Privacy Policy

Velocity ("Velocity", "we", "us", or "our") is operated by Saksham Goel, a business organized under the laws of India.

Our registered office is:

For purposes of applicable data-protection laws, Velocity may act as the data fiduciary, data controller, business, or equivalent responsible entity for personal data that we determine the purposes and means of processing.

This Privacy Policy applies to personal data processed in connection with:

• The Velocity website and associated web applications.
• Velocity accounts and authentication.
• Cloud development environments and sandboxes.
• Compute, GPU and storage services.
• Velocity APIs and developer integrations.
• Subscriptions, prepaid balances and billing.
• Customer support and communications.
• Webhooks and webhook-management functionality.
• Error tracking, telemetry, observability and performance diagnostics.
• Security, abuse prevention and service monitoring.

This Policy does not govern the privacy practices of independent third-party services that you access through Velocity. Those services have their own privacy policies and terms.

The information we collect depends on how you use Velocity. Categories may include the following.

Velocity is a development-environment service. This means that your workspace may contain highly sensitive information, including proprietary source code, credentials, configuration files, private repositories and business data.

We process workspace data to provide the functionality you explicitly request, including provisioning, running, stopping, persisting, archiving, restoring and deleting development environments.

We do not sell your source code or workspace content.

We do not use your private source code for advertising or unrelated profiling.

You are responsible for avoiding unnecessary placement of secrets or sensitive information inside workspaces and for maintaining independent backups of important data.

We use personal data only for purposes reasonably connected to operating, securing and improving Velocity and complying with applicable obligations.

• Create and manage user accounts.
• Authenticate users and enforce access controls.
• Provision and manage cloud development environments.
• Start, stop, archive, restore and delete sandboxes.
• Calculate and record compute and storage usage.
• Process subscriptions, wallet transactions and payments.
• Detect runtime exceptions, diagnose crashes, and resolve bugs using Sentry error monitoring.
• Prevent fraud, abuse, unauthorized access and resource exhaustion.
• Detect security incidents and investigate suspicious activity.
• Provide customer and technical support.
• Send transactional emails and operational notifications.
• Operate APIs and developer integrations.
• Deliver webhook functionality and event notifications.
• Monitor reliability, performance and service health.
• Debug errors and improve the Services.
• Comply with legal, regulatory and accounting obligations.
• Enforce our Terms of Service and Acceptable Use Policy.
• Protect the rights, property and safety of users and Velocity.

Depending on the applicable law and context, we may process personal data because it is necessary to provide a service you requested, to comply with a legal obligation, to protect our legitimate interests (such as diagnosing crashes via Sentry and preventing abuse), to prevent fraud or abuse, or because you have provided consent where consent is required.

For users subject to laws requiring a specific legal basis, including applicable European privacy laws, the applicable legal basis may depend on the particular processing activity.

For users in India, our processing will be carried out in accordance with applicable Indian data-protection law, including the Digital Personal Data Protection framework to the extent applicable to the relevant processing.

India's Ministry of Electronics and Information Technology published the Digital Personal Data Protection Rules, 2025 and an enforcement timeline in November 2025.

Velocity uses third-party cloud infrastructure to provision and operate development environments.

Daytona may process information necessary to operate its infrastructure, including account-related information, infrastructure metadata, sandbox information and other data required to provide its service.

Daytona publishes its own Privacy Policy describing its collection, use, disclosure, retention and security practices.

Workspace contents may be transmitted to or stored within infrastructure operated by Daytona or its infrastructure providers as necessary to provide the development environment you requested.

Velocity may use Clerk for authentication and user-management functionality.

Depending on your authentication method, Clerk may process identifiers such as your email address, authentication identifiers, device information, IP address, session information and other information required for authentication and security.

Clerk states that, for Customer Data processed through its customers' implementations, the customer generally acts as the controller and Clerk acts as a processor or service provider subject to applicable contractual arrangements.

If you connect a source-control provider, Velocity will request only the permissions necessary for the feature you choose, subject to the authorization flow presented by that provider.

Depending on the integration, Velocity may process repository names, repository identifiers, branches, commits, pull requests, issues, contributors, file metadata and file contents.

If you authorize access to private repositories, the corresponding repository data may be processed by Velocity to perform the functionality you requested.

OAuth access tokens or equivalent credentials will be protected using appropriate technical safeguards and will not be intentionally disclosed publicly.

You can revoke an integration through the applicable provider's account settings or through Velocity where supported.

GitHub and GitLab independently process information according to their respective privacy policies.

Velocity enables users and their autonomous AI agents to connect and execute actions across third-party applications (including but not limited to GitHub, Gmail, Slack, Notion, Linear, Supabase, Google Sheets, Google Calendar, Google Drive, Jira, Discord, and 1,000+ developer toolkits) using integration infrastructure powered by Composio.

When you authorize a third-party app connector:

• Multi-Tenant Isolation: Each user operates under a dedicated, isolated entity identifier (velocity:<userId>). Your connected accounts and data are never shared with or accessible to other Velocity users.
• Zero Token Client Exposure: OAuth tokens, API keys, and authentication credentials are encrypted and stored within secure vaults managed by Composio. Raw access tokens and refresh secrets are never exposed in frontend application bundles or browser storage.
• Action Execution & AI Agent Control: Tools and action calls initiated through Velocity MCP or cloud sandboxes are executed server-side via authenticated Composio proxies according to the specific permissions and scopes you granted during authorization.
• Granular User Control & Immediate Revocation: You can inspect active connections, monitor status, and disconnect or revoke access at any time through the 'Manage Connectors' tab in your user profile, or directly within the third-party service provider's security portal.
• Account Deletion & Data Purging: Upon deleting your Velocity account, all associated third-party connected accounts, integration entities, and stored authentication credentials are automatically and permanently purged.

Third-party services connected through Composio process data subject to their own independent privacy notices and terms of service. You remain responsible for ensuring you have appropriate rights and authorization to grant Velocity access to those third-party services.

Velocity uses third-party payment infrastructure to process payments, subscriptions and wallet top-ups.

Depending on the transaction, we may receive payment-related metadata such as payment identifiers, order identifiers, transaction status, amount, currency, timestamps, refund status and subscription information.

Razorpay separately processes personal and transaction information under its own privacy documentation.

We use payment information to confirm transactions, credit prepaid balances, reconcile usage, process refunds where applicable, prevent fraud and maintain accounting records.

Velocity may use transactional email providers such as Resend to send account, billing, security, support, webhook and other operational communications.

Depending on the message, email providers may process your email address, message metadata, delivery information, IP information and the content necessary to deliver the message.

Resend publishes its own Privacy Policy and related legal documentation describing how it handles information in connection with its service.

Transactional and security-related communications may continue even if you opt out of optional marketing communications.

Velocity may use Svix to provide customer-facing webhook functionality, including endpoint management, event delivery, retries, delivery monitoring and webhook-related logs.

When you configure a webhook endpoint, information necessary to deliver events may be transmitted to Svix and subsequently to your configured endpoint.

Webhook payloads may contain information associated with the Velocity event that you subscribed to. You are responsible for ensuring that your webhook destination is secure and authorized to receive that information.

Svix describes its service as providing webhook delivery, retries, endpoint management, observability and security functionality.

You should not include unnecessary sensitive information in webhook payloads.

Velocity may use Arcjet or similar security tooling for application security, rate limiting, bot detection, abuse prevention and related security controls.

Arcjet's SDK architecture includes security processing within the application environment, and Arcjet states that certain sensitive-information detection can occur locally without the raw data leaving the application environment.

The exact information processed depends on the Arcjet features and rules enabled by Velocity.

Velocity uses Sentry (Functional Software, Inc.) for application performance tracing, exception tracking, runtime crash analysis, and software diagnostic telemetry across our client interfaces and backend services.

To ensure reliable delivery of diagnostic telemetry and prevent data loss from browser ad-blockers, client-side Sentry requests in the browser are routed through a secure, first-party Next.js server proxy tunnel before transmission to Sentry ingest servers.

When a software bug, unhandled exception, or unexpected crash occurs, Sentry captures technical context including:

• Error messages, exception types, and full stack traces.
• Performance tracing metrics, API request durations, and database query latencies.
• Application release versions, build identifiers, and deployment environment.
• HTTP request metadata, URL endpoints, and response status codes associated with the failure.
• Browser version, operating system, device characteristics, and viewport size.
• Breadcrumb logs leading up to the error (such as UI clicks or route transitions).
• Pseudonymous user identifiers (such as user ID or session ID) to measure error frequency and user impact.

Session Replay Clarification: Sentry's video-like Session Replay feature is disabled in our Sentry configuration. Product analytics and interaction session replays are managed separately through PostHog, which operates under strict client-side data masking for passwords, payment details, and personal input fields.

We enforce automated data scrubbing and privacy sanitization rules to ensure that sensitive personal data, authentication tokens, passwords, payment details, private workspace repository contents, and environment variables are masked or stripped before transmission to Sentry.

Sentry processes error telemetry in compliance with international privacy standards, including GDPR, SOC 2 Type II, and Standard Contractual Clauses (SCCs) for cross-border data protection.

Velocity's web application, APIs, and edge proxy routing are hosted across globally distributed third-party infrastructure providers including Vercel and Cloudflare.

Cloudflare Workers & Edge Proxy: We deploy serverless edge workers (such as our high-performance proxy on Cloudflare Workers mapped to connect.velocity.fairarena.app) to securely route, multiplex, and proxy real-time workspace traffic, manage WebSocket tunnels to development environments, and enforce edge rate limits.

Cloudflare Observability, Logging & Analytics: In accordance with our operational standards, Cloudflare Workers observability is enabled to capture live invocation logs, execution traces, exception stacks, subrequest latency metrics, and error telemetry. This enables our engineering team to detect routing anomalies, diagnose connection timeouts, mitigate abuse, and maintain 99.9% uptime.

Security, WAF & Edge Protection: Cloudflare provides enterprise DDoS mitigation, TLS/SSL transport encryption, Web Application Firewall (WAF) filtering, and bot protection. Technical identifiers (such as CF-Ray request identifiers,CF-IPCountry, andCF-Connecting-IP headers) are processed to inspect traffic integrity, prevent malicious attacks, and authenticate edge proxies.

Vercel describes collection and processing associated with its websites and hosting services in its current Privacy Notice. Cloudflare describes its independent security, network logging, and data-protection commitments in the Cloudflare Privacy Policy and Data Processing Addendum (DPA).

Velocity utilizes enterprise-grade managed database and caching infrastructure to securely persist and retrieve application state:

• Upstash Redis - Serverless in-memory caching, real-time rate limiting, and low-latency session management.
• NeonDB - Serverless PostgreSQL for scalable relational data storage and transactional integrity.
• Microsoft Azure - Managed cloud database and compute infrastructure.
• Prisma ORM - Type-safe database client and query builder enforcing schema validation.
• Aiven - Managed open-source database clusters including PostgreSQL and Redis.

All database and caching connections utilize encrypted transport security (TLS/SSL), secrets management, and least-privilege administrative access controls to safeguard data integrity.

Velocity may use cookies, local storage, session storage and similar technologies to maintain authentication sessions, remember preferences, provide security features, monitor application errors, measure service usage and support application functionality.

Some third-party providers (including Clerk, Sentry, PostHog, and Cloudflare) may also use cookies or similar technologies when their services are integrated into our application.

For detailed information on our use of cookies, storage keys, and controls, please review our dedicated Cookie Policy.

We use reasonable technical and organizational safeguards appropriate to the nature of the information we process.

• Authentication and authorization controls.
• Role-based access controls where applicable.
• Encryption of data in transit using industry-standard transport security.
• Restricted access to production systems and credentials.
• Secret management and environment-level credential protection.
• Automated data scrubbing for error reporting and diagnostics.
• Logging and monitoring of security-relevant events.
• Abuse prevention and rate limiting.
• Sandbox isolation for development workloads.
• Security updates and dependency management.
• Administrative controls for production infrastructure.

No Internet-connected system can be guaranteed to be completely secure. You should therefore also protect your account credentials, API keys, OAuth credentials and data.

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing Services, maintaining security, resolving disputes, enforcing agreements, complying with legal obligations and maintaining accounting and transaction records.

Different categories of information may have different retention periods.

We do not promise that deleted information will be immediately removed from every backup, cache or disaster-recovery system. Residual copies may remain for a limited period until securely overwritten or otherwise removed in accordance with our retention procedures.

You may request deletion of your Velocity account by contacting us or using the account-deletion functionality provided in the application, where available.

Deletion may result in the permanent deletion of associated workspaces and other data according to the applicable workspace lifecycle.

We may retain information where necessary to comply with legal obligations, maintain financial and transaction records, prevent fraud, resolve disputes, enforce agreements, investigate security incidents or otherwise exercise legally permitted rights.

Depending on your location and applicable law, you may have rights relating to your personal data, including rights to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal data where legally available.
• Request information about how your personal data is processed.
• Withdraw consent where processing is based on consent.
• Request restriction or objection where applicable under relevant law.
• Request portability where applicable under relevant law.
• Lodge a complaint with an applicable data-protection authority.

These rights are subject to applicable legal conditions and exceptions. For example, we may need to retain certain transaction, security or legal records even after an account deletion request.

To submit a privacy or data-rights request, contact:

We may need to verify your identity before fulfilling a request to protect against unauthorized access to personal data.

We will respond within the period required by applicable law.

Because Velocity relies on globally distributed technology providers, personal data may be processed or stored in countries other than the country in which you reside.

For example, providers such as Clerk (USA), Sentry (Functional Software, Inc., USA), Daytona, Vercel (USA), Cloudflare (USA), GitHub (USA), GitLab and other infrastructure providers operate internationally. Their respective privacy documentation describes their international processing practices.

Where applicable, we use legally recognized transfer mechanisms, including Standard Contractual Clauses (SCCs) and contractual safeguards required for international transfers.

Velocity is a developer infrastructure service and is not directed toward children.

You must not use the Services where doing so would violate applicable age restrictions or child-protection laws.

If we learn that we have collected personal data from a child where collection is prohibited by applicable law, we will take reasonable steps to address the situation.

Velocity may contain links to or integrations with third-party services.

Once you leave Velocity or interact directly with a third-party service, that provider's privacy policy governs its independent processing.

We encourage you to review the privacy policies of third-party services before connecting them to your Velocity account.

We may update this Privacy Policy when our Services, technology, legal obligations or data-processing practices change.

We will update the "Last Updated" date when changes are made. Where required by applicable law, we will provide additional notice or obtain consent for material changes.

The current version of this Privacy Policy will be available on this page.

This Privacy Policy should be read together with our: