Volo Privacy Policy

Last updated: 29 October 2026

This policy explains what personal data the Volo app and its service collect, why, who processes it on our behalf, how long it is kept, and the rights you have over it.

1. Who is responsible

The controller of your personal data is Fatih Ay, Rostocker Str. 52, 70376 Stuttgart, Germany. For any privacy question or request, contact support@yourvolo.com.

2. What we collect

• Account details: your email address, name and profile photo. If you sign in with Google or Apple, we receive the identity details you allow that provider to share.
• Content you create: audio and video recordings, episode titles, descriptions and cover images, comments, direct messages and playlists.
• Data derived from your recordings: transcripts with word timings, and AI-generated suggestions such as summaries, keywords, categories, silence and filler-word cuts.
• Recording consent: when you start or join a live session, the time you agreed to be recorded and which version of the notice you saw.
• Problem reports: when you use "Report a problem" in Settings, the text you write, a screenshot if you add one, your phone model, system version and app version.
• Activity: listening history (where you are in an episode, how long, which parts of it you heard and which parts you skipped or played again), likes, bookmarks and the creators you follow.
• Plays: when someone listens to an episode for 30 seconds, we count a play. In the app we note who listened, so the same episode counts again only after a 30-minute break. In the web player for shared links we do not store the IP address: we make a code from it with a key that is only held in memory and replaced every day. Once the day is over, nobody can tell whose code it was. With that same code, we also keep which parts of a shared episode were skipped or played again, joined once per connection and episode per UTC day. We set no tracking cookie for this measurement. Connections sharing one address count together; the code also changes after an API restart. Web listening contributes to skipped/replayed insights only on days with at least 20 different codes, and to the public most-replayed line only on days with at least 50. Returning on many days does not by itself reach these thresholds.
• Podcast app downloads: when a podcast app (for example Apple Podcasts) fetches an episode from a public show's feed, we count a download, once a day per address and app. Here too we do not store the IP address: we make a code from it and the app's name, with the same key that is replaced every day.
• Device data: a push-notification token and your device platform, so we can send notifications you have enabled.
• Technical data: our servers record the IP address and request details of each connection for security and troubleshooting, and delete these logs after 14 days.

3. How we use it

• To run your account and deliver the app's features, including recording, uploading, editing in Studio, publishing, playback and live multi-host sessions.
• To show creators how many plays their episodes have, per day and per episode, how far listeners get and which parts they skip or play again, without showing who listened. Skipped and replayed parts show only once at least 20 people have listened to the episode.
• To process recordings you choose to edit: generating waveforms, detecting silences, transcribing speech and producing editing suggestions.
• To send notifications you have switched on, and essential account email such as password resets.
• To keep the service secure and diagnose problems, including preventing abuse, protecting accounts, and recording limited error diagnostics (error category, software version when available, and code locations). Raw error messages, recordings, messages and screen content are excluded.
• To improve the app, only if you opt in through our consent prompt or "Help improve Volo" in Settings: Microsoft Clarity records screen interactions and usage sessions so we can find confusing parts of the app.
• To put your email address in your show's public feed, only if you switch on "My email in the feed" on the show: Spotify sends a code there to confirm the show is yours. Anyone with the feed link can read it, and podcast apps may keep copies of the feed. It goes out of the feed by itself after two days, and you can switch it off there before that.

We process this data to perform our agreement with you when you use Volo, and on the basis of our legitimate interest in keeping the service secure and working. Where a feature is optional, as with the Microsoft Clarity analytics or the email in your feed above, we rely on your consent instead, which you can withdraw at any time where you switched it on.

4. Who processes data on our behalf

We use the following providers. Each receives only what it needs for its task.

• Hetzner — hosts our servers and database in Germany.
• Cloudflare — stores uploaded media, and handles our domain and email routing.
• AssemblyAI (USA) — converts speech to text. When you request a transcript or AI suggestions, it receives a compressed audio copy of that recording.
• OpenAI (USA) — analyses transcript text to generate summaries, keywords, categories and suggestions. It receives text, not audio or video.
• 100ms — runs live multi-host sessions. Session audio and video are routed through its European infrastructure; session records are stored in its India region.
• Amazon Web Services — stores recordings of live sessions in Stockholm, Sweden.
• Resend — delivers account email such as password resets.
• GitHub (USA) — hosts our private task list. A problem report you send becomes a task there with its text, your user number, phone model, system and app version. Your screenshot stays on our servers. When you delete your account, the text is removed from the task and the task is closed.
• Expo and Google Firebase Cloud Messaging — deliver push notifications.
• Google and Apple — only if you choose to sign in with them.
• Microsoft Clarity (USA) — only if you opt in through our consent prompt or "Help improve Volo" in Settings. We do not attach your Volo account ID. Clarity uses its own device and session identifiers. We exclude private messages from capture and require Strict masking for enabled builds. Session replay does not record your microphone or camera.
• Sentry (USA) — stores error reports in its European region in Frankfurt, Germany. It receives limited JavaScript and server error diagnostics when reporting is enabled, including error category, code locations and software version when available. This troubleshooting reporting is separate from optional session analytics. We exclude account identifiers, request data, raw error messages, local variables, recordings, messages and screen content. Native device crash reporting is currently disabled.

5. Transfers outside the European Union

Some of the providers above are based in, or process data in, the United States and India. Data sent to them is limited to what each needs for the task described in section 4.

6. How long we keep it

• Your account and content are kept while your account exists.
• When you delete your account, your personal data is removed from our live database immediately, and the related media files are deleted from storage within minutes, with failed deletions retried until they succeed. The plays you added to other people's episodes stay in their numbers, with no link to you.
• A deleted episode stays recoverable for 30 days before its media is permanently removed.
• The raw recordings of a live session are deleted 30 days after the episode is published. These are your phone's own recording (the files the app records next to the call, so the episode sounds and looks better) and the separate recording of each person from the call. While the episode is a draft, we keep these files, because the episode is made from them. If the draft is deleted, they go 30 days after the deletion; if the host discards the recording, within a day. The episode itself is kept like your other content.
• Database backups are kept for up to 14 days, after which they are overwritten, so deleted data can remain in a backup for up to that long.
• We keep an anonymous placeholder record with no personal data so that internal account identifiers are never reassigned to someone else.

7. Your rights

Under the GDPR you can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interest. You can delete your account at any time in Settings → Delete account, or follow the steps on our account deletion page. For any other request, email support@yourvolo.com. You also have the right to lodge a complaint with a data protection supervisory authority.

8. Children

Volo is not intended for anyone under 16. We do not knowingly collect data from anyone below that age; if you believe someone under 16 has created an account, contact us and we will delete it.

9. Security

All connections to our service are encrypted. Uploaded media is held in private storage and served only through short-lived, access-checked links, and access to our systems is restricted.

10. Changes

If we change this policy we will update the date above, and for significant changes we will let you know in the app or by email.