Privacy Policy

PRIVACY POLICY

Last updated July 14, 2026

This Privacy Notice describes how and why Idol Software might access, collect, store, use, and/or share (“process”) your personal information when you use Volly, including when you:

Visit our website at volly.so or use the Volly application at app.volly.so
Sign up for and use Volly to deploy, host, share, or discover internal tools with your team
Sign in to view an app a teammate has shared with you
Engage with us in other related ways, including support, marketing, or events

Volly is currently operated by Robert Idol, a sole proprietor doing business as Idol Software (“Idol Software,” “we,” “us,” or “our”).

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use Volly. If you still have any questions or concerns, please contact us at hello@volly.so.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find more detail on any topic below by using the table of contents.

What personal information do we process? Depending on how you use Volly, we may process your name, email address, profile picture, workspace membership, comments you post, content your team deploys, and technical/usage data. See WHAT INFORMATION DO WE COLLECT?

Do we process any sensitive personal information? No. We do not intentionally collect or process sensitive information such as racial or ethnic origin, religious beliefs, health data, or sexual orientation.

Do we collect any information from third parties? Yes, but only from Google. If you sign in with Google, Google shares your name, email address, and profile picture with us.

How do we process your information? We process your information to provide the Services (authentication, hosting your team’s deployed apps, and enforcing the access rules your workspace sets), to communicate with you, for security and fraud prevention, to understand product usage, and to comply with law. Learn more under HOW DO WE PROCESS YOUR INFORMATION?

In what situations and with which parties do we share personal information? We share information with the service providers who help us run Volly (Cloudflare, Neon, Resend, PostHog, Google), and within your workspace, subject to the access controls your workspace’s admins configure. We do not sell your personal information or share it with advertisers. Learn more under WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

How do we keep your information safe? We use organizational and technical measures designed to protect your personal information, though no method of transmission or storage is 100% secure.

What are your rights? Depending on where you’re located, you may have rights to access, correct, or delete your personal information. Learn more under WHAT ARE YOUR PRIVACY RIGHTS?

How do you exercise your rights? The easiest way is to email us at hello@volly.so. We will consider and act on any request in accordance with applicable data protection laws.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
HOW LONG DO WE KEEP YOUR INFORMATION?
HOW DO WE KEEP YOUR INFORMATION SAFE?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK FEATURES
DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
DO WE MAKE UPDATES TO THIS NOTICE?
HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you or your workspace’s admins provide to us.

We collect personal information you voluntarily provide when you create an account, join a workspace, use the Services, or contact us. Depending on how you interact with us, this may include:

Name (from your Google account, or as entered by an admin who invites you)
Email address
Profile picture, if provided by Google
Your workspace membership and role (admin or member)
Comments you post on apps within your workspace
Content your workspace deploys to Volly — application code, static files, and any README or release notes written by you or your teammates. This content is provided and controlled by you or your workspace, and may itself contain personal information if you choose to include it
If you’re invited to a workspace, the email address your admin used to invite you

Volly does not currently process payment information — we don’t charge for the Services yet.

Sensitive Information. We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such information.

Information automatically collected

In Short: Some information — such as your IP address, browser characteristics, and product usage data — is collected automatically when you use Volly.

We automatically collect certain information when you visit, use, or navigate the Services:

Log and usage data. Our authentication and hosting infrastructure records information such as your IP address, browser/user-agent string, and the timestamps of your sessions and requests. This is used to keep the Services secure and operating correctly.
Product usage data. We use PostHog, a product analytics tool, to understand which features are used and how, so we can improve Volly.
Access records. If your workspace restricts access to an app to people within your company, and you view that app, we record your email address and the time you accessed it, so your workspace’s admins can see who’s using their tools.
Automated screenshots. When your workspace deploys an app, we may automatically capture a screenshot of it to display as a thumbnail in your workspace’s app directory. That screenshot reflects whatever the app happens to display at capture time.

Information we receive from third parties

In Short: We receive limited information from Google when you sign in with your Google account.

Google. If you sign in with Google — whether to your Volly account or to view an access-restricted app — Google shares your name, email address, and profile picture with us, consistent with the permissions you grant during sign-in.

We do not otherwise purchase or receive information about you from data brokers or advertisers.

Google API Services User Data Policy

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide and secure Volly, communicate with you, and understand how the product is used. We process personal information only when we have a valid legal reason to do so.

We process your personal information for the following purposes:

To facilitate account creation and authentication, via Google Sign-In or magic-link email, and to keep your account in working order.
To provide the Services — hosting and serving the apps your workspace deploys, and enforcing the access rules (private, workspace-wide, or unlisted) your workspace’s admins configure for each app.
To enable teammate collaboration — for example, so members of your workspace can comment on and discuss apps published within your workspace.
To communicate with you — transactional email (magic links, workspace invitations, deployment notifications) sent via our email provider, Resend, and, if you’ve created an account, occasional product updates. You can opt out of non-essential communications at any time; see WHAT ARE YOUR PRIVACY RIGHTS?
To protect our Services, including fraud monitoring and prevention.
To identify usage trends so we can understand how Volly is used and improve it.
To comply with legal obligations.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we have a valid legal reason to do so, such as your consent, to fulfill a contract, to comply with the law, or for our legitimate business interests.

This section applies if you are located in the EEA, UK, or Switzerland — for example, as an employee of a company that uses Volly.

We may rely on the following legal bases:

Consent. We may process your information where you have given us permission to do so for a specific purpose. You can withdraw your consent at any time by contacting us (see HOW CAN YOU CONTACT US ABOUT THIS NOTICE?).
Performance of a Contract. We process personal information as necessary to provide the Services you or your workspace have requested.
Legitimate Interests. We may process your information where we believe it’s reasonably necessary to achieve our legitimate business interests — for example, to secure the Services, diagnose problems, prevent fraud, or understand how our product is used so we can improve it — and where those interests don’t outweigh your rights and freedoms.
Legal Obligations. We may process your information where necessary to comply with a legal obligation, such as cooperating with a law enforcement or regulatory request.

If you are located in Canada, we may process your information with your express or implied consent, or, in limited circumstances permitted under Canadian law (for example, fraud detection and prevention, or compliance with a court order), without it. You can withdraw consent at any time by contacting us.

In Short: We share information with the service providers who help us run Volly, and within your workspace, based on the access settings your workspace configures. We do not sell your personal information.

Service providers. We share data with the following third parties who perform services on our behalf, under contracts that limit their use of your information to providing those services:

Purpose	Provider
Sign-in via Google account	Google
Application hosting and compute	Cloudflare (Workers)
Storage for deployed app files	Cloudflare R2
Automated app screenshots	Cloudflare Browser Rendering
Database	Neon (Postgres)
Transactional email delivery	Resend
Product analytics	PostHog
Web fonts (marketing site only)	Google Fonts

Loading Google Fonts on our marketing website (volly.so) shares your IP address with Google. The Volly application itself (app.volly.so) hosts its fonts directly and does not make this request.

Within your workspace. Volly is built for teams. Depending on the visibility an admin sets for an app (private, workspace-wide, or unlisted-with-link), your name, comments, and app-access activity may be visible to that app’s owner, your workspace’s admins, and/or other members of your workspace who have access to the app. This information stays within your workspace — we don’t make it public or share it with other workspaces.

Business transfers. We may share or transfer your information in connection with, or during negotiations of, a merger, sale of business assets, financing, or acquisition of all or part of our business.

We have not sold or shared any personal information with third parties for a business or commercial purpose in the preceding twelve (12) months, and we do not use your personal information for cross-context behavioral advertising.

5. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

Our infrastructure runs in the United States (Neon’s database hosting and Cloudflare’s network), though Cloudflare’s global network may process requests closer to where you are for performance. Regardless of your location, your information may be transferred to, stored, and processed in the United States and in the facilities of the third parties listed above.

If you are located in the EEA, UK, or Switzerland, we rely on appropriate safeguards for these transfers, including Standard Contractual Clauses where applicable. Our service providers’ data processing agreements are available upon request; PostHog’s is published at https://posthog.com/dpa.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to provide the Services, unless a longer period is required by law.

We retain your personal information for as long as you have an account or your workspace retains you as a member, and as needed to fulfill the purposes described in this notice — for example, to maintain security logs or comply with a legal obligation. When we no longer have a legitimate business need to process your personal information, we delete or anonymize it, or, if that isn’t possible (for example, because it’s in a backup archive), we securely isolate it from further processing until deletion is possible.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use reasonable organizational and technical measures to protect your personal information.

We rely on our infrastructure providers’ security controls — including encryption in transit — and apply access controls to limit who can reach production data. However, no method of transmission over the internet or method of electronic storage is 100% secure, so we cannot guarantee absolute security. Transmission of personal information to and from the Services is at your own risk.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: Volly is a business tool. We do not knowingly collect data from or market to children under 18.

Volly is intended for use by working professionals through their employer’s Volly workspace, not by children. We do not knowingly collect, solicit, or sell personal information from individuals under 18 years of age. If you believe we’ve collected information from a minor, please contact us at hello@volly.so and we will delete it.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you’re located, you may have rights to access, correct, delete, or restrict the use of your personal information.

In some regions (the EEA, UK, Switzerland, and Canada), you have rights under applicable data protection law, which may include the right to: (i) access and obtain a copy of your personal information; (ii) request correction or deletion; (iii) restrict how we process it; (iv) receive a portable copy of it; and (v) object to certain processing. You can exercise these rights by contacting us using the details in HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

We will consider and act on any request in accordance with applicable data protection laws. If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your Member State or UK data protection authority. If you are in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing consent. Where we rely on your consent, you may withdraw it at any time by contacting us. This won’t affect the lawfulness of processing before withdrawal.

Opting out of marketing communications. You can unsubscribe from marketing emails at any time via the unsubscribe link in those emails, or by contacting us. We may still send you service-related messages necessary to administer your account (for example, deployment notifications or security alerts).

Account information

To review, change, or delete your account, contact us at hello@volly.so. When you or your workspace’s admin requests account deletion, we deactivate or delete the account and associated information from our active systems, though we may retain limited information as needed to prevent fraud, resolve disputes, or comply with legal obligations.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track (“DNT”) feature. Because no uniform technical standard for recognizing DNT signals has been finalized, we do not currently respond to DNT signals. If a legal standard for online tracking is adopted that we must follow, we will update this notice.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of a US state with a comprehensive privacy law (including California, Colorado, Connecticut, Virginia, and others), you may have rights to access, correct, delete, or obtain a copy of your personal information.

Categories of personal information we collect

The table below reflects the categories of personal information we have collected in the past twelve (12) months.

Category	Examples	Collected
A. Identifiers	Name, email address, IP address, online identifier	YES
B. California Customer Records personal information	Signature, physical characteristics, financial, or employment information	NO
C. Protected classification characteristics	Race, gender, age, religion, and similar	NO
D. Commercial information	Purchase history, payment information	NO
E. Biometric information	Fingerprints, voiceprints	NO
F. Internet or network activity	Browsing/interaction data with our Services, collected via product analytics	YES
G. Geolocation data	Precise device location	NO
H. Audio, electronic, visual, or similar information	Images, audio, or video recordings	NO
I. Professional or employment information	Job title, employment history	NO
J. Education information	Student records	NO
K. Inferences	Profiles built from the categories above	NO
L. Sensitive personal information	—	NO

We use and retain this information as needed to provide the Services, generally for as long as you or your workspace have an active Volly account.

See HOW DO WE PROCESS YOUR INFORMATION? and WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We have not sold or shared (as “sharing” is defined under California law) any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months, and we do not use your information for cross-context behavioral advertising.

Your rights

Depending on your state of residence, you may have the right to:

Know whether we are processing your personal data
Access your personal data
Correct inaccuracies in your personal data
Delete your personal data
Obtain a copy of the personal data you previously shared with us
Non-discrimination for exercising your rights
Opt out of the sale of personal data, targeted advertising, or certain profiling (we do not currently engage in any of these)

How to exercise your rights

To exercise any of these rights, email us at hello@volly.so. Under certain state laws, you may designate an authorized agent to submit a request on your behalf; we may ask for proof of that authorization. Upon receiving a request, we will verify your identity using the information already associated with your account before acting on it.

Appeals

If we decline to act on your request, you may appeal by emailing hello@volly.so. We will respond in writing with the outcome and, if denied, you may submit a complaint to your state attorney general.

California “Shine the Light” law

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about the categories of personal information (if any) we’ve disclosed to third parties for their direct marketing purposes in the prior calendar year. We have not made any such disclosures. To make a request, contact us at hello@volly.so.

12. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Last updated” date. If we make material changes, we will notify you by posting a notice on our website or by sending you a direct notification.

13. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, email us at hello@volly.so or contact us by post at:

Idol Software (Robert Idol) 601 Ansley Ridge Pl Cary, NC 27518 United States

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Depending on the laws that apply to you, you may have the right to request access to the personal information we collect from you, details about how we’ve processed it, correction of inaccuracies, or deletion. To make such a request, email us at hello@volly.so.