Your closet stays yours.

What changed on October 14, 2026. You can now add several outfit photos at once and let Volley find the pieces in them. To do that, Anthropic looks once at a smaller copy of each photo, with its location and camera details removed. The list of who helps us run Volley below says so.

Sharing a piece now works like a dial: you open it to your court, minus anyone you leave out, rather than to one friend at a time. Creators can publish a public page with their lookbooks, a look can be shared as a link, and we've added an error-reporting service to the list below.

Earlier versions of this page are kept at onvolley.com/privacy/2026-10-06 and onvolley.com/privacy/2026-10-03.

What you give us

• Your account. Your email, to sign you in with a one-time code. If you use Sign in with Apple, Apple gives us a private account number and the email you chose to share, which can be a hidden Apple address. We use them only to sign you in.
• Your profile, if you add it. A first name, a profile photo, the wall behind your closet, your birthday (month and day only, never the year), and your sizes (a size for tops and bottoms and a shoe size, used only to pick your daily fit and seen by nobody else).
• Your closet. The photos you take or choose of your pieces, your outfits and the things you pin for ideas, the cleaned-up pictures we make from them, their tags and your corrections, names and notes, what you wear, your saved looks and your trips.
• One photo of you, only if you choose. Volley can show you how a friend's piece would look on you, and that needs a picture of you. We record that you agreed and when. Nobody on Volley ever sees it, not your friends and not us, and nothing it makes can ever be shared. Remove it in settings and every picture it made goes with it. Skip it and the rest of Volley works the same.
• Your friends. Who you're connected to, the invites you send, the courts you join, the pieces you choose to share, borrow requests and answers, and the asks you send your court and the replies.
• Pieces you add from a link, a receipt or our browser extension. Only the garment: its name, image, price and brand. A forwarded receipt email isn't kept, and card numbers, addresses and order numbers are thrown away in the same pass. The extension reads only the page you click it on, at the moment you click.
• Volley Plus, if you subscribe. You buy it through Apple, and Apple tells us only that you subscribed, which plan, and whether it's active and until when. We never see a card number, a billing address or your Apple ID.
• Notes you send us. What you write in Share a thought in the app, which arrives with your account email so we can reply, and anything you email to [email protected].

What's collected as you use Volley

• How the app and the web app are used. Named product events, like "a piece was added" or "a look was saved", tied to your account's id number. Never your name, your email, your photos or the words you search for, and never a recording of your screen. Before you sign in to the web app, its events use a random number kept in your browser instead, joined to your account once you sign in.
• Your IP address, and a rough region worked out from it. Whenever the app, the web app or this website talks to our analytics service, it sees your IP address, as any website does, and works out roughly where you are, about as precisely as a city. It keeps that region, and it also keeps the address itself.
• A notification token, if you allow notifications, so a note can reach your phone.
• A rough sense of where you are, for the weather. Your location is rounded to about a kilometre, a neighbourhood and not an address, before it leaves your phone. It's kept on your phone for about a week so we don't ask every morning. It never reaches our servers, it's never attached to you, and it's never used for analytics. When you plan a trip, the place name you search for and the trip's dates go to the weather service, so it can find the place and its usual weather.
• On this website and the web app, what's described below under This website and the web app.

What others give us

• Apple, when you sign in with Apple or subscribe.
• A friend, when her invite connects you, or when she shares a piece with you or answers your ask.

• To run Volley for you. Keep your closet, put together your daily fit, show a friend the pieces you choose, carry a borrow request between you, and keep Volley Plus working when it renews.
• To read and clean up your photos. An AI service suggests tags and checks the pictures we make, and an image service lifts each piece off its background. If you ask to see a piece on you, an image service makes that picture. The AI only ever suggests: you confirm or fix every tag, and you always get the last word.
• To write to you. Sign-in codes, and a small number of notes about your own account and about what a friend does with something of yours. Never a marketing list, and about one note a week at most. If you joined the waitlist, one email when you're in.
• To see what's working. Product events and the website's analytics tell us where Volley helps and where it gets in the way.
• To keep Volley safe, and to do what the law requires.

We don't sell your data, we don't share it for advertising, we don't show ads, and we never use your photos to train AI. Nobody browses your closet. Lending is free and always will be, and nothing about lending, sharing or your court sits behind Volley Plus.

These are named because they receive your photos, or watch how Volley is used:

• Anthropic (Claude) reads your photos to suggest tags and to check the pictures we make, and reads a forwarded receipt to find the garments in it. When you add outfit photos to find the pieces in them, it looks once at a smaller copy of each photo, with its location and camera details removed. Anthropic doesn't train its models on what we send.
• Photoroom lifts your piece off its background and makes the clean picture your closet shows. It doesn't train on images sent the way we send them.
• Brave Search answers the searches you type on the web app's Inspiration page, under "On the web". The words you type go to Brave with nothing about you attached. Saving a result keeps the picture's address and the page link, never a copy of the picture.
• SerpApi finds which shops have a piece in stock when you tap to find one new or secondhand. It receives a few words describing the piece, like "black linen trousers", and nothing about you.
• Microlink opens a link you save when the page will not show us its picture any other way, and hands back the picture's address and the title. It receives the link, nothing about you.
• Pinterest, only if you connect it. Volley reads the boards you pick, with your permission, and shows them to you inside your drawer. Pins are fetched live and never copied or shown to anyone else; disconnecting removes what we hold.
• Replicate makes the picture of you in a friend's piece, and only when you've added your photo and tapped to see it. It receives that photo and the piece, and no name, email or account.
• PostHog, in the US, is our analytics for the app, the web app and this website.
• Apple signs you in if you choose, sells Volley Plus, and delivers notifications to your iPhone.

If you buy something new through a link in Volley, the shop may pay us a small commission. The link carries a one-time code that says the click came from Volley and nothing about you. Once you are on the shop's site, its own privacy policy applies.

And these do the plumbing:

• a database and file storage host, in the US, where your account, photos and closet live, locked to your account
• an email delivery service, for sign-in codes and notes
• a notification service that passes notes on to Apple
• a web host and network, which also routes your private receipt address and holds our encrypted backups
• weather services, which get a rounded location or a place name and nothing that says it's you
• an error-reporting service, which gets crash reports and a sample of how long screens take to load, with the phone model and app version. No IP address, name or email, and it never records your screen.

That is every kind of company that receives your data. Write to us and we'll name each one.

• Your closet is private by default. There is no public feed, and nobody browses anyone's wardrobe.
• Friends are by invite only. An invite works once and expires after a week. Once you're connected, she sees your first name, how many pieces you have, your profile photo and your closet's wall. Members of a court see each other's first names and piece counts.
• A piece is seen only if you open it. It's private until you choose Can see or Can borrow, and then it's open to your court, minus anyone you leave out. The database enforces it, not just the app. Closing it works the moment you flip it back.
• A borrow is between the two of you. Another friend may see that a piece is out, never with whom.
• Some things are public, and only if you publish them. Each of these can be opened by anyone who has its link, and only once you publish it:
  • a capsule you share,
  • your creator page at your handle, which search engines can also find,
  • a shoppable lookbook on that page,
  • a look you share as a link.
  Your creator page and lookbooks only ever show your own pieces. A shared look can include a piece a friend has opened to you, shown only as a friend's piece and never with her name. Shop links are yours, and we count taps on each piece with nothing about the person who tapped. Unpublishing takes it down, though it can't reach copies other people already made.

onvolley.com, including the Journal and the sample closet

When you visit, PostHog records how the visit goes: the pages you open, where you click or tap, and how far you scroll. We put those together into heatmaps, which is how we find the part of a page that loses people. Nothing is replayed and nothing on your screen is recorded.

What you type into a field is never collected by our analytics. Your email in the waitlist form goes only to the waitlist.

It uses a random id kept in your browser for as long as the tab is open, then it's gone. No cookie, no advertising pixel, and no profile of you. Nothing from this website is joined to your name, your email or your Volley account, including if you later join the waitlist or sign in.

If your browser sends Do Not Track or Global Privacy Control, the analytics doesn't load at all. Pages that open an invite or a friend's link never load it.

We also keep our own simple record of arrivals: which of our links you came in on, the exact address you landed on, the page that sent you (usually just a site name, because browsers hold the rest back), and the time. Nothing after a #.

The Journal and the sample closet keep their own counts in that same simple record: that the Journal's front page or a piece was opened, that a piece was read to the end, which block inside an interactive piece was tapped, and which parts of the sample closet were tried. Each is one count per visit, stored with the piece's name and the link you came in on, and nothing else: no id, no cookie, nothing that stays in your browser once the tab closes. These counts don't need the analytics to load and don't check the Do Not Track signal, because there is nothing about you in them.

One exception, and it's labelled where it sits: the Journal's front page carries a Spotify player for one song. Inside that frame Spotify sees your IP address and may set its own cookies, under Spotify's privacy policy rather than this one. Apart from that, no other company collects what you do on this site, here or across other sites.

app.onvolley.com, the web app

The web app uses a cookie to keep you signed in. It sends the same kind of named product events as the iPhone app, tied to your account's id number once you sign in. It also notes where you click and how far you scroll, to make heatmaps, with every word on the page and everything you type hidden first, so it never learns what your pieces are called or what you searched for. It doesn't replay the page.

Neither the iPhone app nor the web app ever records your screen.

• Every photo and record is locked to your account by the database itself, not just the app.
• Your data is encrypted on the way to and from your phone, and again where it's stored.
• There are no passwords to leak. You sign in with a one-time code or with Apple.
• The keys that talk to our services live on our servers, never in the app.
• Nightly backups are encrypted and kept as locked down as your closet.

• Your closet, profile and friends: for as long as you keep them. Nothing expires on a timer, and nothing is kept after you remove it.
• The photo of you, and what it made: until you remove it.
• Your Volley Plus record: as long as your account, so a lapsed plan can be told apart from one you never had.
• Notes you send us: as long as we need to answer them. Ask and we'll delete them.
• Waitlist emails: until your one email is sent, then removed.
• Product events, clicks and scrolls: up to a year, and deleted with your account.
• Backups: anything you delete leaves our backups within 30 days.