The short version: Velocity Bridge and Diffy send us nothing, and this website sets no cookies unless you accept analytics. The long version is below, because "we respect your privacy" is not a policy.
Last updated 8 October 2026 · Applies to Velocity Bridge, Diffy, Diffy Pro and to redicon.pk
RedIcon is a sole proprietorship operated by Shahzad Alvi in Islamabad, Pakistan. We publish desktop software. For anything in this policy, write to support@redicon.pk.
Velocity Bridge does not send us any data at all. There is no analytics, no telemetry, no crash reporting, no update beacon and no licence check. The application makes network connections only to the servers you tell it to connect to.
Server passwords, passphrases and keys are stored in the operating system's own credential store — Windows Credential Manager on Windows, the Secret Service (GNOME Keyring, KWallet) on Linux. They are never written to the application's database, its configuration files or its logs, and they never leave your computer except as part of authenticating to the server you chose.
If no system keychain is available — which happens on some headless Linux systems, and under Snap until you grant the password permission — Velocity Bridge tells you so in the application and does not store the password anywhere. It asks you each time instead. There is no fallback file.
| Data | Where it lives |
|---|---|
| Saved sites, folders, transfer queue, sync history | A local SQLite database in your user profile |
| Settings, accepted host keys, accepted TLS certificates | The same local database |
| Session log — the protocol conversation with your server | Local log files. Passwords and authorization headers are removed as the log is written, not filtered afterwards |
| Passwords and key passphrases | The OS credential store only |
You can see exactly where these are inside the application, under Settings → Paths, and open each folder from there. Uninstalling removes the application; deleting those folders removes the data.
Velocity Bridge can export your saved sites to a .velocity-export file. That file is encrypted with a passphrase you choose and is written wherever you ask. We never receive it, and we cannot recover it if you lose the passphrase.
Diffy and Diffy Pro do not send us any data at all. There is no analytics, no telemetry, no crash reporting, no update beacon and no licence check. The files you compare, read or edit are opened from your computer and saved back to your computer — they are never uploaded anywhere.
| Data | Where it lives |
|---|---|
| The files you compare, view or edit | Where they already were. Diffy reads them and, only when you press Save, writes them back |
| Preferences — theme, zoom, word wrap, diff options | The application's own settings storage in your Windows user profile |
| Recently used files, and the files open in your last session | The same settings storage, so the app can reopen them for you |
None of this leaves your computer. Uninstalling Diffy from Windows removes the application and its settings.
Only when you ask it to. Documentation (F1, or the ⋯ menu) opens redicon.pk/docs/diffy in your browser, Open-source licences in the About box opens redicon.pk/open-source/diffy, and Get Diffy Pro opens the Microsoft Store. In each case the app passes your browser the address and nothing else — no identifier, no session and nothing about your files. The website visit is then an ordinary visit to redicon.pk, covered by the next section.
redicon.pk is a set of static pages. It embeds no advertising, sells nothing, and loads no fonts or images from third parties. The one script it loads from someone else is Google Tag Manager, which runs Google Analytics. That script loads on every visit, before you answer the banner, and what it does in each case is described below.
We use Google Analytics 4 to count visits and see which pages get read, so we know what to write more of. It is held in a denied state until you press Accept on the banner: until then it sets no cookies and creates no identifier for you. If you decline, or simply ignore the banner, it stays that way.
Being in the denied state does not mean Google is never contacted. Your browser fetches the tag from Google on every visit, and while consent is denied the tag sends Google a cookieless notice that a page was viewed. That notice carries the page address, the time and your browser's user agent, and like any request it reaches Google from your IP address. It contains no cookie and no identifier, so it cannot be linked to your other visits. Google uses these notices to estimate total traffic; we see only the resulting aggregate numbers.
If you accept, Google sets the _ga cookies described in the cookie statement and we see aggregate figures — visit counts, approximate country, which pages were opened, which links out to the Microsoft Store were followed. Advertising and personalisation signals are disabled regardless of your answer, and the property is configured so IP addresses are not retained. Google acts as our processor for this and handles the data under its own privacy policy. Our lawful basis is your consent, which you can withdraw at any time from the cookie statement — there is a button on it.
The application itself is unaffected. Velocity Bridge contains no analytics of any kind and sends us nothing, whatever you choose here. This section is about the website only.
One clarification, because the app links here. From version 0.9.1, pressing F1 in Velocity Bridge — or choosing the user guide from the command palette or Settings → About — opens this site's documentation in your browser. Earlier versions carried a copy of the guide inside the app; that copy is gone, so reading the guide now requires a connection.
That visit is an ordinary visit to redicon.pk and everything on this page applies to it, including the banner if you have not answered it. The app passes your browser the address and nothing else — no identifier, no session, nothing about which servers you use, and no indication that the visit came from the app rather than from anywhere else. Velocity Bridge itself still makes no connection to us; it asks Windows to open a link, exactly as clicking one in any other program would.
Our host also records standard server access logs — IP address, timestamp, page requested, browser user agent — for security and to keep the site running. These are ordinary web-server logs, not a profile of you, they are not combined with anything else, and they exist whether or not you accept analytics.
We keep your message and your address for as long as it takes to answer you and to have a record of the conversation. We do not add you to a mailing list, and we do not sell or share your address with anyone.
Velocity Bridge, Diffy and Diffy Pro are distributed through the Microsoft Store. Microsoft collects data from Store users under its own privacy statement, which we do not control and you should read separately if it matters to you.
As the publisher, Microsoft shows us aggregate, anonymised figures: how many people acquired each app, ratings and reviews, crash and health statistics, and broad breakdowns by market and Windows version. We cannot identify an individual from any of it, and we receive nothing about what you do inside the applications — because the applications report nothing.
Diffy Pro is a paid app sold through the Microsoft Store, and Diffy (free) links to it. Microsoft is the merchant of record: you pay Microsoft, under its own terms and privacy statement, and Microsoft handles your payment details. We never see or store your card number — we are told only that a copy was sold, in the same aggregate figures described above.
Velocity Bridge is currently free and there is nothing to pay for. When paid features are introduced, purchases will be handled by an external payment processor, which will act as merchant of record and will handle your payment details directly. We will never see or store your card number. This policy will be updated with the processor's name and its own privacy terms before any payment is possible.
Velocity Bridge and Diffy are developer tools and are not directed at children. We do not knowingly collect information from anyone, of any age.
Because we hold almost nothing, most requests have a short answer. If you have emailed us and want that correspondence deleted, or want to know what we hold about you, write to support@redicon.pk and we will act within 30 days. If you are in the UK, EU or another region with statutory data rights, those rights apply and we will honour them regardless of where we are based.
If this policy changes materially — particularly if any of our applications ever starts sending us anything — we will change the date at the top and describe what changed. We will not quietly widen it.