Privacy Policy

Effective 27 September 2026, updated 26 October 2026 for version 1.1. This policy covers two things: the VeloUtils application for macOS, every release of it, and the veloutils.app website. They have different answers, so the website has a section of its own. The app comes as a direct download from this website and as a Mac App Store version; where the two differ, the policy says so.

1. Data the app collects

None. The app does not collect, receive, store, process or share any personal data, usage data, diagnostic data or identifiers of any kind. This is a statement about the application; for the website, see section 9.

Because nothing is collected, there is nothing to sell, share, link to your identity or use for tracking. In App Store terms, the app's privacy declaration is Data Not Collected.

2. Your documents

VeloUtils runs inside the macOS App Sandbox. It can read and write only the files that you choose — through the system open panel, the system save panel, a drag onto the window, or a file handed to it by Finder. It cannot reach anything else on your Mac.

Since version 1.1, the Markdown preview can show an image stored beside your document, but only once you allow it: Show Images… asks you to choose the folder in a system open panel. The app then reads images in that folder until you quit it, and remembers nothing of the choice afterwards.

Your documents are processed in memory on your own machine and are never uploaded. The app never modifies a file you opened. Its only write path is the Mermaid tool's Export, which creates a new PNG or SVG at a location you pick in a save panel.

3. Network access

VeloUtils requests the macOS outgoing-network entitlement for one reason, and we want to be precise about it, because it is the only way the app itself sends a request off your Mac.

The Markdown preview is a real web view. If your own document references a remote image — for example a badge image in a README — the preview fetches that image, exactly as a web browser would. That request goes from your Mac directly to whichever server your document names. The developer neither sees, routes nor logs it. No document content is sent with it.

Clicking a link in the Markdown preview hands the address to your default browser. The preview itself never navigates away.

The Mermaid preview loads its rendering library from inside the app bundle, not from the network, and renders with Mermaid's strict security level. Since version 1.1 it loads nothing from the network at all: a remote image in a diagram is not fetched, and clicking a link in a diagram hands the address to your default browser. In versions 1.0.0 and 1.0.1, an image node or an image in a label fetched its address, and a clicked link opened in the preview itself.

The JSON, CSV, Timestamp, Encode / Decode and JWT tools perform no network access at all. The JWT tool checks a signature on your Mac, against the key you paste.

A few menu items and buttons open a page outside the app, the same way a link in the Markdown preview does. Help › VeloUtils Support opens veloutils.app/support, and Help › Privacy Policy opens this page. Help › @srikeerthandev on X, and the X logo in the sidebar footer, open the developer's profile on x.com. Each address is fixed and carries nothing about you or your documents, and your default browser loads it, not VeloUtils.

Help › Send Feedback…, and the envelope in the sidebar footer, open a new email to support@veloutils.app in your mail app. The draft is pre-filled with a subject line and, at its foot, the VeloUtils version and build and your macOS version, and you can read and change every line of it. VeloUtils sends nothing: the message leaves your Mac only if you send it from your mail app.

The direct-download version also shows a Buy Me a Coffee strip at the foot of the sidebar and, occasionally, a reminder; section 4 says when. Both open buymeacoffee.com/srikeerthan in your default browser. The app itself sends nothing to Buy Me a Coffee. What you do on that page is covered by Buy Me a Coffee's own privacy policy, not this one. The Mac App Store version contains neither the strip nor the reminder.

If you open no document that references a remote resource, VeloUtils itself makes no network request.

4. What is stored on your Mac

In every version, the identifier of the tool that was selected when you last closed the window, so that the app reopens where you left it. macOS stores this in the app's own sandbox container. In version 1.1, macOS also keeps the window's size and position and the sidebar's width there. None of it contains document content or personal data.

Since version 1.1, the list of time zones you add to the Timestamp tool, so that they are there the next time. It holds only the zones' names, such as Europe/Berlin. The JWT tool keeps the token and key you paste in memory only, and never writes them anywhere.

The direct-download version keeps three more values in the same container, all for its Buy Me a Coffee reminder. The reminder appears only once you have opened the app on 14 different days, then at most once every 30 days, and never after you choose Don't show again. To know when that is, the app stores the dates of the first 14 days you opened it (dates only, no times), when the reminder last appeared, and whether you chose Don't show again. None of it leaves your Mac. The Mac App Store version stores none of these.

VeloUtils writes no other preferences, no caches of your documents, no history and no logs. Deleting the app does not delete these values: macOS keeps the app's container, at ~/Library/Containers/app.veloutils, after the app itself is gone. Checked on macOS 27.0 on 27 September 2026, and for version 1.1 in October 2026.

5. Third-party code and services

The application integrates no third-party service, SDK, analytics provider or advertising network. The website is separate and does use one, described in section 9.

It bundles one open-source library, Mermaid, which runs locally inside the app and is never downloaded at runtime. Mermaid and its dependencies are listed with their licences inside the app, under Help › Acknowledgements.

The direct-download version links to one outside service without integrating it: the Buy Me a Coffee strip and reminder open a page in your browser, as section 3 describes. No Buy Me a Coffee code runs inside the app, and the app shares nothing with it. If you use that page, Buy Me a Coffee's privacy policy applies.

6. Encryption

VeloUtils implements no encryption of its own. It uses only the encryption that macOS provides, in the form of HTTPS inside WebKit. Its ITSAppUsesNonExemptEncryption declaration is NO.

7. Children

VeloUtils collects no data from anybody, including children under 13. It contains no advertising, no in-app purchases and no user-to-user communication.

8. Your rights

Data-protection rights such as access, correction, portability and erasure apply to personal data that a controller holds about you. We hold none, so there is nothing to disclose, correct, export or delete. If you believe otherwise, write to the address below and we will answer.

9. This website

Everything above describes the application. This section describes veloutils.app, which does collect a small amount of anonymous traffic data — unlike the app, which collects none.

The site uses Cloudflare Web Analytics to count visits. It records the page you viewed, the page that referred you, general technical information such as browser, operating system and device type, and an approximate country. It does not identify you, does not follow you between sites, and is never used for advertising or sold to anyone.

This site sets no cookies and stores nothing in your browser — no cookies, no local storage, no session storage. Verified on 22 September 2026: no page returns a Set-Cookie header.

The site is hosted on Cloudflare Pages, so Cloudflare handles the requests needed to serve it, including your IP address, and acts as our processor for that. Cloudflare derives the approximate country from the IP address; the address itself is not part of the analytics data we can see.

We use this only to learn which pages people find useful. If you would rather not be counted, any content blocker that blocks static.cloudflareinsights.com will stop it, and the site works normally without it.

10. Changes to this policy

If this policy changes, the revised version appears on this page with a new effective date. Material changes will also be noted in the release notes of the version they accompany.

11. Contact

Questions about this policy, about privacy in VeloUtils, or about this website, go to support@veloutils.app.