VeloAssist

VeloAssist policy

Privacy Policy

VeloAssist is built so that your screen, your keystrokes and your files go directly between your own devices. We do not have accounts, we do not run analytics, and we cannot see your sessions.

Last updated 29 October 2026Privacy questions

Who we are

VeloAssist and VeloAssist Host are made by LV-223 Pty Ltd, trading as VeloSec, in Australia. We handle personal information under the Australian Privacy Principles in the Privacy Act 1988. Contact us at assist@velosec.au.

In short

  • No VeloAssist account, sign-in, advertising, tracking or analytics, in the apps or on this website.
  • Remote sessions run directly between your devices and are encrypted end to end. Screen contents, keyboard and pointer input, clipboard and files never pass through our servers.
  • Your machine list, notes, tags and groups stay on your devices, or in your own iCloud account if you turn on iCloud sync.
  • A small signalling service helps your devices find each other over the internet. It sees network addresses and device key fingerprints while it connects them, never session contents, and keeps no logs of who connected to what.

Data on your devices

  • Device keys. Each install creates its own private key in the device keychain. It never leaves the device and is never synced.
  • Paired devices. The Host keeps a list of the devices you approved (their name and public key) in its keychain. You can revoke any of them at any time.
  • Machine list. The VeloAssist app keeps the remote machines you added, with any names, notes, tags, groups and Tailscale addresses you enter.
  • Screen thumbnails. The app keeps a small image of each remote machine's last screen to show on its card. Thumbnails stay on the controller, are never synced, and can be turned off per machine.
  • Activity log. VeloAssist Host records each session on the machine it runs on: which paired controller connected, when, for how long, and the network path and address it used. It keeps 30 days and never sends the log anywhere.

iCloud sync

If you turn on iCloud sync in the app's Settings, your machine list, groups, notes, tags and Tailscale addresses are stored in your private iCloud database through Apple's CloudKit. Machine names, notes, tags, Tailscale addresses, host fingerprints and group names are end-to-end encrypted with keys in your iCloud Keychain. We have no access to your iCloud data. Device keys and thumbnails are never synced. You can delete the synced copy at any time with Delete VeloAssist data from iCloud in Settings. Apple's handling of iCloud data is covered by Apple's privacy policy.

The signalling service

When you connect over the internet, your devices exchange a few signed, encrypted setup messages through our signalling service at signal.assist.velosec.au, which runs on Cloudflare. After that, the session goes directly between your devices.

  • What it sees: the IP addresses of connecting devices, the public key fingerprints of a Host and of the devices paired with it, and when a Host is online. Setup messages are encrypted end to end, so the service cannot read them.
  • What it stores: for each Host that uses it, the Host's public keys, the time it came online, and the fingerprints of the devices allowed to reach it. Nothing is stored for a fingerprint that never connects as a Host.
  • No logs: the service keeps no request logs. No record is kept of which addresses connected, to which Mac, or when. We see only aggregate counts and error rates, with no addresses or fingerprints, to keep it running.

To find a direct path, the apps also ask public STUN servers run by Cloudflare and Google for your public network address. Those servers see your IP address and port, and nothing else.

Your network

On a local network, devices find each other with Bonjour and connect directly, without using the signalling service. For internet sessions, VeloAssist Host may ask your own router to open a temporary port (UPnP, NAT-PMP or PCP), which it removes when the session ends. If you use Tailscale, VeloAssist connects over your tailnet like any other app on it.

This website

assist.velosec.au uses no cookies, analytics or third-party scripts. It is hosted on Cloudflare, which processes your IP address to deliver the pages.

App Store and TestFlight

VeloAssist is distributed through Apple. If you choose to share crash reports or TestFlight feedback with developers, Apple passes them to us; they can include your device model, system version and the feedback you write. We use them only to fix problems.

Sharing and selling

We do not sell or share personal information, and we do not use it for advertising. The service providers above (Cloudflare, Google for STUN, and Apple) process data only to provide their part of the service.

Your choices and rights

  • Turn iCloud sync, thumbnails and internet access on or off in the apps at any time.
  • Revoke a paired device on the Host, which also removes it from the signalling service's allow list.
  • Delete the apps to remove their data from a device, and use Delete VeloAssist data from iCloud to remove the synced copy.
  • Ask us what we hold about you, or to correct or delete it, at assist@velosec.au. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Children

VeloAssist is not directed at children and we do not knowingly collect information from them.

Changes

If we change how VeloAssist handles data, we will update this page and the date at the top before the change takes effect.