1Who we are and what this covers#
This Privacy Policy explains how VelocityOS (“Velocity”, “we”, “us” or “our”) handles personal data when you visit velocityos.xyz, join the waitlist, use the Velocity app at app.velocityos.xyz, receive our emails and notifications, or contact us (together, the “Services”). Words with capitals that are not defined here have the meaning given in our Terms of Service.
For the purposes of the EU and UK General Data Protection Regulation (“GDPR”) we are the controller, and for India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary, of the personal data described here. The Velocity login and profile are one account system shared with wizzhq.xyz, run by the same team; section 5 explains exactly what that means.
You can reach us about anything in this policy at contact@wizzhq.xyz.
2The short version#
- We collect what we need to run your account and wallet, keep them safe and meet our legal duties. We do not sell personal data, and we use no advertising or third-party analytics trackers.
- Your account and profile are shared with wizzhq.xyz, run by the same team, so one login works on both.
- Your wallet addresses and transactions are on public blockchains. Anyone can see them, and they cannot be deleted.
- Our error log and bug reports are kept on our own servers. The error log never records what you type into a field.
- You can ask to see, correct, export or delete your data, and to complain, by writing to contact@wizzhq.xyz.
3The data we collect#
Account data
- Your name, email address, username and profile photo.
- How you log in: the third-party login you used (such as Google or GitHub) and the name, email address and photo it gave us; or a one-time email code (we store only a hash of each code, valid for 10 minutes); or your password, which is stored only as a salted hash. We never see your Google or GitHub password.
- Whether your email is verified, whether your Account has early access, and which version of our Terms of Service and this Privacy Policy you accepted at login, and when.
Login, device and security data
- The IP address you log in from, used for rate limits and to protect the login.
- For each signed-in device: a label taken from your browser’s user agent (such as “Chrome on Mac”), a shortened IP address with its last part removed, and when the session started and was last used. You see this list under Account and security and can sign any device out.
- The IP address recorded with security-relevant actions, such as trades, withdrawals, owner changes, waiting periods, recovery requests and reports made on the “This isn’t me” page.
- Your passkeys (device lock): their public key, name and usage counter. The private part never leaves your device.
- Safety records: freezes, waiting periods, confirmation codes (as hashes) and the alerts we sent.
Wallet and transaction data
- The addresses of your Smart Accounts, Solana account, Bitcoin address and Hyperliquid trading account, your balances, deposits, buys, sells, moves, Earn positions, trades and withdrawals, and the fees charged.
- Addresses you save for withdrawals, and the address of any backup owner or recovery wallet you add.
- The keys of your Velocity Wallet. They are created and kept, encrypted, only inside our separate Signing Service, and are not readable by the rest of our systems.
On-chain data is public. Transactions on Base, Arbitrum, BNB Chain, Robinhood Chain, Solana, Bitcoin and Hyperliquid are recorded on public ledgers that anyone can read. Anyone who knows that an address is yours can see its balances and history. This is how blockchains work, not something we choose.
Plan and setting data
- Your plans and baskets: coins, splits, modes, amounts, schedules, budgets and time zone; your Earn choices; the setting for moving deposits automatically; and the baskets you share.
- Your notification preferences, quiet hours, web push subscriptions (an address issued by your browser’s push service) and, if you connect Telegram, your Telegram chat identifier.
Waitlist data
When you join the waitlist we store your email address, name, country, which products interest you and your answers to three short questions, together with your IP address, the approximate country, region and city derived from it, and your browser’s user agent. The approximate location is worked out on our own server, without sending your IP address to anyone.
Error log
When something goes wrong in the app, it sends an error report to our own server. A report contains the error message and technical trace, the page and its address with any values removed from it, the app version, your user id and email if you are logged in, a random session id, your browser, operating system, device type, language, time zone, screen and connection type, and the last 30 steps before the error (pages opened, buttons pressed and calls to our servers). Before a report leaves your device it is cleaned of anything that looks like an email address, a long number, a key, a token, an address or a recovery phrase. It never contains anything you typed into a field, the content of requests or answers, cookies, passwords, codes or keys.
Bug reports
If you use “Report a bug”, we receive what you write, the email address of your Account or one you give, your Telegram username if you choose to add it so that we can reply there, a picture if you attach one (we remove embedded metadata, such as location, from JPG and PNG pictures), the technical details above if you leave “Include technical details” on, your IP address and your browser’s user agent.
Messages to us
If you email us or write to us on Telegram, we keep the message and our reply.
What we do not collect
We do not ask for identity documents, bank or card details, and we do not use advertising cookies, tracking pixels or third-party analytics. We do not receive your device’s precise location.
4How we use it, and our legal bases#
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and running your Account, logging you in and showing your profile | Account data, login data | Performance of our contract with you |
| Creating your Velocity Wallet and carrying out your Instructions, Plans, Earn choices, trades, moves and withdrawals | Account, wallet and transaction data, plan and setting data | Performance of our contract with you |
| Keeping accounts and assets safe: device lock, confirmation codes, waiting periods, safety alerts, freezes, recovery, rate limits and fraud prevention | Login, device and security data, account data | Our legitimate interest in protecting you, other users and the Services; performance of our contract |
| Sending receipts, summaries, statements and safety alerts by email, web push or Telegram | Account data, plan and wallet data, notification preferences | Performance of our contract; your consent for optional channels such as Telegram and push |
| Managing early access and the waitlist and telling you when your spot is ready | Waitlist data, account data | Your request to join; our legitimate interest in opening the Services gradually |
| Finding and fixing errors and answering bug reports | Error log, bug reports | Our legitimate interest in a working, secure service |
| Meeting legal duties, including sanctions screening, tax, record keeping and requests from authorities | Any of the above, as required | Legal obligation |
| Establishing, exercising or defending legal claims | Any of the above, as needed | Our legitimate interest |
Under the DPDP Act we process your personal data on the basis of your consent, given when you create an Account or join the waitlist, and for the legitimate uses the Act allows, such as using data you have provided voluntarily for the purpose you provided it, meeting legal obligations and responding to emergencies. You may withdraw your consent at any time (see section 10); withdrawal does not affect processing that took place before it, and we may then be unable to keep providing the Services.
We do not use your personal data for advertising, and we do not sell it or rent it to anyone.
5Sharing with Wizz#
Velocity and Wizz (wizzhq.xyz) are run by the same team and use one account system. There is no separate Velocity user database: when you sign up on Velocity, your Account is created in the shared account system, and if you already have a wizzhq.xyz account with the same email address, Velocity uses that account. This is what lets one login and one profile work on both, and lets a security action on one protect you on the other.
Shared in both directions
The following data is held once and used by both Velocity and Wizz:
- your name, email address, username and profile photo;
- your login methods: the third-party logins linked to your account, your password hash and email login codes;
- whether your email address is verified;
- session and security events: your session version (so that signing out everywhere, or resetting your password on either site, ends your sessions on both), and when you last logged in and were last seen;
- which of the two you have used, and when you first used each; and
- your Velocity early-access status.
Your Velocity waitlist entry is kept by Velocity’s own waitlist service. It is not shown on wizzhq.xyz, and the same team can see it.
From Velocity to Wizz
- When you create an account through Velocity, the shared account system also sets up the standard wizzhq.xyz account features for it, including a Wizz in-app wallet and Wizz’s email settings. The welcome email you receive comes from Velocity.
- If you freeze your Velocity Wallet, the Wizz in-app wallet of the same account is frozen too.
From Wizz to Velocity
- If your account has a balance in a Wizz in-app wallet, Velocity can show it to you and offer to move it into your Velocity Wallet. Nothing moves unless you choose to.
What stays with Velocity
Your Velocity Wallet, plans, baskets, Earn choices, trades, withdrawal addresses, signed-in Velocity devices, passkeys, notification preferences, error reports and bug reports are kept in Velocity’s own records. They are not shown on wizzhq.xyz and are not used for Wizz’s products. Both run on the same servers and are looked after by the same team, under the same access controls.
Why, and on what basis
We share account data between Velocity and Wizz to give you one login and one profile (performance of our contract with you) and to protect your account on both sites, such as ending every session when you reset your password (our legitimate interest in security).
Your rights across both
Because the account is one record, a request to access, correct or delete your account data covers both Velocity and Wizz. Send it to contact@wizzhq.xyz, the same address for both. If you want to stop using only one of them, tell us and we will remove the data held for that one (such as your Velocity Wallet records, once it is empty) and keep the shared account for the other. Deleting the shared account deletes it on both.
6Service providers and other recipients#
We share personal data only with the following, and only what each needs for its task:
| Recipient | What they receive | Why |
|---|---|---|
| Our hosting provider | All data we store, on servers we rent and operate ourselves | Running the Services |
| Brevo (email delivery) | Your email address, name and the content of the email | Sending login codes, receipts, summaries, statements and safety alerts |
| Google, GitHub and other login providers you choose | The fact that you are logging in to Velocity; they return your name, email and photo | Logging you in |
| Your browser's push service (such as Google, Apple, Mozilla or Microsoft) | Encrypted notification messages and your push address | Delivering web push notifications you turned on |
| Telegram | Messages to your chat if you connect it; bug report summaries may be forwarded to our team's private chat | Optional notifications; answering bug reports |
| Blockchain node providers (such as Alchemy and Helius) and public network endpoints | Your wallet addresses and the transactions we send for you | Reading balances and sending transactions |
| Hyperliquid | Your trading account address, your orders and positions | Trading |
| Exchanges, aggregators and bridges (Uniswap, 0x, KyberSwap, Jupiter, Across, Circle) | Your account addresses, amounts and coins | Quoting and executing buys, sells, conversions and moves |
| Earn sources (such as Aave, Morpho, Lido and Jito) and token issuers | Your account addresses and amounts, through public blockchain transactions | Earn and tokenised stocks |
| Price and market data providers (such as CoinGecko, CoinMetrics, Tiingo, Kraken, Coinbase, Chainlink and mempool.space) | Requests for prices and, for mempool.space, your Bitcoin address | Prices, scores, estimates and your Bitcoin balance |
Some app screens load public market data straight from your browser, from Hyperliquid, CoinGecko, Jupiter and GeckoTerminal. Those providers then see your IP address and browser details, as with any website you visit, but we do not send them your account details.
We may also disclose personal data when the law requires it or a competent authority lawfully requests it, to protect the rights, safety or property of our users, the public or us, or to a successor if all or part of the Services is sold, merged or reorganised. In that last case we will tell you and this policy will continue to protect your data.
7International transfers#
Our team and our providers operate in several countries, including India, the European Union and the United States, so your personal data may be processed outside the country where you live. Where the GDPR applies, we transfer personal data outside the European Economic Area or the United Kingdom only with appropriate safeguards, such as an adequacy decision or the European Commission’s standard contractual clauses, and you can ask us for a copy of them. We do not transfer personal data to any country to which the Government of India has restricted transfers under the DPDP Act.
8How long we keep data#
| Data | How long |
|---|---|
| Account data | While your Account is open. After you ask us to delete it, we delete or anonymise it within 30 days, except what we must keep as described below |
| Wallet, transaction and fee records | For as long as your Account is open and then for up to 5 years after it is closed, where we need them for legal, tax, anti-money-laundering or dispute purposes |
| Keys of your Velocity Wallet | Until every account they control is empty or under your own control. We do not destroy keys that still control your assets |
| Email login codes | Valid for 10 minutes; a new code cancels earlier ones |
| Session cookie and device records | The session cookie lasts up to 30 days. Device records are kept while your Account is open so that you can review past sign-ins |
| Security records (IP addresses of security actions, waits, freezes, recovery cases) | While your Account is open and up to 2 years after, to investigate misuse |
| Error log | Deleted automatically 90 days after the error was last seen |
| Bug reports and attached pictures | Until the report is resolved and then while it helps us prevent the problem recurring; deleted on request |
| Waitlist entry | Until you get access or ask us to remove it, or until we close the waitlist |
| Notification records | While your Account is open |
Records on a public blockchain or on Hyperliquid cannot be changed or deleted by anyone, including us. Deleting your Account removes the link between those records and your identity in our systems, but the records stay on the blockchain.
9How we protect data#
We use technical and organisational measures appropriate to the risk, including:
- the keys of your Velocity Wallet live only in a separate Signing Service, under its own system user, encrypted with keys that the rest of our systems cannot read;
- passwords are stored as salted hashes, and login codes and session identifiers as hashes;
- encrypted connections (HTTPS), secure and HTTP-only session cookies, and a strict content security policy;
- a device lock, confirmation codes, waiting periods and alerts for sensitive actions; and
- access to personal data limited to the team members who need it.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant authorities as the law requires, including the Data Protection Board of India under the DPDP Act.
10Your rights#
Depending on where you live, you have some or all of these rights over your personal data:
- Access. Get a copy of your personal data and a summary of how we process it and with whom we share it.
- Correction and completion. Have inaccurate or incomplete data corrected or updated. You can change much of it yourself in the app.
- Erasure. Have your data deleted, subject to the limits in section 8.
- Portability. Receive the data you gave us in a structured, machine-readable format. The monthly statement also gives you your activity as a file.
- Restriction and objection. Ask us to limit processing, or object to processing based on our legitimate interests.
- Withdraw consent. Withdraw any consent you gave, as easily as you gave it, such as by turning off an optional notification channel.
- Grievance redressal. Have a complaint handled by us, as described in section 11.
- Nominate. Under the DPDP Act, nominate another person to exercise your rights if you die or become incapable.
- Complain to a regulator. Complain to your local data protection authority, such as a supervisory authority in the EU, the Information Commissioner’s Office in the UK, or the Data Protection Board of India once you have used our grievance process.
How to make a request
Write to contact@wizzhq.xyz from the email address on your Account, and say which right you want to use. To protect your data, we may ask you to confirm the request from that address or in the app before we act on it. We answer within one month, or within a shorter period where the law that applies to you requires it. If a request is complex we may extend this by up to two further months where the GDPR allows, and we will tell you why. Requests are free, unless they are clearly unfounded or excessive.
Before we delete an Account whose Velocity Wallet still holds assets, we will help you withdraw them. Safety alerts are part of the Services and cannot be switched off while your Account is open.
11Grievance Officer (India) and complaints#
For any complaint about how we handle your personal data, including under the DPDP Act and the Information Technology Act, 2000 and its rules, contact our Grievance Officer:
Grievance Officer, Velocity
Email: contact@wizzhq.xyz
Please include your Account email and a description of the issue.
We acknowledge every grievance within 72 hours and resolve it within 30 days of receiving it. If you are not satisfied with our answer, you may take the matter to the Data Protection Board of India or to the data protection authority where you live.
13Emails and notifications#
We send safety alerts (such as a new device, a new withdrawal address, an owner change, a recovery or a freeze) to your Account email every time; they cannot be switched off, because they protect your assets. Routine emails, such as the weekly summary, the monthly statement, the first buy of a plan and a low balance, can be turned off in Notifications or with the link in each email. Web push and Telegram are used only if you turn them on. We do not send marketing emails without your consent.
14Automated processing#
Smart plans and Flexible split plans adjust buy amounts and splits using scores calculated from market prices, applied in the same way to everyone. Safety rules automatically pause or delay actions that break a limit or look unusual, and you can always contact us about such a decision. We do not use automated processing to make decisions about you that have legal or similarly significant effects based on your personal characteristics, and we do not build profiles of you for marketing.
15Children#
The Services are only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
16Changes to this policy#
We may update this Privacy Policy. If a change is material, we will tell you by email or in the app before it takes effect, and update the “Last updated” date at the top of this page. Where the law requires your consent to a change, we will ask for it.
17Contact#
Questions, requests and complaints about privacy go to contact@wizzhq.xyz, our single contact for Velocity, the shared account and the Grievance Officer. Our operator is VelocityOS.