1. Who we are
VolNet ("we", "us", or "our") is an independent project operated from Georgia. It operates the VolNet mobile application, the website at https://volnet.app, and related services (together, the "Service").
For privacy questions or to exercise your rights, contact us at [email protected]. If we are required to appoint a data protection officer or representative in a jurisdiction relevant to you, we will publish their contact details here.
2. Information we collect
We collect the following categories of personal information when you use the Service.
| Category | Examples | Why we collect it |
|---|---|---|
| Account and contact information | Name, email address, phone number, encrypted or hashed account-password records, account type | To create, authenticate, secure, and administer your account. |
| Profile information | Gender, date of birth, city, country, biography, languages, interests, social-media links, and hosting availability | To create your profile and enable community and matching features. |
| Organisation information | Organisation name, email, website, city, country, and profile image | To create and display organisation profiles. |
| Content you provide | Profile, organisation, and event images; event title, description, date, time, and location | To provide the profile and event features you choose to use. |
| Community activity | Invitations, volunteering history, event participation, and account status | To operate volunteer–organisation relationships and the Service. |
| Push-notification information | Firebase Cloud Messaging (FCM) registration token, device platform, notification permission status, and the dates the token was registered or last updated | To deliver optional event reminders and organisation event-approval notifications to the device you choose to register. |
| Security and technical information | Authentication tokens, IP address, device/app information, request logs, and security records | To protect the Service, troubleshoot, prevent abuse, and meet legal obligations. |
We do not request precise GPS location through the app. Location information in the Service is the city, country, or event location you enter or select.
The app uses Firebase Cloud Messaging to deliver optional push notifications. Firebase may process technical information needed to deliver a notification, such as a registration token and device or app information. We do not use FCM for advertising, cross-context behavioural advertising, or analytics. The app does not currently include third-party advertising or analytics SDKs. If this changes, we will update this policy before the new processing begins.
3. How we use information and our legal bases
Where the General Data Protection Regulation (GDPR), the UK GDPR, or similar law applies, we process personal information only when we have a valid legal basis. Depending on the activity, we rely on:
- Performance of a contract: to create and manage your account, provide profiles, events, invitations, and the core Service.
- Legitimate interests: to secure the Service, prevent fraud or misuse, maintain and improve the Service, and communicate about service-related matters. We balance these interests against your rights.
- Consent: where law requires it or where you make an optional choice, such as enabling push notifications, biometric sign-in, or providing optional profile information. You may withdraw consent at any time; this does not affect processing already carried out.
- Legal obligation: to comply with applicable law, enforceable requests, accounting requirements, or to establish, exercise, or defend legal claims.
We use your information to:
- provide, personalise, maintain, and secure the Service;
- display profile, organisation, and event information to the users who need it to use the Service;
- authenticate you, manage passwords, and support optional biometric sign-in on your device;
- communicate with you about accounts, invitations, events, support, and material Service changes;
- investigate abuse, enforce our Terms of Service, and protect users and the public; and
- comply with legal requirements and resolve disputes.
We do not sell personal information or use it for cross-context behavioural advertising.
4. Push notifications
Push notifications are optional. If you enable them, we use Firebase Cloud Messaging (FCM) to send service-related notifications, including reminders about events you joined and requests for an organisation to approve an event. Notifications may display event information, such as an event name or start time, on your device.
You can choose not to enable notifications, turn them off in your device settings, or disable them in the app where that option is available. Turning off notifications stops future delivery but does not undo notifications already shown on your device. We keep your FCM registration token while it remains associated with your active account and device, until it becomes invalid, you unregister it, or your account is deleted.
5. Who can see your information
Information you put in a volunteer profile, organisation profile, event, or invitation may be visible to other authenticated VolNet users as needed for the Service. For example, volunteers may view organisation and event details, and organisations may view volunteer information made available through the relevant community features. Do not post information that you do not want other users to see.
We may disclose information to:
- service providers that host, secure, maintain, or support the Service, acting under contractual instructions;
- professional advisers, insurers, auditors, or prospective transaction parties where necessary and lawful;
- competent authorities or other parties where required by law or needed to protect rights, safety, or security; and
- a successor organisation in connection with a merger, acquisition, restructuring, or sale of assets, subject to applicable law.
Current service providers: Railway provides application and database hosting, Cloudinary provides image storage and delivery, and Google Firebase Cloud Messaging provides push-notification delivery. Each provider may process information in the regions where it operates. We use these providers only to operate the Service. We do not currently use advertising, analytics, crash-reporting, payment, or marketing-email providers.
6. International transfers
Your information may be processed in countries other than the country where you live. Where a transfer is subject to GDPR, UK GDPR, or similar restrictions, we will use a valid transfer mechanism and appropriate safeguards, such as an adequacy decision or approved standard contractual clauses.
Railway, Cloudinary, and Firebase may process information outside your country, including outside Georgia and the European Economic Area. Where a transfer is subject to GDPR, UK GDPR, or similar restrictions, we will use a valid transfer mechanism and appropriate safeguards, such as an adequacy decision or approved standard contractual clauses.
7. Retention
We keep personal information only for as long as necessary for the purposes described in this policy, including to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. When information is no longer required, we delete it or de-identify it, unless lawful retention is required.
We retain active-account information while your account remains active. We retain deactivated-account information while it is needed to allow reactivation or until you request deletion. We retain security logs for up to 90 days and backup copies for up to 90 days after the primary copy is deleted, unless a longer period is required to resolve a dispute, prevent abuse, or comply with law.
Deactivating an account disables access; it does not necessarily delete personal information. See Section 8 for deletion requests.
8. Security
We use reasonable technical and organisational safeguards designed to protect information. These include encrypted connections where supported, access controls, authentication controls, and secure on-device storage for authentication data.
No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for promptly contacting us if you suspect unauthorised access.
9. Your privacy choices and rights
You may update certain profile information in the app. You may deactivate your account in the app settings. To request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, contact [email protected]. We may need to verify your identity before responding.
If GDPR or a similar law applies to you, you may have rights to be informed, access your information, correct it, erase it, restrict processing, object to processing, receive portable data, and not be subject to certain solely automated decisions. You may also complain to your local data protection authority. We aim to respond within the time required by applicable law; under GDPR this is generally one month.
If you are in Georgia, you may also have rights under Georgia’s personal-data-protection law. You can submit a complaint to the Personal Data Protection Service of Georgia where applicable.
10. Children
The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided personal information to us, contact [email protected] so we can take appropriate action.
11. Third-party links and user content
The Service may contain links to third-party websites or social-media profiles that users provide. We do not control those services and are not responsible for their privacy practices. Review their privacy notices before providing information to them.
12. Changes to this policy
We may update this policy when our practices or legal requirements change. We will publish the revised version in the Service and update the effective date. For material changes, we will provide additional notice where required by law.
13. Contact
VolNet, operated from Georgia
Privacy and support: [email protected]