VØLT is the controller of the data described here. This policy says what we collect, why, who else touches it, how long we keep it, and how you get it back or get rid of it. It is written to be read, not to be survived.
| Data | Why | Legal basis |
|---|---|---|
| Name, email, hashed password | To give you an account | Contract |
| Age, sex, height, current/start/goal weight, activity level, dietary preference, stated goal | To calculate your macros and build your plan | Explicit consent |
| Onboarding survey answers (focus zones, equipment, diet, schedule, training age) | To build your initial plan during signup | Explicit consent |
| Body measurements, check-ins, weight history, personal records, workout logs | To track progress and adapt the program | Explicit consent |
| Food and macro logs | Nutrition tracking and AI food analysis | Explicit consent |
| Wearable metrics — resting HR, HRV, sleep, steps (only if you start a sync) | Recovery and readiness guidance | Explicit consent |
| Physique photographs (only if you upload them) | AI progress feedback | Separate explicit consent |
| AI coaching conversations | Continuity between sessions | Contract |
| Subscription tier, status, Stripe customer/session IDs | Billing and access control | Contract; legal obligation |
| Volts activity — balance, transactions, quests and lessons rewarded, boosts, coach-perk requests and their notes, your invite code and who used it | To run Volts (earning, spending, buying) | Contract |
| Crypto payments (only if you pay in crypto) — the coin, network, amount, transaction ID and the wallet address it was sent from | To match your payment to your order and credit it | Contract; legal obligation |
| Feature-usage events tied to your email | To find where the app is failing people | Legitimate interests |
| Push subscription endpoint and browser user-agent (only if you turn reminders on) | To deliver notifications | Consent |
| Name, email, phone from lead and contact forms | To send what you asked for, follow up, and qualify the inquiry (we may record a lead stage, an estimated interest level, and internal notes) | Consent |
We never see, receive or store your card number. Stripe handles the card end to end. Crypto payments are sent straight to VØLT's wallet; we never hold keys for, or have access to, your wallet. Blockchain transactions are public and permanent by design, so a transaction itself can't be deleted from the blockchain — only our records about it.
In a PostgreSQL database operated by Supabase, hosted in the United States. Every table carries row-level security, so a signed-in session can only read rows belonging to that account. Traffic is encrypted in transit with TLS. The app itself is served by Cloudflare.
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, authentication, server-side functions | US |
| Cloudflare | Hosting, CDN, bot protection on forms | Global |
| Stripe | Payments and subscriptions (Stripe is the controller of your card data) | US / IE |
| Google (Gemini) | AI coaching, meal plans, program generation, food and photo analysis | US |
| Anthropic (Claude) | AI coaching, as fallback | US |
| Ollama Cloud | AI coaching, as fallback | US |
| AgentMail | Transactional and coaching email | US |
| Sentry | Error and crash reporting — receives technical error reports tied to a pseudonymous account id and your tier, never your name, email, or health data | US |
| Google Fonts & jsDelivr | Content-delivery networks that serve fonts and code libraries; they receive your IP address as part of loading the page | Global |
| Apple HealthKit | Health sync — only if you start it; data moves from your device to us, never the other way | On device |
| Apple / Google / Mozilla push services | Delivering notifications you asked for | Global |
| Public blockchain data services (PublicNode, Base, Arbitrum, Solana, dRPC, MEV Blocker, mempool.space, Blockstream, TronGrid, XRPL) | Read-only lookups of public transactions sent to VØLT's own wallet, to confirm crypto payments — we send them no personal data | Global |
| Coinbase, Kraken | Public BTC and XRP prices for crypto quotes — no personal data is sent | US |
The AI providers process each request to produce an answer and do not use your data to train their models under the API terms we contract on.
International transfers. If you are in the EU/EEA or the UK, your data is transferred to the United States under the Standard Contractual Clauses incorporated in these processors' terms.
Your macros, calorie targets, meal plans and training programs are generated automatically from what you enter. They are estimates produced by formulas and AI models. No legal or similarly significant decision about you is made automatically. AI output can be wrong. Nothing in VØLT is medical advice — talk to a doctor before changing how you eat or train, and especially if you are pregnant or have a medical condition.
Wherever you live, VØLT gives you the same controls, in Profile → Privacy & Your Data:
You also have the right to restrict or object to processing, the right to data portability (the JSON export exists for exactly this), and the right to lodge a complaint with your supervisory authority.
You have the rights to know, delete, correct, and to opt out of sale or sharing for cross-context behavioural advertising — we do neither, and we have no "Do Not Sell" link because there is nothing to opt out of. You will never be discriminated against for exercising a right. You may use an authorised agent.
The consumer-health-data provisions of the My Health My Data Act and Nevada SB 370 apply to your body and fitness data. We honour those provisions for every user regardless of where they live. We do not sell consumer health data and will not do so without the separate signed authorisation those laws require.
Prefer to do it by email? Write to yuhfriendchris@agentmail.to from your account address. We respond within 30 days (45 in California, extendable once where the law allows). Nothing here requires you to prove where you live.
VØLT is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
VØLT sets no advertising or analytics cookies. It uses your browser's local storage to keep you signed in and to cache your logs so the app works offline. That storage is strictly necessary to provide the service you asked for, which is why no cookie banner is shown for it. Clearing your browser storage signs you out.
Row-level security on every table, JWT authentication on every endpoint that handles your account data, a Content-Security-Policy on the app, signature verification on payment webhooks, and rate limiting on AI and checkout endpoints. No system is perfect; if we suffer a breach affecting your data we will notify you and the relevant regulator within the deadlines the law sets.
If we change how your data is used in a way that matters, we will tell you in the app and by email, and where the law requires it we will ask for your consent again rather than assuming it.
The controller of your data is the operator of VØLT. VØLT is provided by:
Data controller: Christopher Ryan Benavides (sole operator)
Business name / registered entity: to be completed on formation — see §12
Registered address: to be completed
Contact email: yuhfriendchris@agentmail.to
EU/EEA or UK users. If VØLT is offered to people in the European Economic Area or the UK, the law requires an EU/UK Representative (GDPR Art. 27) to be named here. That appointment will be added before we begin offering VØLT to EU/EEA or UK customers.
This section is completed when the legal entity behind VØLT is formed and registered. Until then, the operator identified in §11 is the controller. When the entity exists, its legal name, registered number, and registered office will be stated here, and the entity will become the controller named throughout this policy.
VØLT — yuhfriendchris@agentmail.to