Privacy

Who we are

VOLAT Work is run by Volat Labs LLC, a Maryland limited liability company. In this page, “we” means Volat Labs LLC.

What VOLAT Work is

VOLAT Work keeps the plan for an app: tasks, releases, ideas, docs and approvals. Your own AI tools connect to it with scoped keys. VOLAT never reads your code, does not run an agent and does not call a language model. Trust says what it can and cannot do.

Your email and sign-in

You sign in with your email address. Supabase Auth sends you an email with a link and a six-digit code. You can also set a password: Supabase stores it hashed, and VOLAT keeps no password of its own. In a workspace you choose a display name.

Workspace content

What you put in a workspace is stored in our database: apps, releases, tickets, comments, ideas, docs, decisions, attachments, members, agents, run receipts, approvals and a history of who changed what. We also keep a log of agent calls: which key, which action and whether it worked. The database limits every query to the caller’s own workspace.

Files you attach go to a private Supabase Storage bucket. If you turn on push alerts, we store your browser’s push address and keys, readable only by you.

When something breaks, we keep a short error report: what failed and on which page. Tokens, keys and similar secrets are replaced before it is stored.

Agent keys

Each agent has its own key. VOLAT shows it once, when it is created, and stores only its SHA-256 hash with a short prefix and a start-and-end hint. A key has scopes, can be limited to one app, expires (after 90 days unless the owner chooses otherwise) and can be revoked by the owner.

GitHub App

The GitHub App is optional. If you install it, VOLAT records for each ticket the repository, branch, pull request number and link, state, check state, mergeable state and head commit id. It reads the names of the files a pull request changes, never the patches or file contents, and it posts one check named “Mishka approval”. It asks GitHub for four permissions only: Metadata (read), Checks (write), Pull requests (read) and Commit statuses (read).

Launch list

If you join the launch list, we store your email address, when you joined and whether you have unsubscribed. We send one confirmation email from support@volatlabs.com through Resend. Every launch email has an unsubscribe link, and unsubscribing stops launch email to your address. The address stays on file, marked as unsubscribed, so we never email you again. We delete it if you ask at support@volatlabs.com.

The list is not readable by agents, API keys or other workspace members. One person at Volat Labs can open it. To limit repeated sign-ups, the server counts them per network address in memory.

Analytics

The public pages (home, pricing, launch list, docs, guides, trust, changelog, public roadmaps, privacy and terms) use Google Analytics, and we show no consent banner. Loading it sends your browser’s request to Google, with the page address and title, and an event when someone joins the launch list. The event does not include the email address. Analytics does not load inside the signed-in app or on the sign-in pages.

Cookies and browser storage

• mishka-theme remembers light, dark or system. Your browser sets it when you choose a theme, and it lasts a year.
• Sign-in cookies keep you signed in. They are httpOnly, SameSite Lax and Secure in production. Two short cookies, which last up to an hour, hold the address a code was sent to and the page to return to after sign-in.
• Google Analytics sets its own cookies on the public pages.
• Inside the app, your browser’s storage holds interface settings such as recent apps, panel widths and unsent idea drafts. They stay in your browser.

Who processes data for us

• Supabase: the database, sign-in and attachment storage.
• Vercel: hosts the web app and its daily job runner.
• Resend: sends the launch list emails.
• Google: Analytics on the public pages.
• GitHub: only if you install the GitHub App. We send it the “Mishka approval” check and read the file names of pull requests.
• Your browser’s push service: only for push alerts you turned on.
• Webhook addresses: only ones the owner sets up in Settings. VOLAT sends them signed events that carry ids and a few plain fields, never titles, comments or secrets.

Backups of the data may be kept with our database host or in a private GitHub repository.

Keeping, exporting and deleting data

Settings, Workspace, Export everything downloads one JSON file with every table you can read. Secrets are left out: agent key hashes, device keys and personal views. The owner can also set up a nightly export to a private repository they control.

VOLAT does not hard-delete workspace data. Deleting something marks it deleted, and the owner can restore it from Settings, Trash. There is no permanent-delete button yet, so deleted items stay in the database, and the change history cannot be edited or removed. We have not set a retention period for workspace data.

To ask about your data or the launch list, write to support@volatlabs.com.

Where data is processed

This page names no hosting region, because none is recorded for the database or the app. If the region matters to you, ask before relying on VOLAT Work.

Children

VOLAT Work is a work tool for people building apps. It is not aimed at children.

Changes

When this page changes, the date at the top changes.

Contact

Volat Labs LLC, support@volatlabs.com