What we store, and why.

Who runs the service

Vellum Studio is part of the Nova Ecosystem. The service and its database are operated by the Owner on infrastructure he controls: an application server (VPS-2) inside the European Union, with Cloudflare in front for TLS and caching. There is no third-party design SaaS, no external database and no advertising network in the path.

Contact for any privacy question or request: [email protected].

What we store

Account: your email address, display name, a scrypt hash and random salt of your password (never the password itself), your role, and the date the account was created.

Sessions: a SHA-256 hash of the session token (never the token), the IP address and user-agent that signed in, the last time it was seen, and its 14-day expiry.

Designs: the document itself (pages, layers, text, colours), its title, size, page count, a small thumbnail, the folder name, and created/updated timestamps. Design data is only ever read under your own account id; a foreign id answers 404.

Versions: the snapshots you create or that are kept on save, with a label, element count and timestamp.

Uploaded images: the file you upload, its type, byte size, pixel dimensions and date. Only you can read them back.

Share links: a hash of the share token (never the token), an optional label, read-only mode, expiry, revocation state and the last time it was opened.

Comments: the page, position, text and the display name of the author.

Security log: a record of actions such as sign-in, save, share and delete — actor, action, target, IP and time. It is used to investigate abuse and to prove what happened; it does not copy your design content.

Login attempts: the IP, the identifier that was tried, the time and whether it succeeded, kept only long enough to throttle brute force (7 failures per account and per IP in 15 minutes).

AI jobs: the prompt you typed, the model name, how many layers were produced, how long it took and whether it succeeded.

What we do not do

No Google Analytics, Plausible, Hotjar, Meta pixel or Cloudflare beacon. No advertising or cross-site tracking cookies. No data brokers. No selling or renting personal data. No reading your designs for anything other than rendering, exporting, or investigating a specific abuse report.

Cookies

Two cookies only. vs_session keeps you signed in: HttpOnly, SameSite=Lax, Secure on HTTPS, 14-day server-side expiry. vs_share remembers that you unlocked one password-protected share link. Both are strictly necessary, so there is no consent banner and nothing to opt out of.

The language menu is the one place where text leaves your browser: if you pick a language, the visible page text is sent to Google's free translation endpoint from your browser. If you never open the menu, nothing is sent. The editor canvas is never translated.

AI

The editor is not AI-driven. There is one optional action, “AI art direction”: when you press it, the prompt you typed is sent through our proxy to DeepSeek, which returns a layout you can edit. That prompt is stored with the job record so the hourly limit can be enforced and faults diagnosed. Your designs and uploaded images are not sent to train models, and we do not use them for advertising.

Where it lives and how it is protected

Designs, versions, assets and account rows live in one SQLite database (WAL mode) on the server, and uploaded images live next to it on the same disk. Traffic is TLS-encrypted; passwords are hashed with scrypt and compared in constant time; session and share tokens are stored only as hashes; every query that touches your data is scoped to your account id; login and share-unlock attempts are throttled and answered with 429 + Retry-After.

How long we keep it, and how to delete it

Designs stay until you delete them. Deleting a design moves it to the trash and a permanent delete removes the document, its versions, its comments and its share links. Deleting your account removes your designs, versions, uploads, comments, share links and sessions in a single transaction; security-log rows keep the action metadata (who did what, when) without the design itself. Expired sessions and old login attempts are swept by their own expiry.

You can export any design as PNG, JPEG, SVG, PDF or ZIP before deleting it. There is no lock-in and no export fee.

Your rights

You can ask for a copy of your data, correct your display name or email, delete your account and everything in it, or object to a specific processing operation. Write to the address above and we answer from the same mailbox. If you are in the EU/EEA and are not satisfied with our answer, you can complain to your national data protection authority (in Greece, the Hellenic Data Protection Authority).

Children

Vellum Studio is not directed at children under 16. Do not create an account if you are younger than that.

Changes to this page

If what we store changes, this page changes on the same day and the date at the top moves. Material changes are announced on this page rather than buried in a changelog.