Last updated: October 6, 2026
Privacy Policy
1. Who we are
Killian Pavy, acting as an individual, is the data controller for information collected through voltius.app and the Voltius application.
Contact: contact@voltius.app
2. Data we collect
We collect only what is necessary to provide the Service:
- Account data: your email address.
- Authentication: a derived key — your master password is never transmitted or stored.
- Billing: handled by Lemon Squeezy. We receive a customer ID and subscription status; we do not store payment card details.
- Vault data: stored encrypted on our servers. We cannot read its contents.
- Technical logs: IP address, timestamps, and HTTP request metadata for security and abuse prevention. Retained for 30 days.
3. What the Voltius application connects to
On its own, without an account, the application connects to:
- Update checks: at startup and every 4 hours, it asks updater.voltius.app whether a newer version exists, sending its version, operating system and processor architecture. Your IP address is visible to the service, as with any connection. These checks cannot be turned off; automatic downloads can.
- Release notes: after an update, it downloads the changelog from GitHub to show what is new.
- Marketplace: when you open the plugin or snippet marketplace, it downloads the catalogue from GitHub.
Signing in connects it to our sync server. Optional plugins such as Gist sync connect to the services you configure them with. Connections you open to your own hosts (SSH, SFTP, serial and so on) go directly from your device to those hosts.
4. Legal basis and purpose (GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Account management | Email, auth key | Contract performance |
| Payment processing | Email, Lemon Squeezy customer ID | Contract performance |
| Security / abuse prevention | IP, logs | Legitimate interest |
| Transactional emails | Contract performance | |
| Update checks | IP, app version, OS, architecture | Legitimate interest |
5. Data retention
- Account data: until account deletion, plus 30 days for billing dispute purposes.
- Encrypted vault: deleted within 30 days of account deletion.
- Technical logs: 30-day rolling window.
- Billing records: 10 years (French legal obligation).
6. Data sharing
We do not sell your data. We share it only with:
- Lemon Squeezy — payment processing (USA; adequacy decision / SCCs apply).
- Oracle France — server infrastructure.
- Cloudflare — network routing to our servers, the update service, and backup storage (USA; Data Privacy Framework / SCCs apply).
- Resend — transactional email delivery (USA; Data Privacy Framework / SCCs apply).
- GitHub — hosts application downloads, release notes and marketplace catalogues (USA; Data Privacy Framework / SCCs apply).
7. Your rights (GDPR)
As a data subject you have the right to:
- Access the data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten").
- Port your data in a machine-readable format.
- Object to processing based on legitimate interest.
- Restrict processing in certain circumstances.
Exercise your rights by emailing contact@voltius.app. You also have the right to lodge a complaint with the CNIL (French data-protection authority).
8. Security
Vault data is end-to-end encrypted with a key derived from your master password, which is never transmitted. All data in transit is protected by TLS. Our servers never have access to the plaintext contents of your vault.
9. Cookies
The voltius.app website does not use tracking or advertising cookies. The account portal uses session cookies strictly necessary for authentication. No consent banner is required for strictly-necessary cookies under the ePrivacy Directive.
10. Changes
We will notify you of material changes by email at least 14 days in advance.
11. Contact
Data-protection questions: contact@voltius.app