more likely to find them useful.
  • The pixels run in your browser. They report the pages you open, the animations you view and completed purchases to Meta and TikTok. Meta sets the _fbp cookie and TikTok sets the _ttp cookie to recognise your browser. If you arrive from one of their ads, we store the click reference in the _fbc or _ttclid cookie.
  • Our server reports sign-ups, checkouts and purchases to Meta and TikTok directly. With each report we send your IP address, browser user agent, those cookies, the order value and a one-way SHA-256 hash of your email address and account id. They receive the hashes, never the email address itself.
  • Meta and TikTok process this data under their own privacy policies. You can control ad personalisation in your Facebook, Instagram or TikTok ad settings, and you can block these cookies with your browser settings or an ad blocker without affecting the rest of the site.

Payments

  • Token purchases are paid by card through Stripe or in cryptocurrency through NOWPayments. Card numbers, bank details and wallet addresses are entered on the processor's own page and handled under its own privacy policy. We never receive or store your full card details.
  • We receive only the order status, amount, currency and the processor's reference, which we use to credit your tokens and keep accounting records.

Cookies and local storage

  • __session (strictly necessary): keeps you signed in. It is httpOnly, sent only to our site and expires after 30 days or when you sign out.
  • google_oauth_state (strictly necessary): protects Google sign-in against forged requests. It is httpOnly and expires after 10 minutes or as soon as sign-in completes.
  • Local storage: a random visit identifier for our own visit measurement, and a marker for each ad event already reported so it is not counted twice.
  • Advertising cookies: when advertising measurement is on, the Meta Pixel sets _fbp and the TikTok Pixel sets _ttp. After a click on one of their ads we set _fbc or _ttclid, kept for 90 days.
  • You can delete cookies and local storage at any time in your browser settings. Blocking the strictly necessary cookies will stop sign-in from working.

Why we use your data and our legal bases

  • To create and secure your account, sign you in, including with Google, and verify your email address (performance of our contract with you).
  • To sell tokens, keep your balance, deliver downloads and issue licenses (performance of contract).
  • To send transactional emails: verification codes, password reset codes, a welcome email, purchase receipts and payment review notices (performance of contract). We do not send marketing emails.
  • To prevent abuse and fraud, for example by rate limiting codes and checkouts and disabling accounts that break our terms (legitimate interests).
  • To measure traffic, see which sources and devices our visitors use and improve the site (legitimate interests).
  • To measure which of our ads lead to sign-ups and purchases (legitimate interests, or your consent where the law requires it).
  • To keep records required for accounting and tax, and to respond to lawful requests (legal obligation).

How we share information

  • We do not sell your personal data and we do not share it for cross-context behavioural advertising, apart from the advertising measurement described above.
  • Service providers: we share data with the providers listed in the next section, only as needed to run the service and under their obligations to protect it.
  • Licenses: the license for a clip shows your account name and can be viewed by anyone you give the license link to, so buyers and clients can verify it.
  • Legal reasons: we may disclose data if required by law, court order or a valid request from authorities, or to protect the rights, safety and property of our users, the public or us.
  • Business transfers: if the service is sold or merged, your data may transfer to the new owner, who must continue to protect it under this policy. We will tell you before that happens.

Service providers

  • Google provides the "Continue with Google" sign-in.
  • A PostgreSQL database on our own servers stores account, balance, order, download and license records.
  • Resend delivers our transactional emails.
  • Stripe processes card payments.
  • NOWPayments processes cryptocurrency payments.
  • Meta Platforms measures the results of our Facebook and Instagram ads.
  • TikTok measures the results of our TikTok ads.
  • An IP geolocation provider resolves visitor IP addresses to an approximate country, region and city.
  • Our hosting provider runs the website and its servers.

International transfers

  • Some of our providers are located outside your country, including in the United States. Where data leaves the European Economic Area, the United Kingdom or Switzerland, the transfer relies on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

How long we keep data

  • Account data, including data received from Google, is kept while your account exists. When you ask us to delete your account, we delete or anonymize it within 30 days.
  • Orders, downloads and license records may be kept longer where needed for accounting, tax, fraud prevention, or so that licenses you already issued can still be verified. These records are kept only as long as the law requires or allows.
  • Visit records, including the IP address, are deleted automatically 90 days after the visit; the daily traffic totals we keep afterwards contain no personal data.
  • Verification and reset codes are deleted once used and become unusable after they expire.
  • The browser details we keep for reporting a purchase to ad platforms are deleted once the purchase is reported, or after 7 days if the checkout is never paid.
  • Support emails are kept for as long as needed to resolve your request and for a reasonable time afterwards.

Your rights and choices

  • Depending on where you live, including under the GDPR, UK GDPR and US state privacy laws such as the CCPA, you may have the right to know what personal data we hold, to access, correct, export or delete it, to object to or restrict certain processing, to opt out of targeted advertising, and to withdraw consent at any time.
  • To use these rights, or to delete your account, email support@velements.store from the address on your account. We may ask you to confirm your identity, and we reply within 30 days. We will not treat you differently for using your rights.
  • You can revoke Google sign-in access at myaccount.google.com/connections, clear cookies and local storage in your browser, and limit ad personalisation in your Meta and TikTok settings.
  • You also have the right to complain to your local data protection authority.

Security

  • All traffic to the site uses HTTPS. Sessions are signed and verified on the server for every protected request, authorization decisions are made server-side, passwords are stored only as salted scrypt hashes, and one-time codes are stored hashed and rate limited.
  • Access to production data is limited to the people who need it to run the service.
  • No system is perfectly secure. If we learn of a breach that affects your data, we will notify you and the relevant authorities as required by law.

Children

  • velements is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

Do Not Track

  • There is no agreed standard for Do Not Track signals, so the site does not respond to them. You can still block advertising cookies as described above.

Changes to this policy

  • We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your data, including data received from Google, we will tell you by email or on the site before it takes effect.

Contact

  • For any question about this policy or your data, email support@velements.store. We aim to reply within a few business days.