Privacy Policy

At Veel, we respect your privacy and are committed to being transparent about what we collect, why, and how you can opt out. This Privacy Policy covers both Veel Scenepacks (veelscp.com) and Veel Community (veelscp.com/community).

1. What We Collect

Account information (Community only)

If you create a Veel Community account, we store:

• Username and password (passwords are hashed with bcrypt — we cannot read them)
• Email address (used for account recovery only)
• Profile information you voluntarily add (bio, avatar, banner)
• Content you create (posts, comments, messages)

Analytics data (only with your consent)

If you accept cookies on the homepage, we collect anonymous usage data to understand how people use the site. This is described in full in Section 2 below. If you decline, nothing is collected — see Section 2 for exactly what that means technically.

What we never collect

• IP addresses
• Device fingerprints or hardware identifiers
• Location data
• Data about you from other websites

2. Cookie Consent & Analytics

When you first visit veelscp.com, you'll see a cookie consent banner. Your choice is stored in your browser's localStorage and applied across the entire site — including all sub-pages — for every future visit.

This consent is real and enforced in code, not just in words.

If you accept cookies

The following analytics systems are active:

Service	Operated by	What it collects
Google Analytics (GA4) ACTIVE	Google LLC	Page views, session duration, general device/browser type, country-level location. Sets _ga and _gid cookies. Data is processed by Google and subject to Google's Privacy Policy.
Vercel Analytics ACTIVE	Vercel Inc.	Page views and navigation events. Cookie-free and aggregated only — no individual user profiling. Subject to Vercel's Privacy Policy.
Veel Internal Tracker ACTIVE	Veel (us)	Search queries you type, which scenepacks you click, download events, scroll depth milestones, and anonymous session data. Stored in our own MongoDB database. Never sold or shared.

If you decline cookies

• Google Analytics: Google's official opt-out flag (window['ga-disable-G-5R4M79P603']) is set to true before GA initialises, preventing any data from being sent. Any _ga, _gid, and _gat cookies already present in your browser are deleted on the spot.
• Vercel Analytics: The script is never downloaded. A privacy gate runs as an inline script at the very top of every page — before any deferred scripts execute — and conditionally prevents the Vercel Analytics file from loading if you previously declined.
• Veel Internal Tracker: The tracker checks your consent preference before doing anything. If declined, every tracking function is replaced with a silent no-op. No session is created, no events are queued, no API calls are made.

This preference persists across every page on the site. You will not need to re-decline on the Community page, the Sports page, or any other sub-page — your choice applies everywhere.

Changing your preference

Your consent is stored under the key veel_cookie_consent in your browser's localStorage. To reset it and see the banner again, you can clear your site data in your browser settings, or open DevTools → Application → Local Storage → delete the veel_cookie_consent key.

3. Images & Media Uploads

Images uploaded to Veel — including profile avatars, banners, and community post images — are hosted on the Veel CDN (cdn.veelscp.com), our own dedicated content delivery infrastructure.

• Uploaded files are stored on Veel CDN servers.
• We do not share image data with third parties.
• If you delete your account, images associated with your account will be removed from our CDN within a reasonable timeframe.

4. How We Use Your Information

We use information only to:

• Create and maintain your account
• Allow you to participate in the community (posts, DMs, notifications)
• Moderate content and enforce our community guidelines when necessary
• Improve the scenepack catalogue and site features using aggregated analytics (only when you've consented)

We will never sell, rent, or trade your personal information to any third party. Ever.

5. Direct Messages & Group Chats

• Your private messages are stored in our database so they can be delivered to recipients.
• We do not read or monitor private messages unless required by law or necessary to investigate a reported abuse or policy violation.
• Messages are not end-to-end encrypted at this time — they are encrypted at rest in our database but are technically accessible to platform administrators. We are working toward E2EE for DMs.

6. Third-Party Services

The following third-party services may be active depending on your cookie consent choice:

Service	Purpose	Active when
Google Analytics	Site usage analytics	Cookies accepted
Vercel Analytics	Page view tracking	Cookies accepted
Google Fonts	Typography (Inter, Space Grotesk)	Always — fonts are loaded from Google's CDN. No personal data is retained by Google for font requests beyond standard CDN logging.
Font Awesome CDN	Icons	Always — served from Cloudflare's CDN. Standard CDN logging only.
TMDB (The Movie Database)	Scenepack metadata (posters, cast, descriptions)	Always when viewing scenepack details — API requests go to TMDB's servers. No user data is sent; only the scenepack title/ID is queried.
Discord Webhooks	Internal admin notifications for new uploads	Admin-only, not triggered by user actions.

No service listed above receives personally identifiable information about you beyond what is technically necessary for the request (e.g., your IP address may be visible to CDN providers as a normal part of HTTP requests).

7. Data Storage & Security

• User account data and community content is stored in a MongoDB Atlas database with access controls and encryption at rest.
• Passwords are hashed with bcrypt before storage — we cannot recover or read your password.
• Authentication uses short-lived JWT tokens. These are stored in your browser's localStorage and are not accessible to other sites.
• If you delete your account, your personal data (profile, posts, messages) will be permanently removed from our database within 30 days.
• In the event of a data breach that affects your personal information, we will notify affected users as quickly as reasonably possible.

8. Your Rights

You have the right to:

• Access the content and data associated with your account
• Correct inaccurate profile information at any time via your profile settings
• Delete your account and all associated data
• Opt out of analytics by declining or withdrawing cookie consent (see Section 2)
• Request data erasure by contacting us at [email protected]

If you are located in the European Economic Area, you have additional rights under the GDPR including the right to data portability and the right to lodge a complaint with your local supervisory authority.

9. Children's Privacy

• Our platform is intended for users 13 years or older (or the minimum age required by local law, whichever is higher).
• We do not knowingly collect personal information from children under 13.
• If you believe a child has created an account, please contact us and we will remove it promptly.

10. Updates to This Policy

• We may update this Privacy Policy as the platform evolves.
• The "Last Updated" date at the top of this page will always reflect the most recent revision.
• For significant changes that affect how we handle your data, we will post a notice on the site.
• Continued use of the platform after an update constitutes acceptance of the revised policy.