Security
How Vela protects family information and how to report a concern. Updated 19 October 2026.
Access and encryption
Signed-in app requests are checked for family membership and role. The founder’s administration tools require separate sign-in protected by Cloudflare Access. The founder can read messages to operate and review the pilot. Vela is not end-to-end encrypted: its servers and named providers process messages.
Vela uses HTTPS. Family content fields are encrypted before database storage; the database and private media storage also use provider-managed encryption at rest. Media access is checked and temporary access links expire. Production and test environments have separate resources and credentials. No service can guarantee perfect security.
What stays on your phone
The optional parent portrait and calling number stay on the organiser’s device rather than being uploaded as profile data. A photo deliberately sent in an ask or reply is uploaded as a family message. iPhone sign-in credentials use the operating system’s secure storage. Protect shared devices and chat histories with your own screen lock.
Retention and deletion
The pilot notice gives each category’s retention period. Vela deletion does not remove delivered Telegram messages, screenshots or copies on other people’s devices. Providers may have their own disclosed retention, including AI abuse-monitoring records. See Your data and deletion for request instructions.
Report a vulnerability
Email t.aiusheev@gmail.com with the affected page or app version, a description and steps using your own account or synthetic data. Do not include passwords, sign-in codes, invitation tokens or someone else’s messages. Do not access another family, disrupt the service or publish private information to demonstrate an issue. We will review and coordinate a fix. There is no paid bug-bounty programme or guaranteed response time.
If information is exposed
We investigate, contain the problem, preserve necessary evidence and notify affected people and authorities when required. If someone else may have your sign-in code or invitation link, stop sharing it and contact the founder. Never send a sign-in code or password to support.