Privacy Policy

Volume is a tool for short-form creators. It helps you make TikTok slideshows and Instagram carousels, publishes them to the accounts you connect on the schedule you set, and shows which content formats are performing on TikTok. We are the data controller for the information described below.

When you connect TikTok, you are sent to TikTok’s own consent screen and you choose whether to grant access. We never see or store your TikTok password. We request these permissions and no others:

• —user.info.basic and user.info.stats: your open ID, username, display name, avatar and follower count, so the app can show you which account is connected.
• —video.list: your own posts and their view, like, comment and share counts. This is the complete set of metrics TikTok makes available to us. We do not receive watch time, retention, audience demographics, or any per-slide data, because TikTok does not expose them.
• —video.upload and video.publish: permission to send a finished post to your account. You choose, per campaign, whether posts publish directly to your profile with the privacy level and disclosure settings you configured, or land in your TikTok inbox as drafts you publish yourself. Nothing is ever posted outside the settings you set, and turning a campaign off stops posting immediately.

Connecting Instagram is optional. When you choose Connect with Instagram, you are sent to Instagram’s own login and consent screen (Instagram Login, operated by Meta) and you choose whether to grant access. We never see or store your Instagram password. Only Instagram professional accounts (Business or Creator) can be connected. We request these permissions and no others:

• —instagram_business_basic: your Instagram account ID, username and account type, so the app can show you which account is connected and post to the right one.
• —instagram_business_content_publish: permission to publish the single images and carousels you create in Volume to that account. Posts go out only when you press Post now or at the time you schedule, with the caption you write. Nothing is published that you did not create and schedule, and you can cancel a scheduled post until it is sent.

We do not read your Instagram direct messages, comments, followers, insights, or any other content, and we do not request permissions for them. To publish, the images you created are placed at a public web address on our domain for long enough for Instagram to fetch them.

You tell us which accounts you want watched. For those accounts we collect only information that is publicly visible on TikTok: post captions, publish dates, and public counts such as views, likes, comments and shares. We obtain this through a third-party public-data provider rather than scraping TikTok ourselves.

We analyse the structure of those posts: how many slides, what kind of opening line, where the call to action sits. We do not republish anyone’s content, and drafts we generate for you are written from structural patterns, never copied from another creator’s words.

When something goes wrong in a project, you can choose Send to Volume in the Volume Mac app. That sends us the record of what the app’s agent did on that project, so we can work out what went wrong: the agent’s conversation, the commands it ran, the project’s edit history, the project file, the frames the agent looked at, the results of the app’s checks, and a short excerpt of the app’s log with passwords, keys and sign-in tokens taken out. It also says which version of the app and which AI model you used, and includes the note you write. Your exported video or your footage is included only if you tick the box for it. Nothing is sent without your confirmation.

So the team sees a report the day it arrives, a short notice with your email, your workspace’s name and the start of your note is posted in our team’s private chat. We use a report only to diagnose and fix the problem. We keep the report and that notice for 30 days and then delete both, and we delete them sooner if you ask.

• —We do not sell your data, and we do not share it with advertisers or data brokers.
• —We only post what your campaigns generate, with the privacy and disclosure settings you chose. Pausing a campaign stops posting immediately.
• —We do not access your TikTok direct messages, followers list, or private analytics; we do not request those permissions.
• —We do not access your Instagram direct messages, comments, followers or insights, and we do not publish anything to Instagram you did not create and schedule.
• —We do not use your content to train general-purpose AI models.

We analyse structural features across our customer base (how often a numbered-list opening outperforms a question, for instance), so that a format working in your niche is spotted sooner. This pooling uses derived attributes only: slide counts, opening types, pacing.

We never pool the look, voice, or persona of your content, and pooled data is never traceable back to an individual account. If you would rather be excluded entirely, email us and we will opt you out.

We use a small number of processors, each contractually limited to providing their service to us: a cloud database and file storage provider, a public-data provider for competitor posts, an email delivery provider for digests, an AI provider that generates draft text and reads post imagery, and a team chat service where we get notices such as a report you sent from the Mac app. Providers are not permitted to use your data for their own purposes.

You can disconnect TikTok or Instagram at any time from Settings, which immediately stops all access. You can also revoke access from within TikTok’s or Instagram’s own settings, which has the same effect: when you remove Volume from your Instagram account’s apps, Meta tells us and we disconnect it straight away.

To have us delete the data we hold about your Instagram account, see tryvolume.app/data-deletion. A deletion request sent through Instagram is carried out automatically and at once.

To delete your account and everything associated with it, use the delete option in Settings or email [email protected]. We remove your data within 30 days, except where we are legally required to retain records such as invoices. Backups are purged on a rolling 35-day cycle.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, object to processing, or receive it in a portable format. Email us and we will action it within 30 days, free of charge. If you are unhappy with our response you may complain to your local data protection authority.

Access tokens are encrypted at rest and the encryption key is stored separately from the database, so a copy of the database alone does not grant access to any TikTok or Instagram account. Data is encrypted in transit. Access to production systems is limited to those who need it.

Volume is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

If we make a material change we will email account holders before it takes effect. The date at the top of this page always reflects the current version.