Volley photographs the inside of your home and the things you own. We built it knowing that, so this policy is short, plain, and honest — what we collect, where it goes, and how to make all of it disappear.
What changed on 22 August 2026. Two things on this page were describing Volley slightly wrong, and we would rather say so than quietly edit them. The weather section said your location "is not stored" — it is, on your own phone, for about a day, so we don't ask you again every morning; it still never reaches our servers. And the list of companies below said it was the whole list when it left out the two weather services that receive the rounded location. Nothing about how Volley works changed. Two sentences that described it did.
Volley runs on a small set of services, each doing one job:
That's the whole list. We don't sell your data, we don't show ads, and nobody browses your closet.
Volley lets you connect with people you already know, by invite only. Connecting is not sharing, and we keep those two things far apart on purpose.
Connecting happens when you send someone an invite link and she accepts, or she sends you one and you do. From then on, each of you can see the other's first name, once she's added one, and how many pieces are in her closet — a number, not the pieces. Nothing else crosses between two connected accounts.
Sharing a piece is a switch you flip — one piece at a time, one person at a time, off until you turn it on. A piece you share shows that friend its clean cutout image and its basic tags (its name, category, and color). It never shows her the original photo you took, what it cost, or when you've worn it. You can't share with someone you aren't connected to — the database refuses, not just the app — and nothing is ever suggested or nudged toward sharing. Unsharing takes effect the moment you flip the switch back.
Lending is a second switch on top of sharing — a shared piece can't be borrowed unless you also mark it lendable. Before a piece appears borrowable, an automatic check looks at whether its photo shows just that piece — a whole-outfit shot would show your friend more than the thing she's borrowing. If a piece is held back, the app tells you why, and "Lend it as-is" puts your word above the check's. No person looks at your photos for this. A friend asks; you say yes or no; you always get the last word. Only the two of you can see a borrow, from request to home again. Another friend browsing may see that a piece is out, but never with whom. At each step — the ask, the yes or no, the return — we send the person waiting a short email, so nothing is ever silently lost.
Disconnecting removes the link and everything that rode on it in the same stroke — your first name and your count leave her side, every share between you is revoked, and any open borrow request is cancelled, all at once.
There is no public feed and no browsing anyone's wardrobe uninvited. You can only be connected to someone holding an invite you created, or whose invite you accepted — and an invite is single-use and expires after a week.
Two of those services touch your actual photos. Here is exactly what they do with them — and, just as important, what they don't.
Photoroom lifts your piece off its background. Photos sent through its API aren't saved on Photoroom's servers, and its terms don't allow your images to be used to train a model.
Anthropic (Claude) looks at one photo at a time and suggests tags — is this a blazer, what color, which season. By default, Anthropic does not use anything sent through its API to train its models, and deletes those inputs and outputs from its systems within 30 days. Nothing you shoot becomes training data for an AI.
The AI only ever suggests. You confirm or fix every tag, and your correction is the final word — so your closet fills with your judgment, not a machine's guess. The same holds at lending: if the automatic photo check holds a piece back, you see why and can lend it as-is — your word above the check's, there too.
Your photos reach these two services only to be processed in the moment, only for your closet. They're never used to build anyone else's, and never sold or handed on beyond the one job they do here.
Volley photographs private spaces, so security isn't an afterthought — it's built into how the data is stored and reached.
Besides your camera, Volley gives you two more ways to add a piece — and both take only the garment, nothing else.
add+…@onvolley.com) that works only for your account. Forward an order
email to it and Claude reads that email once, to pull out the garments —
their name, image, price, and brand. Everything else — card numbers, your address,
order and tracking numbers, who sent it, the rest of the message — is
discarded in the same pass and never stored. We keep the garment
lines; we do not keep the email. Only your account's address can forward — a receipt
forwarded by anyone else is refused.Both doors only ever create pieces you own — Volley is your closet, never a wishlist — and you confirm every draft before it lands.
For as long as the piece is in your closet. A wardrobe lasts, so we don't quietly expire your photos — nothing disappears on a timer, and nothing is kept after you say otherwise. Waitlist emails are kept only until launch-note duty is done, then removed.
What a piece is made of. Each piece holds up to three images: the photo you took, the cleaned-up cutout, and a transparent copy used to build your daily look. Removing the piece removes all three. That's the whole set — no other copy is made, and nothing of yours is stored anywhere else.
What deleting really does. Remove a piece and its photos leave storage for good, not just your view. Two honest edges: a link we already handed your phone to show an image can keep working for up to an hour before it expires, and our nightly backups hold a copy for 30 days before rolling off. After that a deletion is complete everywhere.
In the app: settings → delete my account. This is a real deletion, and it cascades — your photos and their cleaned-up copies are removed from storage, your closet records are erased, your friend connections are removed from both sides, any invites you sent or accepted are deleted, every share you granted or received disappears with them, your borrow history goes too, and your analytics identity is deleted. Every image under your name — photos, cutouts, the transparent copies, your closet's wall, your profile picture — is emptied out of storage, and the backups roll off within 30 days. What remains is a line of anonymous accounting (that an account once spent two cents of processing) with nothing connecting it to you.
Write to [email protected]. A person reads it.