Privacy Policy
This policy explains what Volanee collects, why, and what we do and do not do with it. It is written to be read.
1. What we collect
| Data | Why | How it is stored |
|---|---|---|
| Name, email, password, role | Your account | Password hashed (scrypt); never stored in clear |
| Date of birth | Age rules and youth safety limits | Encrypted at rest (AES-256-GCM) |
| Phone, home address | Never shown to an organization. Seen by you, and by Volanee staff handling a safety report | Encrypted at rest |
| ZIP code and approximate location | Finding opportunities within the distance you choose | Coordinates; listings show a neighborhood, never an address, until acceptance |
| Identity verification results | Trust and legal identifiability | Provider reference, verified legal name and outcome, encrypted. Document images are held by the provider or deleted after a manual decision |
| Updates from organizations | Telling accepted students about an opportunity (there are no private messages) | Encrypted at rest; seen by the students accepted for that opportunity, their parents and the organization, and by Volanee staff only when a report is filed. Messages sent before updates replaced them on September 29, 2026 stay encrypted under the same rule |
| Opportunity history, ratings, verified hours | The product | Standard storage |
| Support tickets and reports | Safety and dispute resolution | Encrypted; critical reports preserve an evidence record under legal hold |
| Chat messages | Messages between friends, in group chats, in a club’s chat, and between a student and a teacher or counselor at their school | Encrypted at rest. Seen by the people in the chat and, read-only, by a verified counselor at a student’s school and by the administrators of the school’s district, who can search and export them for a public records request and keep them on hold; every look and export is recorded. A parent following a student can read that student’s chats with school staff, never their chats with friends. Contact details are refused. A sender or the chat’s admin can take a message down: students no longer see it, but it stays in the school’s record. Staff messages written from 9 PM to 7 AM are delivered at 7 AM |
| Phone and computer alerts | To show school posts, messages and confirmed hours on a device you turned alerts on for | The address your browser gives us for that device, encrypted at rest. What we send is encrypted for that device alone. Turn alerts off and the address is deleted; an address the browser stops answering at is deleted too |
| School posts | Announcements a school or district sends to students and the parents following them | Sent only to students the school has confirmed, or to a club’s members. Kept with who it reached, who opened it and, when a post asks, who tapped Got it, which whoever sent it can see. A photo or PDF on a post is stored privately and shown only to people who can see the post. Check ins at events are kept with the post. An urgent post is also emailed: to students only at their school email address, and to parents at the address they gave us. Volanee never sends text messages |
| Launch list and school pilot requests | To reply to a school, organization or adult volunteer asking for a pilot or a key | Encrypted at rest. A pilot request (name, role, school, work email, and an optional phone number and message) is read only by Volanee staff, and deleted a year after it was last handled unless a pilot started |
| Technical logs (IP, device, actions) | Security and audit | Audit log; retained 24 months |
2. What we do not do
- We do not sell personal information, and we do not share it with data brokers or for cross-app advertising.
- We do not show a minor's exact location or address to other users. A student’s full name, including last name, is shown to Organizations they apply to and to the members, officers and advisors of clubs they join. Teens appear on leaderboards as first name and last initial, and can opt out.
- We do not let anyone read updates or older messages except as described above.
3. Who we share with
Service providers who act for us under contract: our hosting, database and file-storage providers, our email provider once email is switched on, and an identity-verification provider if we add one (today Volanee staff review IDs themselves). When you type a town, ZIP code or school into a search box, our server sends what you typed, and nothing that identifies you, to address-lookup services built on OpenStreetMap. Some pages load a typeface from Google Fonts, which sees your device's IP address. An organization a student signs up with sees their name, school, profile and attendance record, never their phone number or home address; the student sees the opportunity's exact address once accepted. A school counselor Volanee has verified sees the verified hours of students who name that school. Club officers and advisors see the hours of members who joined their club. Guardians of students under 18 see their teen's activity. Law enforcement and courts, when legally required or when we believe someone is at risk. A successor, if Volanee is acquired, under this policy.
4. Minors
Volanee is for users 13 and over. We do not knowingly collect information from children under 13; if we learn we have, we delete it. Users aged 13 to 17 can join through their school, on their own, or with a club code. A school that uses Volanee is responsible for any family consent its own policies require; joining a club does not need a parent or guardian’s approval. If a student under 18 pays for Volanee Plus with their own card, our payment processor, Stripe, handles the card and we keep only the plan, price and payment status. A parent or guardian can see their student’s sign-ups and confirmed hours (see For Parents and Guardians). California residents under 16: we do not sell your information and would require opt-in consent if that ever changed.
5. Your rights
You can see and edit your profile in the app. You can download a copy of your data, or delete your account, yourself in Settings. You can also ask for a copy, a correction or deletion through Get help; we respond within 30 days. Some records must be kept after deletion: evidence under legal hold, and safety records needed to keep a removed user from returning. California, Virginia, Colorado, Connecticut and Utah residents have specific statutory rights, which we honor. You will not be treated differently for exercising them.
6. Security
Encryption in transit and at rest for sensitive fields, hashed credentials, strict content-security policy, per-account rate limits and lockout, opaque record identifiers, tenant isolation tests on every release, and an audit log of sensitive actions. No system is perfectly secure; we will notify you and regulators of a breach as the law requires.
7. Retention
Account data while your account exists and 30 days after deletion; audit logs 24 months; verification outcomes until expiry plus 12 months; evidence under legal hold until released by Volanee or a court.
8. Contact
support@volanee.app, or legal@volanee.app for legal questions.