Privacy notice
Short version: we keep a scrambled account id, a counter of how many bytes you used today, and a log of which website addresses (such as example.com) your account connects to, for 30 days, to stop illegal and abusive use. We do not keep your e-mail, your name, your IP address, the pages you read, your searches, or anything you type.
Who is responsible
Veil private beta, contact privacy@efm.lol. Questions or complaints about your data go there.
What we store, why, and for how long
| Data | Why | Kept |
|---|---|---|
| Account id: an irreversible keyed hash (HMAC) of your Google account's id. We ask Google for nothing else, so we never receive your e-mail, name or photo. | So you can sign in again and keep your allowance. (Art. 6(1)(b), providing the service.) | Until you delete the account. |
| Time you accepted the terms, and your plan. | Proof of acceptance; allowance size. | Until you delete the account. |
| Sign-in sessions (random token, stored only as a hash). | To keep you signed in. Strictly necessary cookie, so no consent banner. | 30 days, or until you sign out. |
Connection log: the website address (host name and port, for example example.com:443) your account opened, and the time. The same address within 10 minutes is logged once. No page addresses, search terms, page contents, passwords or messages: we cannot see those, because secure sites are encrypted from your browser to the site. | Preventing illegal and abusive use, answering abuse reports and legal claims, and being able to block bad actors. (Art. 6(1)(f), legitimate interest. This is the only way we can say no to people who misuse the service.) | 30 days, then deleted automatically. It is not removed when you delete your account; it expires on its own schedule. |
| Bytes used per day. | To enforce the free daily allowance. | 35 days, then deleted automatically. |
| Your IP address. | Held in memory only, for about a minute, to slow down sign-in abuse. Never written to disk. (Art. 6(1)(f), security.) Our web server's access logs are switched off. | Under 1 minute. |
Who can see the connection log
Only the operator. It is looked at when there is an abuse report, a sign of misuse, or a legal obligation, and for nothing else: not for advertising, not for profiling, and not shared with anyone except authorities where the law requires it. A matching account may be blocked.
What we do not store
Page addresses (URLs), what you search for, page contents, passwords you type into other sites, your e-mail, your name, or your IP address. There is no analytics, no advertising and no third-party tracker on this site.
What you should know anyway
- While you browse, your traffic passes through our server. Secure (https) sites are encrypted between your browser and the site, so we only handle encrypted bytes and the name of the destination in transit. Plain http sites are not encrypted and could be read in transit. We do not do it and do not store it, but you should not rely on that for anything sensitive.
- The sites you visit see our server's address instead of yours. This is not an anonymity tool: your Google sign-in links your account to your use, and our hosting provider can see that your device connects to our server.
- Sites you open through Veil can set their own cookies and trackers. Those are their business, not ours.
Who else is involved
- Google handles the sign-in and tells us only your account's id. Their own privacy policy applies to that step.
- Hosting provider (a virtual server in Europe) runs our server. It processes data on our behalf.
We do not sell or share your data with anyone else. We pass it on only if the law forces us to, and we cannot give out what we do not have.
Your rights (GDPR)
You can download everything we hold, including your connection log (menu → Download my data), and delete your account (menu → Delete my account). Deleting removes your account, sessions and usage at once; the connection log stays until its 30 days are up, for the security reason above. You can also ask us to restrict processing or object to it by writing to privacy@efm.lol. Because we hold so little, there is nothing to correct. You may object to the connection log by writing to us; we will weigh your reasons against the need to prevent abuse. You have the right to complain to your data protection authority; in Norway that is Datatilsynet.
Security
Encrypted connections only (HTTPS, HSTS). Websites you browse run on a different address from your account, so they cannot reach your session. Access to destinations that are local, private or on mail and file-sharing ports is blocked.
Children
Veil is for people aged 16 and over.
Source code
Veil is built on open-source software (Ultraviolet, Wisp, Epoxy) and is offered under their licences. Source is available on request at privacy@efm.lol.
Changes
If this notice changes in a way that matters, we will say so on the sign-in page. Last updated 2026-10-23 (connection log added).