Privacy Policy — Veludio

Effective date: February 2026 | Last updated: February 2026

Overview

      Veludio is a calendar kiosk platform. We do not sell your data, show you ads, or share your information with third parties for marketing purposes.
    

This Privacy Policy explains what information Veludio collects, how it is used, and your rights regarding that information. By using Veludio you agree to the practices described here.

Information We Collect

Account information — When you create an account we collect a username and hashed password. You may optionally provide an email address for account recovery.

Google account information — If you choose to connect your Google account, we receive your Google account email address and a unique identifier from Google. We use this solely to link your Google account to your Veludio account.

Google Calendar data — If you grant calendar access, we receive OAuth tokens that allow us to read your Google Calendar event data. This data is used exclusively to display your calendar on your kiosk screen. We do not store your calendar events — they are fetched in real time and rendered directly on your display.

Display configuration — Your kiosk display settings (layout, colours, weather location, calendar preferences) are stored on the server running your Veludio installation.

How We Use Google Calendar Data

      Google Calendar data is used for one purpose only: displaying your calendar events on your kiosk screen.
    

Specifically, when your kiosk display requests calendar data:

We use your stored OAuth token to request event data from Google's Calendar API
The event data is passed directly to your kiosk display
Event data is not stored in our database, logged, analysed, or shared
OAuth tokens are stored encrypted using AES-256-GCM encryption

We request the minimum necessary scope: calendar.readonly — read-only access to your calendar events. We cannot create, edit, or delete your calendar events.

Data Storage and Security

Your data is stored on the server running your Veludio installation. Veludio is self-hosted software — the operator of your installation is responsible for server security.

Passwords are hashed using bcrypt and never stored in plain text
OAuth tokens are encrypted at rest using AES-256-GCM
All connections use HTTPS
Session cookies are HttpOnly and Secure

Data Sharing

We do not sell, trade, or transfer your personal information to third parties. We do not use your data for advertising. The only third-party service we communicate with on your behalf is Google, and only when you have explicitly connected your Google account.

Your Rights and Choices

You can disconnect your Google account at any time from the Calendars tab in the Veludio admin panel. This immediately revokes our access to your Google Calendar data and deletes your stored OAuth tokens.

You can request deletion of your account and all associated data by contacting the administrator of your Veludio installation.

You can also revoke Veludio's access to your Google account at any time at myaccount.google.com/permissions.

Cookies

Veludio uses a single session cookie to keep you logged in to the admin panel. This cookie contains no personal information and is deleted when you close your browser or log out. We do not use tracking cookies or third-party cookies.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of Veludio after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this Privacy Policy or how your data is handled, please contact the administrator of your Veludio installation.