Your closet stays yours.

What changed on 1 October 2026. Volley can now show you a friend’s piece on a photo of you, before you ask to borrow it. That is new, it is entirely optional, and it means one more company receives a picture — the service that makes the picture. This page said “two of those services touch your actual photos” and named two; there are three, and the third is the one that matters most, because the photo it receives is of you rather than of a coat. It is named below, and so is everything we do and don’t do with that photo. Nothing about your closet, your friends or your account changed.

What changed on 24 September 2026. We started keeping the exact address you landed on — the page, and anything after the question mark — rather than only working out from it which of our links you'd used. Some of our own links had quietly lost their tag, and we had no way to tell those apart from people who'd arrived on their own. We don't keep anything after a #, which is the part of an address your browser never sends anywhere. Nothing about your closet or your account changed.

What changed on 23 September 2026. This page described the app and said nothing at all about this website, while saying "that's the whole list" — so it was incomplete about onvolley.com, and had been since we started counting visits in August. There is now a line for it below. We also started keeping the full address of the page that sent you, rather than only the site's name, because three people found us through a link someone else shared and we had no way to thank them. Nothing about your closet or your account changed.

What changed on 22 August 2026. Two things on this page were describing Volley slightly wrong, and we would rather say so than quietly edit them. The weather section said your location "is not stored" — it is, on your own phone, for about a week, so we don't ask you again every morning; it still never reaches our servers. And the list of companies below said it was the whole list when it left out the two weather services that receive the rounded location. Nothing about how Volley works changed. Two sentences that described it did.

• Your photos. The pictures you take of your pieces, plus the cleaned-up versions we make of them.
• Your email. To sign you in, with a one-time code or with Sign in with Apple, and, if you joined the waitlist, to send one note when doors open. Once you’re in, a small number of notes about your own account: a welcome when your closet is built, a short hello if you’ve just started, and word when a friend acts on something of yours — an invite that landed, a spot saved on a court, a piece shared or borrowed. Never a marketing list, and we keep it to about one note a week at most.
• Sign in with Apple, if you use it. Apple gives us a private account number and the email you chose to share, which can be a hidden Apple address. We use it only to sign you in.
• Your closet data. Tags (category, color, season, and so on), your corrections to them, and the wears you log.
• One photo of you, only if you choose to add it. Volley can show you how a friend’s piece would look on you before you ask for it, and that needs a picture of you. You pick one, we record that you agreed and when, and it is kept locked to your account like any other photo of yours. Nobody on Volley ever sees it — not your friends, not us. Nothing it makes goes into your closet, nothing it makes can be lent, and there is no way to share, save or send it anywhere. You can swap it or remove it in settings whenever you like, and removing it takes every picture it made with it. Skip it and the rest of Volley works exactly as it does now.
• Your first name. If you add one. We ask what your friends should call you, so a friend sees a name and not your email address. First name only, it's yours to change or clear at any time, and it is only ever shown to people you've connected with.
• Who you're connected to. If you accept a friend's invite, we store that the two of you are connected. We also store the invites you send — including ones nobody has accepted yet — until they're used, they expire, or you delete your account. That's the whole record: a link between two accounts. Nothing about her closet comes with it.
• Your court. If you join a court — a small, named circle of friends — we store the court’s name and that you’re a member. Joining is your call — accepting a court invitation, or using a friend’s court invite link, is what joins you — and it connects you with each person already there, exactly as if you’d traded invites; members see each other’s first names and piece counts, and nothing more. People outside a court can’t see who’s in it.
• Your birthday, if you share it. Month and day only — we never ask for or store the year. It’s optional, it’s yours to clear anytime, and it does exactly two things: your daily fit dresses you for your day, and once a year we may send one short birthday note that morning.
• Your closet’s backdrop. The wall you pick — one of ours, or a photo of your own once that option opens — shows to the friends you’ve connected with when they visit your closet, and to no one else.
• Your profile photo, if you add one. Shown to the friends you’ve connected with — on your closet’s door and your court — and to no one else.
• How the app is used. Anonymous-style product events (like "an item was confirmed") tied to a random account id — never your name, email, or photos, and never a recording of your screen.
• A rough sense of the weather where you are. Today's fit uses your approximate location to fetch the forecast. It's rounded off to about a kilometre — a neighbourhood, not an address — before it leaves your phone, and it's kept on your phone for about a week so we don't have to ask again. It never reaches our servers, it's never attached to you, and it never goes to our analytics.
• This website, separately from the app. When you land on onvolley.com we write one row: which of our links you came in on, the exact address you landed on, the page that sent you, and the time. We also count the steps of a visit — scrolled, opened the form, sent it — one tick each, never a stream. It's how we tell "nobody came" apart from "plenty came and the page didn't land", which are different problems with different fixes. No cookie, no advertising pixel, no profile, and nothing that identifies you: no name, no account, no device id, no IP address kept. "The page that sent you" is whatever your browser chose to tell us, and most of the time that's just a site name — substack.com, instagram.com — because browsers hold the rest back by default. We don't join any of it to your email if you later join the waitlist. One exception, and it's labelled where it sits: the Journal's front page carries a Spotify player for one song. It loads from Spotify when that page does, and inside that frame Spotify sees your IP address and may set its own cookies, under Spotify's privacy policy rather than this one. No other page on this site loads anything from Spotify.

• Supabase stores your account, photos, and closet data, locked to your account at the database level.
• Photoroom lifts your piece off its background, and then makes the clean, filled-out picture of it that your closet shows. Both are the same service, one photo at a time.
• Anthropic (Claude) processes each photo to suggest tags, to check that the clean picture is still the same piece you shot, and, for a piece you make lendable, to check automatically that its photo shows just that piece. If you are a creator and you put a photo of yourself on a capsule, Claude also checks that nobody else is in the frame before that photo can be shown. You always get the last word, on tags and on lending alike.
• Replicate makes the picture of you in a friend’s piece, and only when you have added a photo of yourself and tapped to see it. It receives that photo and the piece; it receives no name, no email and no account.
• PostHog (US) receives the anonymous-style product events above.
• Resend delivers your sign-in codes and waitlist email.
• Apple confirms it’s you when you use Sign in with Apple. It receives nothing about your closet.
• Cloudflare routes your private forwarding address to us, so a receipt you forward can be read for its garments (see below). The email itself isn't kept.
• Open-Meteo, and MET Norway if it can't be reached, return the forecast for that rounded location. They get a neighbourhood and nothing else — no account, no name, no device, nothing that says it's you.

Connecting happens when you send someone an invite link and she accepts, or she sends you one and you do. From then on, each of you can see the other's first name, once she's added one, and how many pieces are in her closet — a number, not the pieces. Nothing else crosses between two connected accounts.

Sharing a piece is a switch you flip, one piece at a time, one person at a time, off until you turn it on. A piece you share shows that friend the clean picture we make of the garment on its own, its name, category and colour, roughly how long it is, the day you added it, and whether you've marked it lendable. If it's away from your closet she sees only that it's away, never where it is or who has it. If it has been lent and returned a few times she sees a small mark saying so, without a number. She never sees the original photo you took, what it cost, or when you've worn it. You can't share with someone you aren't connected to: the database refuses, not just the app, and nothing is ever suggested or nudged toward sharing. Unsharing takes effect the moment you flip the switch back.

Lending is a second switch on top of sharing — a shared piece can't be borrowed unless you also mark it lendable. Before a piece appears borrowable, an automatic check looks at whether its photo shows just that piece — a whole-outfit shot would show your friend more than the thing she's borrowing. If a piece is held back, the app tells you why, and "Lend it as-is" puts your word above the check's. No person looks at your photos for this. A friend asks; you say yes or no; you always get the last word. Only the two of you can see a borrow, from request to home again. Another friend browsing may see that a piece is out, but never with whom. At each step — the ask, the yes or no, the return — we send the person waiting a short email, so nothing is ever silently lost.

Disconnecting removes the link and everything that rode on it in the same stroke — your first name and your count leave her side, every share between you is revoked, and any open borrow request is cancelled, all at once.

There is no public feed and no browsing anyone's wardrobe uninvited. You can only be connected to someone holding an invite you created, or whose invite you accepted — and an invite is single-use and expires after a week.

A capsule is a page you build on purpose and publish under your own handle. It shows the pieces you picked and the days you planned, and anyone with the link can read it — including search engines and AI assistants.

Only your own pieces can go on it. A piece a friend lent you is never part of a capsule, and that rule lives in the database rather than in a switch that could be flipped by accident.

Photographs of you are not part of it either, unless you add one yourself. Turn it off and it stops being served within five minutes, which is as fast as a page already loaded can be told. Try-on pictures can never be published, the same as everywhere else in Volley.

Unpublishing takes your page down. What it cannot do is reach copies other people already made, because that is how the open web works — and we would rather tell you that before you publish than after. Deleting your account removes your capsules along with everything else.

Photoroom does two things with each photo, and both are worth naming. First it lifts your piece off its background. Then it makes the picture your closet shows: the same garment, filled out instead of lying flat, which means an image model making a new picture from yours. That is the one place in Volley where something is generated from your photo without you asking for it, so here is the guard. Claude compares every generated version back to your own photo, and if a logo, a colour, a button, a seam or the garment itself has changed, that version is thrown away and you keep your photo. A prettier picture of a piece that isn't quite yours is worth less than nothing when a friend is deciding whether to borrow it. Photos sent through Photoroom's API aren't saved on its servers, and its terms don't allow your images to be used to train a model.

Anthropic (Claude) looks at one photo at a time and suggests tags — is this a blazer, what color, which season. By default, Anthropic does not use anything sent through its API to train its models, and deletes those inputs and outputs from its systems within 30 days. Nothing you shoot becomes training data for an AI.

Replicate makes the picture of you wearing a friend’s piece, using an image model running on its service. It only ever happens when you have added a photo of yourself and tapped to see a piece on you — there is no automatic version of this, no photo of you is ever sent there unless you tap, and nothing else in Volley sends it anything. Your photo is sent inside the request itself rather than as a link, so no address exists that anyone could follow to it. Volley does not permit anything sent there to be used to train a model.

And every picture it makes is checked before you see it: Claude compares it back to your photo and to the piece, and if your shape or the garment did not come back as the real thing, we show you nothing rather than something we can’t stand behind. That check is the reason the feature asks for a clear photo at all. The pictures it makes are kept locked to your account, like your own photos, and they are the only thing it produces — no version of them is public, shareable, or saved anywhere else.

The AI only ever suggests. You confirm or fix every tag, and your correction is the final word — so your closet fills with your judgment, not a machine's guess. The same holds at lending: if the automatic photo check holds a piece back, you see why and can lend it as-is — your word above the check's, there too.

• Locked to you. Every photo and record is fenced to your account at the database level, so one account can never read another's closet — enforced by the database itself, not just the app.
• Encrypted both ways. Your data is encrypted while it travels to and from your phone, and encrypted again where it rests in storage.
• No passwords to leak. You sign in with a one-time code sent to your email, or with Sign in with Apple. There's no password stored anywhere to be stolen.
• Keys stay on the server. The credentials that talk to Photoroom and Claude live on our backend, never inside the app on your phone.
• Private by default. Your closet is yours alone. Connecting with someone shows her your first name and a count of your pieces and nothing more; no item of yours is visible to anyone else unless you choose to share that specific piece with that specific friend — and even then, the sharing rule lives in the database, not just the app. There's no public feed and no browsing strangers' wardrobes.
• Backed up privately. We keep encrypted nightly backups in a private location, so your closet can't simply vanish. The backups are as locked down as the closet itself.

• From a link. Share a product page, or paste its link, and we read only the public product details that page already publishes — the image, name, price, and brand — to draft the piece. We don't sign in anywhere, and we don't follow you around the site.
• From a receipt. You get your own private forwarding address (add+…@onvolley.com) that works only for your account. Forward an order email to it and Claude reads that email once, to pull out the garments — their name, image, price, and brand. Everything else — card numbers, your address, order and tracking numbers, who sent it, the rest of the message — is discarded in the same pass and never stored. We keep the garment lines; we do not keep the email. Only your account's address can forward — a receipt forwarded by anyone else is refused.
• From the browser extension. If you install Volley for Chrome, clicking the Volley icon on a shop's page sends us two things: that page's address, and the page's <head> markup together with any structured product data the page publishes. That is where the name, image, price, and brand live. We do not read the body of the page, so not the reviews, not your cart, and not anything a shop shows you while you're signed in. We only ever read the tab you clicked on, at the moment you click it. We pull the garment out of that markup and keep the garment; the markup itself is not stored and not logged. The extension runs nowhere else, and it watches nothing you don't hand it.

• Apple takes the money, not us. We never see a card number or its last four, a cardholder name, a billing address, a price, an amount, a tax line, an invoice, your Apple ID, or your Apple email. There is no payment processor between you and us, because there is no payment to us.
• What we hold is the fact that you subscribed. Apple's own id for the subscription, which plan it is, whether it is active or lapsed and until when, and whether it came from a test build or a real one. That is all, and it is the minimum that lets Plus keep working when it renews.
• Why Apple's id. Apple's renewal messages do not carry your name or your email - only that id. Without it a renewal could not be matched to your subscription, and you would lose Plus while still paying for it.
• If you cancel or it lapses. Your closet stays exactly as it is and stays readable. Nothing is deleted, nothing is locked, nothing is held back. You keep every piece, every look and every friend.
• If you delete your account. The subscription record goes with everything else. Cancelling the subscription itself is done in your Apple settings, because Apple is who you bought it from.