Veylo
Open Veylo

Privacy policy

Last updated 30 September 2026

In short

Veylo runs in your browser and keeps your boards on your device. There are no accounts, no cookies, no analytics and no advertising, and the site loads nothing from third parties. The only personal data we process is the technical data your browser sends to our web server when you open the site, and any message you send us yourself.

Who is responsible

The controller under Art. 4 (7) GDPR is:

Name
Johannes Müller
Address
Dr.-Reinhard-Weg 2
88281 Schlier
Germany
Email
mail@jotrorox.com
Phone
+49 177 3149134

Hosting and server log data

This website is hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA (railway.com). We have chosen Railway’s EU region in the Netherlands as the server location. When you open a page, the web server automatically processes the following technical data:

  • your IP address
  • date and time of the request
  • the page or file requested and the HTTP status code
  • the amount of data transferred
  • the referring page and your browser and operating system, as reported by your browser

We process this data to deliver the website to you and to keep it secure and stable. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in running the site reliably and safely. The web server software we run does not keep its own request log. We do not combine the data with other data and do not use it to identify you. Log data is deleted after 30 days.

Railway processes this data on our behalf as a processor under a data processing addendum pursuant to Art. 28 GDPR. Railway states that its main processing operations take place in the United States and that it uses sub-processors, a current list of which is available at trust.railway.com. Personal data may therefore be transferred to the United States. The transfer relies on the EU-U.S. Data Privacy Framework where the recipient is certified and otherwise on the EU standard contractual clauses (Art. 46 (2) (c) GDPR), which are part of the addendum. To the extent Railway processes service usage data, such as activity logs, for its own purposes, for example to operate and secure its platform, it does so as an independent controller under its own privacy policy (railway.com/legal/privacy).

Domain and DNS

Our domain is registered with Namecheap, Inc. (USA), which also runs the DNS servers (Namecheap Advanced DNS) that tell your device which server to contact. When your device or its DNS resolver looks up our domain, these servers can see the IP address of the requesting resolver and the domain name that was queried. We process this data so that the website can be reached. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in a working website. Because Namecheap is based in the United States, this may involve a transfer to a third country, which relies on appropriate safeguards under Art. 44 ff. GDPR.

Data stored in your browser

Veylo saves your boards, columns, cards, tags, subtasks, due dates and display settings, such as the sidebar and the board or list view, in your browser’s local storage. This data stays on your device. It is not sent to us or to anyone else, and we cannot see it.

Local storage is needed to provide the function you asked for, so no consent is required under § 25 (2) no. 2 TDDDG. Because the data lives only in your browser, it does not sync between devices. To delete it, remove your boards in Veylo or clear this site’s data in your browser settings.

Cookies, analytics and third parties

Veylo does not set cookies and does not use analytics, tracking, advertising or social media plugins. Fonts, styles and scripts are served from this website itself, so your browser does not contact any other server when you use it. The web server also instructs your browser not to send referrer information and to block connections to other sites.

Contacting us

If you write or call us, we process your contact details and your message to answer you. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or steps before one, and otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering enquiries. We delete the data once your request is dealt with, unless we are legally required to keep it. Our email is handled by Tuta Mail (Tutao GmbH, Hannover, Germany), which processes messages on our behalf as our email provider.

Recipients and storage periods

Your data is passed on only to the service providers described above: Railway and its sub-processors for hosting, Namecheap for the domain and DNS, and Tuta Mail for email. We do not sell it or share it with anyone else. Server log data is deleted after 30 days. Messages you send us are kept until your request is dealt with, plus any period the law requires. Data in your browser stays until you delete it.

No obligation to provide data, no automated decisions

You are not obliged to provide personal data to use Veylo. Your browser sends the technical data listed above automatically because it is needed to load the site. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Your rights

You have the right to:

  • access the personal data we hold about you (Art. 15 GDPR)
  • have inaccurate data corrected (Art. 16 GDPR)
  • have your data erased (Art. 17 GDPR)
  • have processing restricted (Art. 18 GDPR)
  • receive your data in a portable format (Art. 20 GDPR)
  • object to processing based on legitimate interests (Art. 21 GDPR)

To use any of these rights, contact us at the address above. If you object to processing based on Art. 6 (1) (f) GDPR, we will stop it unless we can show compelling legitimate grounds that override your interests.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), baden-wuerttemberg.datenschutz.de. If you follow that link, your browser connects to the authority’s website, which has its own privacy policy.

Security

This website is delivered over an encrypted HTTPS connection.

Changes to this policy

We will update this policy if the website or the law changes. The current version is always available on this page.