Privacy Policy

Effective September 24, 2026 · Last updated October 20, 2026

This Privacy Policy explains what information WILHELM IIX, doing business as Volk ("Volk", "we", "us"), collects when you use volk.gg, its mobile web apps and any related services (together, the "Service"), how we use and share it, how long we keep it, and the choices and rights you have. It applies to everyone who visits or uses the Service. Please read it together with our Terms of Use, Cookies Policy and Community Guidelines.

The short version: we collect what we need to run a social network, we do not sell your personal information, we do not use third-party advertising trackers, and you can download or delete your account at any time.

Information we collect
How we use information
Legal bases (EEA, UK and similar laws)
What is public
How we share information
Content safety scanning
How long we keep information
Your choices and rights
Additional information for U.S. residents
International transfers
Security
Children
Changes to this policy
Contact us

1. Information we collect

1.1 Information you give us

Account information: to have an account you give us a username, an email address and a password (stored only as a one-way hash), and you choose a gender (Male or Female) when you set up your account. Everything else is optional and stored only if you add it yourself: a display name and country (asked during setup, both can be skipped), and a phone number, date of birth or city (only in your settings; we never ask for them).
Profile information: profile photo, cover image, bio, website, links to your other social media accounts, and any other details you add to your profile. Business accounts may also include a business name, category, address, billing address and website.
Content you create: posts, comments, replies, reactions, polls and votes, quotes and reposts, stories, photos, videos, audio, documents, GIFs, bookmarks and pins, marketplace listings, job listings, live streams and live chat messages, and replays of your live streams if you choose to save them.
Imported content: if you import from X (Twitter), the archive you choose is trimmed on your device to recent posts before it is uploaded; we then scan its media and create your posts from it.
Messages: direct messages, group chats and community rooms, including text, photos, videos and files you send, along with read receipts, reactions and pins. Chats are end-to-end encrypted once the people in them have set up encryption on a supported browser: message text is encrypted on your device, and we store it only in a form we cannot read. We can see who is in a chat and when messages are sent. Photos, videos and files sent in chats, and messages from official Volk accounts (such as @vex), are not end-to-end encrypted. See section 11.
Connections and activity choices: accounts you follow, block or mute, groups you join, and your privacy, notification and security settings.
Communications with us: reports you file, feedback, verification or author applications, support requests, bug reports you send from the app (with a screenshot if you attach one), and the reason you give if you delete your account.
Payments (if enabled): if we add paid features, we keep records of your payments. Card and bank details are entered with and processed by our payment processor; we do not store full card numbers.

1.2 Information collected automatically

Device and connection information: IP address, browser and version, operating system and version, device type (phone or desktop), language, time zone, and a device identifier we set in a cookie so you can see and sign out your active sessions.
Approximate location: country, region and city estimated from your IP address by our network provider. We use this for security (for example, to show you where your account is signed in) and do not collect precise GPS location.
Usage information: pages and features you use, posts and stories you view, when you were last online, and actions such as reactions and follows. We use this to operate features like view counts, "last seen", and recommendations.
Logs: our servers and our network provider record technical logs (such as IP address, requested URL, time and response status) to keep the Service running and secure.
Cookies and local storage: see our Cookies Policy. We use only cookies and storage needed to run the Service and remember your preferences. We do not use advertising or cross-site tracking cookies.
Push notification subscriptions: if you turn on notifications, your browser gives us a subscription address and encryption keys for its push service, which we store so we can send you notifications.

1.3 Information from others

Other users may mention you, tag you, message you, share your content or report your content or account.
If you sign in with a third-party account (such as Google, where enabled), we receive your name, email address and profile picture from that provider, as permitted by your settings with them.
When you post a link, we fetch that page's public title, description and image to show a preview.

2. How we use information

To provide the Service: create and secure your account, show your profile and content, deliver messages and notifications, run feeds, search, stories, live streams, the marketplace and job listings, and process and store the media you upload (including resizing and transcoding videos).
To personalize your experience: suggest accounts and content, remember your language, theme and other settings.
To keep people safe: detect, prevent and respond to spam, fraud, abuse, security incidents, and content that breaks our rules or the law, including through automated scanning described in section 6; enforce our Terms and Community Guidelines; and verify accounts.
To communicate with you: send service emails (such as sign-up confirmation, password resets, security alerts and important changes) and, if you turn them on, push notifications. We do not send marketing email without your consent.
To improve the Service: understand how features are used, troubleshoot and fix problems, and develop new features.
To comply with law: respond to lawful requests, meet reporting obligations (including reporting apparent child sexual exploitation to the National Center for Missing & Exploited Children), keep records we are legally required to keep, and establish or defend legal claims.

We do not sell your personal information, and we do not use it for targeted advertising based on your activity on other websites.

3. Legal bases (EEA, UK and similar laws)

Where laws such as the GDPR or UK GDPR apply, we rely on:

Contract: to provide the Service you asked for under our Terms.
Legitimate interests: to keep the Service safe and secure, prevent abuse, improve features and communicate with you about the Service, where those interests are not overridden by your rights.
Consent: for optional features such as push notifications and optional profile fields. You can withdraw consent at any time, without affecting earlier processing.
Legal obligation: where we must process information to comply with the law.
Vital interests and public interest: in rare cases, to protect someone's life or physical safety, or to protect children.

4. What is public

Volk is a public social network. Unless you change your privacy settings, the following can be seen by other users and, where we make it available, by anyone on the internet, including search engines: your name, username, profile photo, cover image, bio, website and social links, follower and following counts, and your posts, comments and reactions. Stories are visible for 24 hours. Live streams are visible to viewers while live. Messages are visible only to the people in the conversation.

Your email address, phone number, date of birth and city are never shown publicly, whatever your settings. Your country is shown only if your privacy settings allow it (new accounts start with it hidden). Your gender is shown on your profile. Your profile also shows how many people joined Volk through your invite links.

Content you share publicly may be copied, shared or saved by others, and may remain in search engine caches or other people's copies even after you delete it.

We share information only as described here:

With other users, as described in section 4 and according to your settings.
With service providers who process information on our behalf under contracts that limit their use of it:
- Cloudflare, Inc.: content delivery, DNS, network security and bot protection (including the anti-bot check on sign-up and sign-in forms), media file storage, live video, sending our service emails and telling us whether they were delivered, small server-side services that fetch link previews, scan imported archives and check that a sign-up email address can receive mail, and scanning of the media we serve for known child sexual abuse material (CSAM).
- Our server and hosting providers in the United States.
- Linear Orbit, Inc. (our issue tracker): when you send a bug report from the app, its text, your username, the page you were on, your browser and device type, and the screenshot if you attach one are filed there so we can fix the problem.
- Browser push services operated by Google, Mozilla, Apple and Microsoft, which deliver encrypted notification messages to your device when you enable notifications. The content is encrypted so that the push service cannot read it.
- Payment processors (such as Stripe or PayPal), if and when paid features are enabled, to process payments and prevent fraud.
- Optional integrations, such as a translation service or GIF provider, only if they are enabled and only for the specific text or search you send to them.
For legal reasons and safety: we may share information with law enforcement, regulators, courts or other parties only if we believe in good faith that it is required by law or legal process, or necessary to prevent fraud, abuse, death or serious physical harm, to protect children, or to protect the rights, property or safety of Volk, our users or the public. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), as U.S. law requires, and NCMEC may share those reports with law enforcement worldwide. We cannot provide the text of end-to-end encrypted messages, because we cannot read it.
Business transfers: if Volk is involved in a merger, acquisition, financing, reorganization or sale of assets, your information may be transferred as part of that transaction, subject to this policy.
With your consent or at your direction, such as when you link another account.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

6. Content safety scanning

To keep the Service free of illegal content and content that violates our Community Guidelines:

Photos and videos you upload, including media imported from X, are checked automatically before they are published, on our own servers: by a nudity-detection model for pornography and other explicit nudity (exposed genitals, buttocks or female breasts), and against a list of fingerprints (hashes) of files we removed before for breaking our rules. Uploads that match are rejected. We keep a record of rejected uploads, including the file fingerprint, the account and IP address involved, and the reason, to prevent abuse and repeat uploads.
Media served through our network provider is also scanned for known child sexual abuse material (CSAM), by matching it against hash lists of known material. Matches are blocked and reported as described in section 5.
Content reported by users is reviewed by people.
We cannot read or scan the text of end-to-end encrypted messages. When you report a photo or video sent in a chat (these are not end-to-end encrypted), or a post with photos or videos, a copy of those files is kept for review.

Automated tools can make mistakes. If you believe content was wrongly blocked, contact [email protected].

7. How long we keep information

Account and profile information: for as long as your account is active.
Posts, comments, messages and media: until you delete them or delete your account. Messages deleted for everyone are removed from our servers, including their encrypted form; a copy may remain wherever another participant saved or forwarded it. In chats with disappearing messages turned on, messages are deleted automatically after the chosen time (1 hour, 1 day or 1 week).
Stories: shown for 24 hours, then removed from public view.
Live streams: we do not record live video. If you choose to save a replay, your device records the stream and uploads it when it ends; the replay is private unless you make it public, and is kept until you delete it. Live chat messages are kept with the stream until the stream is deleted.
Deleted accounts: when you delete your account we remove your profile and content from the Service, generally within 30 days. Copies may remain in encrypted backups for up to 90 days before being overwritten.
Reports: a report stays when the reported content or the account of either the reporter or the reported person is deleted, together with a record of what it was about when it was filed (the usernames and names involved and the text of a reported post), so it can still be reviewed and repeat abuse can be spotted. Reports are kept as safety records (see below).
Sign-in history and devices: the IP address, device, browser and approximate location of each sign-in and failed sign-in attempt, and of each device signed in to your account, are kept for 12 months so you can review them in Settings → Security, and then deleted.
Security and server logs: generally up to 90 days. Sign-up attempts (email address, IP address and the result of the anti-bot check) are kept for 14 days.
Reported photos and videos: when a post, or a photo or video in a chat, is reported, a private copy is kept for review even if the original is deleted. It is kept while the report is open and deleted 90 days after it is resolved, or one year after for reports about child safety, as U.S. law requires for material reported to NCMEC.
Encrypted message key backup: the encrypted copy of your message keys that we keep (which only your recovery PIN can unlock) covers about the last day; older keys are deleted from it. After 10 wrong PIN attempts it is deleted entirely.
Safety and legal records: records of rejected uploads, enforcement actions and legal reports are kept as long as needed to prevent repeat abuse and as required by law (for example, U.S. law requires preserving material related to a report to NCMEC for at least one year).
Payment records: as long as required by tax, accounting and anti-money-laundering laws.

We may keep information longer if we are required to by law, or to resolve disputes or enforce our agreements.

8. Your choices and rights

You can:

Access and update most of your information in your profile and settings.
Control who sees your content and who can contact you in privacy settings, and block or mute accounts.
Manage notifications in notification settings and in your browser.
See your active sessions and sign-in history (including failed attempts) and sign out other devices in security settings.
Delete content at any time, and delete your account from account settings.

Depending on where you live, you may also have the right to request a copy of your personal information (including in a portable format), correct it, delete it, restrict or object to certain processing, and withdraw consent. To make a request, email [email protected] from the email address on your account. We will verify your request and respond within the time required by law (usually 30 or 45 days). You may use an authorized agent where the law allows it; we may ask for proof of their authority. We will not discriminate against you for exercising your rights.

If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

Do Not Track and Global Privacy Control: we do not track you across other websites or sell or share your information for cross-context behavioral advertising, so there is nothing to opt out of. We treat Global Privacy Control signals as a valid opt-out request where the law requires it.

9. Additional information for U.S. residents

Laws in California and several other states require us to describe our practices using certain categories. In the past 12 months we have collected: identifiers (such as name, username, email, IP address and device identifier); customer records (such as phone number, if provided); characteristics (such as gender, and date of birth if you add it); commercial information (such as marketplace and job listings you post); internet and network activity; approximate geolocation derived from IP address; audio, visual and similar information (such as photos, videos and voice recordings you upload); and inferences used for recommendations. Sources, purposes and recipients are described in sections 1, 2 and 5.

We collect account passwords, which are sensitive personal information under some state laws, only to authenticate you. We do not use sensitive personal information to infer characteristics about you.

We do not sell personal information and do not "share" it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.

10. International transfers

Volk is operated from, and our servers are located in, the United States. Our providers may process information in other countries. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States and other countries whose data protection laws may differ from yours. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Security

We protect information with measures including encryption in transit (HTTPS/TLS), end-to-end encryption of chat messages, hashed passwords, access controls, isolated services, and monitoring.

End-to-end encryption. In end-to-end encrypted chats, the keys that decrypt your messages are created and kept on your devices. So that a new device can catch up, we keep a backup of your message keys from about the last day; older keys are deleted from it. The backup is encrypted on your device with a random key that is held separately from the backup, and that key is released only to your device and only for the right recovery PIN. Your PIN never leaves your device, and neither we nor the service holding the key can open the backup on our own. After 10 wrong PIN attempts, both the key and the backup are deleted. If you lose all your devices and your PIN, we cannot recover your encrypted messages. Message text in these chats is never readable by us; photos, videos and files sent in chats, official account messages and chat metadata (who is in a chat, and when messages are sent) are not end-to-end encrypted.

No online service can be perfectly secure, so we cannot guarantee absolute security. Protect your account with a strong, unique password and sign out of devices you no longer use. If you believe your account has been compromised, change your password and contact [email protected]. If we learn of a security breach that affects your personal information, we will notify you and the authorities as required by law.

12. Children

The Service is only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect any personal information from children under 13. If we learn that an account belongs to someone under 18, we will close it and delete its information, except where we must keep information to protect a child or comply with law. If you believe a minor is using the Service, contact [email protected].

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, if the changes are significant, we will give you notice in the Service or by email before they take effect.

14. Contact us

The controller of your personal information is WILHELM IIX (Volk).

Questions or requests about privacy: [email protected]
Safety or abuse reports: [email protected] or [email protected]
Everything else: [email protected]