Volidra privacy notice

This notice explains what personal data Volidra collects when you use our website, our apps and your Volidra account, why we collect it, who receives it, how long we keep it and what your rights are. Volidra is operated by Pelluci LLC, a Wyoming limited liability company. Registered address: 30 N Gould St, Ste N, Sheridan, WY 82801, USA. Privacy contact: privacy@volidra.com.

Who is responsible for your data

Pelluci LLC is the controller of the personal data described in this notice. We receive your data from you and your devices and, for purchases, from the payment and store providers named below (Paddle, Apple and Google), which tell us whether a purchase was made, renewed or refunded. To sign in, buy or get support we need your email address and the purchase records; without them we cannot provide those services. Write to us about anything in this notice at privacy@volidra.com.

Your account

To sign you in, the account service emails a short-lived link to the address you give it. Its restricted database stores a keyed email lookup, an opaque account identifier, verified sign-in and session state, and each registered device's name, platform and release and build identifiers. Raw email addresses are sent to Resend for delivery and are not stored in that account database. Signed-in account actions use durable sessions that can be revoked.

Signed-in security. Your account page lists where you are signed in. For each session we keep when it started and ends, how it started (an emailed link or a passkey) and a coarse label made from two fixed lists, a browser family and a system family (for example "Safari on Mac"); your browser's user agent is read once to make the label and is not stored in our account database (like any web request it also reaches Cloudflare, whose request logs are described under the Mac compatibility check below). You can add passkeys to your account: for each we keep the public key your device made, a counter, the name you gave it and when it was added and last used, never a fingerprint, a biometric or a secret; your device keeps the private key. A passkey is an extra way in, never the only one. We also keep a short history on your account page, for 90 days: a passkey was added or removed, or sessions were signed out. Sessions, passkeys and the history go when the account is deleted, and a removed passkey's record is deleted after 90 days.

Purchases, payments and refunds

Paddle processes billing for purchases on our website; Google Play and Apple process purchases in their stores. RevenueCat resolves entitlements and reconciles store and provider receipts using the opaque account identifier. We keep immutable purchase terms, provider transaction and purchase identifiers, refunds and transfers, to preserve your purchase rights and to reconcile billing. These identifiers are not analytics dimensions. No payment credential or customer file content is required by our account-deletion flow.

If you ask Apple to refund an App Store purchase and you have agreed to it in the app, we answer Apple's request with only the three items its interface requires: that you agreed (customerConsented), whether the purchase was delivered and works (deliveryStatus), and whether a free sample was offered before purchase (sampleContentProvided). If the purchase was not delivered, we add that none of it was used. We send Apple no other usage information and no file names, contents, drive identifiers, name or email address. If you have not agreed, we send Apple nothing.

To apply the rule of one change-of-mind refund per customer, we keep a record that a refund was given. It is tied to the payment provider's customer reference and to the opaque account identifier, not to your email address, and is kept for as long as the purchase records are kept.

The Android app retains minimal pending or unknown purchase-intent metadata in AndroidKeyStore-encrypted local no-backup state to reconcile payment and prevent a competing checkout. It includes the opaque account and reservation, logical product, build, SKU, terms and phase, without an email, session credential, licence or file content in each intent. Online account deletion does not remotely erase this protected local purchase state.

Licence checks

An app asks our service for a signed licence when you act, and which action depends on the app: pressing Refresh, finishing or restoring a purchase in the app (Android, iPhone and iPad), or signing in (Linux). The Linux app, in release builds, also asks about every 15 minutes while it runs and you are signed in. While a new licence is still in its refund period, an app may also ask once when it opens, to see whether the purchase has been refunded, and only when it is online. An app does not ask at any other time. Each request carries your signed-in session and the device's key, and the answer is a signed licence for that device; a refunded licence stops working the next time the app checks it.

Separately from optional measurement, the server observes successful personal license issuance and verified refunds for limited abuse detection. It retains purpose-specific keyed account, purchase and device pseudonyms and hour-level event times for at most 30 days, with a limit of 512 observations per account. Duplicate refreshes and refund deliveries do not add observations. Only extreme device churn or repeated activated-and-refunded purchases across many devices produce an advisory signal for restricted manual inspection. An ordinary device replacement or a refund alone does not produce a signal. These abuse signals never decide entitlement, block a transfer, interrupt storage writes or restrict a refund; the rule of one change-of-mind refund per customer uses only the refund record described above, never these signals. Account deletion removes the linked observations. No raw device key, email, IP address, license payload, storage identity or file content enters this observation table.

Support

If you write to us at our support or privacy addresses, or use a support form, we receive your email address and whatever you send us. We keep the conversation so that we can answer you and handle follow-up questions about your account or purchase. Our help desk deletes each conversation, with its attachments, 24 months after its last message. We keep one record per email address, so the record of your address stays for as long as any of your conversations does. An encrypted backup of the help desk can keep a deleted message for up to 35 more days. Our email provider also holds copies of the messages in our mailboxes; we remove them when you ask us to delete your data. Please do not send passwords, recovery keys or PINs, and do not send file contents.

Aggregate counts of purchases and licences

We look at aggregate numbers about how Volidra is bought and used. Counts of purchases, renewals, refunds and licence activations (by platform) come from the purchase and licence records we already keep to deliver your licence, and they ask nothing more of your device. The country of a purchase appears only in the reports of Paddle, Apple and Google; we do not store it. A count holds no name, email address or file information, and the identifiers in those records are never a dimension of a count.

What we never receive

Our website, measurement, support and purchase systems never receive filenames, drive names, volume identifiers, plaintext recovery credentials, file metadata or the contents of your files. Billing receives no storage content and no recovery keys.

Measurement on our website

We use no advertising pixels and no session replay. Optional website measurement is off until you choose Allow. Like any website, ours receives the normal request and security information that hosting and abuse prevention need. Account rate-limiter keys are derived from the connecting address under a purpose-specific keyed hash; raw addresses are not stored in the account tables or in measurement.

Website measurement. Volidra can measure how its website is used: for example, which page design you saw and which kind of Mac the compatibility check found. It stays off unless you choose Allow under "Optional measurement" (under Privacy choices at the bottom of every page; you can change the choice at any time). If you allow it, this site sets measurement cookies (they are listed under "Cookies on this website"), and the design comparison uses a random code that your browser keeps. We keep only a keyed one-way code of it, with the design you saw and the page events linked to it (for example that you viewed a page or ran the compatibility check), and with a few coarse facts about the visit: which kind of visitor you are (for example a first-time visitor), a coarse device type, how you arrived (directly, from a search, from a link or from a paid link), your language and the part of the site you were on. We keep them for up to 120 days; then the assignment and its events are deleted. Our operations tooling can also record, against a visit code, the minutes of support that visit needed; the support form never attaches a visit code. The Mac count described below sets no cookie and uses no code. There are no advertising trackers and no session recording, and measurement never includes anything about your files or drives.

Optional measurement in the Volidra apps is separate from this and has its own section below, "Optional measurement in the apps".

The Mac compatibility check on our website reads in your browser what your browser reports about your Mac and shows you the result; that is the service you asked for, and it works the same for every visitor. Only if you have chosen Allow under "Optional measurement" (it is off until you choose Allow, and you can change the choice at any time under Privacy choices at the bottom of every page) does the check also send us one anonymous count of the result: one of four labels (a browser that reports an Apple silicon Mac with a supported macOS, one that reports Apple silicon with an older macOS, one that reports an Intel chip, or not determined), at most once per page view, remembered only in the page's memory, so nothing is written to your device for it. If you have not chosen it, nothing is sent. The page sends the count without cookies, and we do not read or set a cookie for it. Like any web request it reaches us with your network address, which we use for the rate limit and which appears in the request logs described next; our database does not store it, or any identifier of your browser or device, with the count. Cloudflare, which hosts our site, also keeps request logs and traces, which can include this one: they can include the address that was requested and request details such as your network address and your browser's user agent, Cloudflare keeps them for up to seven days, and we use them to run and secure the service, not for this count. The platform's rate limiter counts requests per network address, using a one-way code of it, for a minute, which is the "Security, abuse and fraud prevention" processing in the table below. What we keep for the count is anonymous aggregate data: a daily total per label, used to decide whether Volidra for Mac should support Intel Macs, kept for 25 months and then deleted.

Cookies on this website

Every cookie the site can set is listed here, generated from the cookies the application actually sets, so the list cannot drift from the code. All of them are first-party; none is set by a third party and none is used for advertising. Cookies in the measurement category are set only if you choose Allow under "Optional measurement".

Optional measurement in the apps

The Volidra apps for Windows, Android and Linux can send optional measurement. It is off until you turn it on in the app, and you have to be signed in to choose. The apps for Mac, iPhone and iPad send no measurement. Apart from the optional measurement described here, no app sends usage statistics of any kind, such as which drives you open or which errors happen, and no setting turns them on; if one ever does, it will be its own choice, described here before it sends anything.

It is not anonymous. The app reports it while you are signed in, and what we keep is tied to your account and this installation by keyed codes (see below), because the report described below has to tell which of your own steps happened. It never decides anything about you: not your licence, a refund, support, or your access to your files.

What the app sends. Your choice (on or off); that this installation finished its first drive session with a write and a normal safe close; and that this installation verified and saved a signed licence (its activation), which it proves with a one-time receipt that comes with the licence. Each request carries your signed-in session and this installation's key, as every other request the app makes to your account does. It contains no file name, file content, drive name, drive identifier, path, key, passphrase or licence bytes.

What we keep. For each installation that has it on: the platform; whether it is a customer or a test installation (test installations are kept apart from customer totals); the date, without a time, of the first completed session; the date of the activation; the version of the disclosure you chose; and the date the choice ends, and, until it is used or cleared, a keyed hash of the one-time receipt for an activation. They are kept under a keyed one-way code made from your account and the installation's public key, which cannot be used to sign in or to reach your files. We also keep two further keyed codes of your account: one so that the record is deleted with your account, and, only for the choice dated 2026-10-13, one for the link described next.

What it is linked to. If you chose Allow under the disclosure dated 2026-10-13, which every app now shows, we link those two dates, for your account, to the compatibility checks you allowed us to count on the website that led to your purchase, and to your purchases, renewals, refunds and chargebacks. Amounts are kept for purchases made on our website, as the payment provider reports them; purchases in the App Store or Google Play are counted without amounts. The only use of the linked data today is a report about your own account, which only you can request when you are signed in: how the steps from the compatibility check to a first working session went, and what your purchases brought in after refunds, fees and the costs we attribute to your visit. The report holds no account, transaction, visit or device identifier. Nothing else reads the linked data. A choice made under the earlier disclosure, dated 2026-10-12, recorded only the first-session date and linked it to nothing. Payment records themselves are kept as described elsewhere in this notice and are separate from this measurement.

How long it is kept. A choice lasts 120 days from the day you turn it on. After that, measurement stops until you turn it on again, and our scheduled clean-up deletes the record. Before it does, the two dates are counted once into daily totals by platform, customer or test, and day, which carry no code of your account or installation; those totals are all that remains, and they are kept as anonymous counts. Turning it on again later starts a new period, and nothing from an earlier one is linked to it.

Turning it off. Use the switch in the app. The app stops recording on that device at once, even when you are offline or signed out, and then sends the withdrawal to us. When it reaches us we delete the two dates and the link code of that installation. We keep only a minimal "off" record with no dates, for up to 120 days, so that a delayed "on" request cannot switch measurement back on; write to us to have it deleted sooner, and it is deleted with your account in any case. Nothing from that installation is added to the daily totals when you turn it off, and totals counted earlier from a period that had ended carry no code of your account or installation, so they cannot be taken back out. If the withdrawal could not be sent (you were offline or signed out), what we already hold stays until its 120 days end or you delete your account; write to us and we will delete it sooner. This choice does not affect licensing, recovery or offline access.

Kept only on your device

Some features of the app keep information on your device and never send it to us. How the app stores each one differs by platform, and a statement here about how something is stored applies on a platform once the app's storage there has been tested to do what the statement says.

Photo thumbnails in the free preview. Where the app shows them, the free preview can show small pictures of the photos on a drive (JPEG, HEIC, PNG and camera RAW files), so you can see that it is the right drive before you buy. Photo thumbnails in the free preview are made on your device. They aren't saved, and they aren't sent anywhere. Each thumbnail is made from the picture the photo already carries, or from the photo itself, by a separate part of the app that cannot open files or connect to the network. The app writes no thumbnail to your device's storage or to the system's own thumbnail store, and writes nothing from an encrypted drive to your device to make one.

The drive catalog. If you turn it on, the app keeps a list of the names, folder paths, sizes and modification dates of the files and folders on each drive you include, with the drive's name, model and size and an identity for the drive (such as its serial number, or a fingerprint of its layout when it has none), so that you can search for a file while its drive is unplugged. It never keeps file contents or thumbnails. The app keeps the list on your device and never sends it to us. The list of a drive that was not encrypted is stored as it is. The list of a drive that was encrypted is stored encrypted, and is not readable without a key that stays on your device, in its own secure credential store. Where the system lets apps do so, the app leaves the catalog out of your device's backups (on Apple devices, Time Machine and iCloud backups; on Android, Auto Backup and device transfer). Your device's own backups may include the catalog where the system doesn't let apps leave it out. The lists of encrypted drives stay encrypted there. You can take a drive out of the catalog or clear the whole catalog in Settings at any time.

"Your year with Volidra". Before an annual plan renews, the app can show how many drives you opened, how many files Rescue copied and how many health warnings it showed in the past year. These counts are kept only on your device and never sent to us. You can turn them off in Settings. Turning them off deletes the counts.

Why we use your data, and on what basis

You can withdraw a consent at any time; withdrawing does not affect what we did before. Where we rely on our legitimate interests you can object (see your rights below).

Who receives your data

Paddle and the app stores also act on their own responsibilities for billing and distribution, in addition to what they do for us. We disclose data to authorities only where the law requires it. We never sell your personal data, and we never share it for advertising.

International transfers

Pelluci LLC is in the United States, and several of our providers are too. Where personal data leaves the European Economic Area or the United Kingdom, we rely on the transfer tools those laws provide: the EU-U.S. Data Privacy Framework (and its UK Extension for the United Kingdom) where the recipient is certified under it, and the standard contractual clauses (with the UK addendum for the United Kingdom) otherwise; where an adequacy decision covers the destination (for example Switzerland), we rely on it. Where personal data leaves Türkiye, we transfer it in line with Article 9 of Law No. 6698, which allows a transfer on an adequacy decision or, without one, on the appropriate safeguards the Law lists, and, only occasionally, in the cases of its paragraph 6. You can ask us for a description of the safeguards that apply to your data.

How long we keep it

Each section above states the retention for its own data. In short: account records while the account exists and, after deletion, only the billing, tax, purchase and security records that the law or the next section lists; abuse observations for at most 30 days; support correspondence 24 months after its last message (and up to 35 more days in the help desk's backups); linked app measurement for at most 120 days, after which only aggregate daily platform totals without account or device identifiers remain; the Mac compatibility check's daily totals for 25 months. Billing, tax and purchase records are kept for as long as the law requires us to keep accounting and tax records, and for as long as a refund, dispute or chargeback about the purchase can still be raised. Our payment providers and the app stores keep their own records under their own policies.

Deleting your account and what we keep

You can request deletion of your account at Account deletion, including without reinstalling or signing in to the app. Write from your account's email address; we check that it is yours. Eligible sign-in identity, sessions, device registrations and linked optional measurement are removed. Local storage is never erased by this action.

Deletion does not cancel subscriptions or remove purchase and contract rights. Required billing, tax, purchase, refund, transfer and security records remain for the purposes and periods explained on the deletion page. A retained opaque-account security record prevents a deleted identity that has those obligations from being reinstated for sign-in, without retaining the email lookup or allowing account access. Deleting your account also removes the measurement records of every installation linked to it, including installations registered at the same time. Deleting your account does not immediately erase records held by our payment providers and the app stores, or backups; those follow their own retention. Write to privacy@volidra.com for separate marketing or support records, or for a rights request.

Your rights

If you are in the European Economic Area or the United Kingdom you can ask us for access to your personal data, correction, deletion, restriction of its use, a portable copy, and you can object to processing that rests on our legitimate interests. You can withdraw a consent at any time. Licence checks are automatic: they apply fixed rules to the purchase you made to decide whether a device is licensed, including ending a licence after a refund. Abuse observations are only advisory signals that never decide entitlement, block a transfer or restrict a refund. If you think a licence check is wrong, write to us and a person will look at it. Write to privacy@volidra.com; we answer within 30 days, and where a request is complex and the law lets us extend that time, we tell you if we do. We may ask you to show that the request comes from the account's email address. You can complain to the data protection authority of the country where you live or work, or where you think your rights were infringed; in the United Kingdom that is the Information Commissioner's Office.

If you are in Türkiye

This section is the information we owe you under Article 10 of the Law on the Protection of Personal Data, No. 6698 ("the Law").

• Controller. Pelluci LLC, whose identity and address are above.
• Purposes and legal bases. The purposes and the legal bases under Article 5 of the Law are in the table above. We collect the data electronically, through our website and apps and from the payment and store providers named above, and in no other way.
• To whom we transfer it and why. To the service providers above, for the purposes in the table, and abroad as described under international transfers.
• Your rights (Article 11). By applying to us you can learn whether we process your personal data; ask for information if we do; learn the purpose of the processing and whether it is used for that purpose; know the third parties in Türkiye or abroad to whom the data is transferred; ask for correction of incomplete or wrong data; ask for deletion or destruction on the terms of Article 7; ask that those corrections and deletions be notified to the third parties the data was transferred to; object to a result against you that arises solely from automated analysis of the data; and claim compensation for damage caused by unlawful processing.
• How to apply (Article 13). In writing to privacy@volidra.com or to our postal address, or by another method the Personal Data Protection Board determines. We may ask you to verify your identity. We conclude your request free of charge as soon as possible and at the latest within thirty days, unless the work needs a separate cost, in which case the fee in the Board's tariff may be charged. We accept the request or refuse it with reasons, in writing or electronically.
• Complaint (Article 14). If we refuse, your answer is insufficient or we do not answer in time, you can complain to the Personal Data Protection Board within thirty days of learning our answer and in every case within sixty days of your application. You must apply to us first.

If you are in California

The California Consumer Privacy Act, as amended, gives California residents the following information and rights. We apply them to every California resident who writes to us, whether or not the Act would require it.

• What we collected in the past twelve months. Identifiers (a keyed email lookup, an opaque account identifier, and the email address itself where you give it to us for sign-in links or support); commercial information (purchase, renewal and refund records); internet or network activity (only if you opt in to measurement, and request and security metadata that our providers handle); and device registrations (platform, name and build). We do not collect precise location, and we do not collect sensitive personal information to infer characteristics about you.
• Where it came from and why. From you, from your device and from the payment and store providers, for the purposes in the table above. We disclose it to the service providers named above for those business purposes, under contracts that limit their use of it.
• How long we keep each category. Identifiers: while the account exists, and after deletion only the opaque security record described under account deletion. Commercial information: for as long as the purchase and refund records are needed for the one-refund rule, accounting and disputes. Network activity: the retention stated under measurement above (at most 30 days for abuse observations and 120 days for linked measurement). Support correspondence: 24 months after the last message. Device registrations: while the account exists, and a device that has not checked in for 30 days frees its seat.
• Do Not Track. The site sets no cookie for measurement without your consent, and we do not track you across other sites, so a Do Not Track signal changes nothing we do.
• We do not sell or share. We have not sold or shared personal information for cross-context behavioral advertising in the past twelve months, and we have no actual knowledge of selling or sharing the personal information of anyone under sixteen. We share no personal information with third parties for their own direct marketing.
• Your rights. To know what we hold and have collected about you, to delete it, to correct it, to opt out of sale or sharing (there is none to opt out of), to limit our use of sensitive personal information (we do not use it), and not to be treated worse for using these rights.
• How. Write to privacy@volidra.com from the email address of your account, or ask someone to do it for you as your authorized agent with your written permission. We confirm receipt, check that the request comes from the account holder, and answer within 45 days; where we need more time we tell you why and take up to a further 45 days.

Children

Volidra is not directed to children under 16 and we do not knowingly collect their personal data. If you think a child has given us personal data, write to us and we will delete it.

Changes to this notice

We publish changes here with their effective date. For a change that matters to you, we also email the address of your account before it takes effect.