Privacy Policy

This Policy walks through what data we collect when you build profiles, share links, or upload images on volti.lol, why we collect it, and how we handle it once it's in. Analytics here are deliberately light, and we don't use cookies for them. Using the Service means you accept the practices described below.

We can update this Policy when something about how we handle data changes: new features, new providers, new legal requirements. Updates go live when we publish them here or send them your way another way, and continuing to use volti.lol after that means you've accepted the new version. Worth a glance every now and then.

We try to collect only what's actually needed to keep volti.lol running reliably and safely. When you sign up or manage your account, we get the details you give us, plus a few abuse-prevention signals we capture at the moment of each account action. Passwords are stored using industry-standard hashing. We log the IP used at signup and at each login for safety and fraud-prevention reasons. If you change your email, we may keep the old one on file for a short while (for account integrity, fraud prevention, or legal compliance) and we never use it to message you. Once it's no longer needed, the old address is deleted for good.

While you're signed in, we hold a server-side session so we know who you are across requests. The session record carries a session ID tied to your account and a small amount of context: the device or browser type, the country we estimate from your IP, and the IP itself. We use this for sign-in, to surface suspicious activity, and so you can review and revoke active sessions yourself.

Public profile pages get cookie-free, lightweight analytics so creators can see how their pages perform and which links get clicked. When someone views a page or clicks one of its links, we record a small event: the page's owner, where the visitor came from when that's available, an estimated country, a rough device category, and when the action happened. We don't set analytics cookies, and we don't try to fingerprint or identify individual visitors beyond those signals.

When something on the site breaks or behaves oddly, we record a short diagnostic event. That can include the account ID if you're signed in, the session ID, the IP, and the browser or device type. The point is to find and fix bugs, keep things stable, and head off abuse. These logs aren't used for advertising, analytics, or behavioral tracking.

Image-host uploads come with the metadata we need to actually serve the file: the account doing the upload, descriptive and technical details (the displayed name, size, type), and the upload time. We also store a limited slice of upload-side metadata: the IP, browser, and device used to push the file.

When you write in, or when we send you a service email, we process the message and the metadata around it so we can answer, provide support, and let you know when something material changes for your account or for the Service.

We don't use cookies for analytics on volti.lol. The cookies and similar technologies we do use are strictly necessary: they keep you signed in, protect the account, prevent abuse, and make the core features work. Switching them off would break the Service, so we don't offer a toggle for them.

volti.lol sits behind Cloudflare, which uses its own cookies and similar identifiers for things like load balancing, network routing, security, and DDoS mitigation. Those Cloudflare cookies are technically necessary to keep the Service available and protected from hostile traffic. Cloudflare's own cookie and privacy practices live at https://www.cloudflare.com/privacypolicy/.

Non-essential cookies you can manage in your browser settings. Disabling the essential ones or the Cloudflare security cookies will likely break access to the Service or hurt its performance.

The data above is what we use to keep volti.lol running and improving: authenticating users, maintaining secure sessions, rendering public profiles and links, measuring views and link performance without cookies, finding and fixing bugs, monitoring uptime and reliability, blocking fraud and spam, helping with support tickets, processing purchases and subscriptions, complying with legal obligations, and enforcing our Terms. Diagnostics and telemetry stay scoped to performance and security work, nothing else.

If you've opted in, we may send the occasional email about new features, product updates, promotions, or other volti.lol news. We only send marketing emails where the law allows it or where you've explicitly told us yes.

Unsubscribing is one click: every marketing email has the link in the footer, and you can also write to support@volti.lol if that's easier. Opting out doesn't stop the essential stuff like transactional or account emails; those keep coming.

We rely on established email providers to actually send these messages and to capture limited engagement signals (open rates, link clicks, that kind of thing) so we can tell what's working and catch abuse. That data is processed in line with this Policy and the law.

Where the law (such as the GDPR) asks us to identify a legal basis for processing, here are the ones we rely on: performing our contract with you (running the Service, including paid features), our legitimate interests (security, abuse prevention, cookie-free analytics, product improvement), your consent where we ask for it, and our legal obligations alongside lawful requests we receive.

Data sticks around only as long as the purposes in this Policy (or the law) require it. Analytics events have a built-in expiry and drop off automatically when they hit it. Sessions end when they expire or you revoke them. Image-hosting records live as long as the files do, or until whatever lifetime they were configured with runs out.

Once a deletion request is verified, your personal account data and the content you posted are permanently removed from our active systems. There's no rolling that back. A handful of system logs and backups linger for a short while for security, integrity, and legal-compliance reasons, then get rotated out automatically. After that, deleted data isn't kept around for analytics, business reasons, or any other operational use.

We don't sell personal data, full stop. We do share data with service providers who process it on our behalf to actually deliver the Service: cloud hosting, content delivery and edge security, payment processing and billing, email delivery, anti-abuse tooling. Each of those is locked into confidentiality and use-limitation obligations.

We may also disclose information when the law or valid legal process requires it; when it's needed to protect users, the public, or the Service; or as part of a corporate transaction involving volti.lol, in which case any successor will be bound by terms at least as protective as the ones in this Policy.

volti.lol pages link out to third-party sites, services, and profiles that we don't run or control. The moment you follow one of those links or interact with content from another platform, the data you share there is governed by that third party's own privacy policy, terms, and data practices, not ours. We don't monitor, endorse, or take responsibility for how those services collect, use, or protect your information.

That covers any link or embed someone has put on their volti.lol page, plus any integration or external platform you've connected to your own account. Before you click through or hand any personal data to a third party, take a look at their privacy policy.

Card payments on volti.lol run through Stripe, our authorized card-payments processor; PayPal payments run through Paddle, our authorized PayPal processor. Whichever rail you use, your card or PayPal details, billing address, and transaction data are collected and stored by the processor under their own privacy and security policies, not ours.

volti.lol doesn't receive or store full card numbers or PayPal credentials. The only payment data we keep is the slim slice we need to verify the purchase, activate the right features, prevent fraud, and back up support. Sensitive payment info travels straight between you and the processor over an encrypted connection.

For the full picture on how each processor handles your personal and payment data, their privacy policies are at https://stripe.com/privacy (Stripe) and https://www.paddle.com/legal/privacy (Paddle).

Our infrastructure and service providers operate across more than one country. Where the law calls for it, we put cross-border transfer safeguards in place and apply technical and organizational measures so your information stays protected wherever it's processed.

Personal data is protected with a mix of administrative, technical, and physical safeguards: encrypted transport, access controls, and ongoing monitoring among them. No system is fully bulletproof, so we won't claim absolute security. If you think someone got into your account who shouldn't have, write to support@volti.lol right away.

Under the EU's General Data Protection Regulation (GDPR) and comparable regimes elsewhere, you have specific rights over the personal data we hold. volti.lol applies these principles globally, so wherever you're based, you can ask us to confirm whether we hold information about you, request a copy of that data, and receive it in a commonly used digital format. If anything we hold is wrong or incomplete, you can ask us to correct or update it.

You can also ask for your data to be deleted outright. Once we've verified your identity and confirmed the request, we'll permanently wipe your personal information and posted content from our active systems, except for the slim retention we need for legal obligations, fraud prevention, dispute resolution, or service integrity. If you think we're processing your data unlawfully or going past the consent you gave, you can ask us to pause certain processing or object to processing based on legitimate interest entirely.

When our use of your data is based on consent, you can withdraw it whenever you like. That doesn't change the legality of anything we did before you pulled it. volti.lol doesn't run automated decision-making or profiling that would have a significant legal or personal effect on you. If you're not happy with how we're handling your data, you have the right to lodge a complaint with your local data-protection authority. We'd ask you to talk to us first so we can try to fix it directly, but the right is yours either way.

To view, edit, correct, or delete personal information, the quickest path is your account settings; otherwise email support@volti.lol. If you've lost access to your account, support can still process a manual deletion request. We respond to verified data requests within the deadlines the relevant law sets, and we may ask for reasonable identity proof first so we don't end up handing your data to the wrong person.

volti.lol isn't built for children under 13, or whatever higher minimum age applies in your country. We don't knowingly collect personal information from anyone below the applicable age. If you think a child has shared personal information with us, write to support@volti.lol and we'll take it from there.

Questions, concerns, or anything that needs sorting out: write to support@volti.lol.