Privacy Policy

Effective Date: July 11, 2026

Pack6 LLC ("we," "us," or "our"), a company registered in Jamaica, operates the Vellune mobile application ("App"). This Privacy Policy explains how we collect, use, and protect your information when you use Vellune.

1. Information We Collect

2. Information We Do NOT Collect

• Continuous camera video — Vellune does not upload or store your continuous camera feed. When you place a note, the App may capture and upload a still reference image of the placement area to help your paired partner find it.
• GPS or precise location — Note placement uses on-device AR spatial anchors, not GPS coordinates.
• Contacts or phone data — We do not access your address book or call history.
• Advertising profiles — Vellune contains no third-party advertising SDK and does not use your note content for advertising.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App's core functionality
• Deliver notes between paired partners
• Send push notifications when a note is placed, scheduled, revealed, or privately answered; notification previews do not include private reply content
• Process subscription payments (via Apple's App Store)
• Respond to support requests
• Enforce our Terms of Service
• Measure aggregate feature usage and improve reliability
• Create referral attribution and limited pair rewards when you explicitly share a privacy-safe recap

4. Data Storage & Security

Your data is stored on Firebase (Google Cloud) infrastructure. We protect your information using:

• HTTPS encryption for all data in transit
• Firebase Authentication for secure account access
• Firestore security rules that restrict data access to authorized users (you and your paired partner)
• Firebase Storage security rules for note, handwriting, response, and AR assets

5. Third-Party Services

Vellune uses the following third-party services to operate:

• Firebase (Google Cloud) — Authentication, database, file storage, push delivery, App Check, privacy-reviewed product analytics, crash diagnostics, and performance measurement. Diagnostics exclude note content and precise hiding locations. Subject to Google's Privacy Policy.
• Google Sign-In — Optional account authentication when you choose Google as your sign-in provider. Subject to Google's Privacy Policy.
• Apple Push Notification Service and Firebase Cloud Messaging — Delivering notifications to your device. Notification previews are designed not to include private note text. Subject to Apple's Privacy Policy and Google's privacy terms.
• Apple App Store — Processing subscription payments. Subject to Apple's terms.
• RevenueCat — Verifying and managing subscription entitlement status. Subject to RevenueCat's Privacy Policy.

We do not sell, rent, or share your personal data with any other third parties.

6. Data Sharing Between Partners

By design, Vellune shares the following with your paired partner:

• Your display name and avatar
• Notes you write and place for them
• The shared memory archive of exchanged notes

This sharing is the core function of the App and occurs only with the single person you have explicitly paired with.

7. AR Reference Images

A reference image is a still image of the area where a note was placed. It is captured only as part of placement, stored with that note's protected AR assets, and made available only to the paired users who are allowed to access the note. It is used to provide visual guidance and improve reveal recovery. It is deleted when the associated note assets or account data are deleted under the controls described below.

8. Analytics and Your Choices

Release builds use Firebase Analytics to record limited product events such as onboarding completion, invite acceptance, placement, reveal, and paywall interactions. Analytics events use minimal operational parameters and do not include note text, attachment images, reference images, room imagery, or precise location. Firebase Crashlytics and Performance Monitoring collect privacy-reviewed stability and performance diagnostics without note content or precise hiding locations. Where available in the App, you may disable optional product analytics collection in Settings without losing core functionality.

8A. Keepsakes, Share Cards, and Referrals

PDF keepsakes and private video montages are generated on your device only from memories you explicitly select. If you share an exported file, it leaves Vellune through the destination you choose. Reveal recap cards exclude note text, photos, room images, and precise hiding locations by default. A name is included only after you explicitly approve it. Referral links contain an attribution code; we apply limited, abuse-protected counts for opens, shares, pair conversions, and rewards.

8B. Magic Spots and Portable AR

When you save a Magic Spot, Vellune stores a protected copy of that place's AR world map, anchor, and optional reference image so the paired users can reuse it. Removing the Magic Spot revokes its reusable assets without deleting note history. Portable AR notes do not rely on the sender's room map; the recipient chooses a place in their own environment, and continuous camera video is not uploaded.

9. Your Rights

You have the right to:

• Access your data — View all information associated with your account within the App
• Delete your account — Remove your account and all server-stored data through the App's settings
• Revoke permissions — Disable camera access or notifications via your device's Settings at any time
• Cancel subscriptions — Manage or cancel through your Apple ID settings

Account deletion begins removal of your profile, authentication account, devices, invites, and associated server assets. Subscription purchases are processed by Apple and entitlement records are retained by RevenueCat under its own privacy policy; manage subscriptions through your Apple ID settings. Shared relationship history may affect your paired partner, so the App explains the applicable deletion behavior before confirmation.

10. Children's Privacy

Vellune is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete that information promptly.

11. Data Retention

We retain account and relationship data while it is needed to provide Vellune. Notes and memories remain available according to the in-App archive and deletion controls. Deleted live data and uploaded assets are removed from active systems; encrypted provider backups may persist for a limited recovery period before automatic expiry.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or via email. The "Effective Date" at the top reflects when the policy was last revised.

13. Contact

If you have questions or concerns about this Privacy Policy or your data, contact us at hello@vellune.pacsix.com.