The short version. Volkus analyses your face to estimate a demographic label. That analysis happens entirely inside your browser. No photo, no video frame, and no biometric template is ever uploaded to us — not during the scan, not afterwards, not ever. What we store is a resulting label (for example “White · Millennial · M”), a country code, and an anonymous token. There is no account, no email address, and no password.
Volkus is operated from Australia by Qalarc. We are the data controller for the purposes of the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You can reach us at team@qalarc.com.
The scan uses your camera for about 30 seconds. The video stream is processed frame-by-frame on your own device by the Volkus Engine, a set of machine-learning models that your browser downloads and runs locally.
Under Australian privacy law, biometric information used for automated identification is sensitive information. Because the imagery never leaves your device and no template is retained, we do not collect or hold biometric information. The demographic label we do store is derived, coarse, and not used to identify you as an individual.
You can refuse. The camera only turns on after you tick the consent boxes, and you can close the page at any point. You can also browse Volkus without ever scanning — you simply post without a demographic label.
| Data | Why | Kept for |
|---|---|---|
| Anonymous token | A SHA-256 hash generated in your browser from device and
browser characteristics. It lets us recognise a returning visitor and
stop the same person voting twice, without an account. |
90 days |
| Demographic label | The scan's output (ethnicity, age bracket, gender, skin-tone band) plus any label you have disputed. This is the point of the site — it is shown publicly alongside your posts. | 90 days |
| Country code | Two letters (for example AU), read from Cloudflare's
CF-IPCountry header, to show a flag and produce country statistics. |
90 days |
| Posts, replies, votes | The content you choose to publish, and your votes. | Until removed |
| Reports | Moderation records when content is flagged. | Until resolved |
We do not store your IP address against your activity, and we do not store names, email addresses, phone numbers or payment details, because we never ask for them.
The token is a device fingerprint. It is built from characteristics your browser already reveals — screen size, timezone, available fonts, graphics rendering, and similar — hashed together with your demographic label. We keep only the hash, never the raw characteristics. It is pseudonymous: it is not your name, but it is reasonably stable for your device, so we treat it as personal information and protect it accordingly. Clearing your browser storage, or changing device or browser, produces a different token.
Volkus sets no advertising or tracking cookies and uses no
third-party analytics. We use your browser's localStorage to keep your
token, your demographic label, your theme, and your filter choices on your own
device. You can erase all of it at any time by clearing site data in your browser.
Volkus is hosted on Cloudflare Pages, with data stored in Cloudflare Workers KV. Cloudflare processes requests on our behalf as our hosting provider and is bound by its own terms; see the Cloudflare privacy policy.
We do not sell your data. We do not share it with advertisers or data brokers. We do not run third-party trackers. Aggregate, non-identifying statistics are published openly on our public data dashboard — that transparency is the point of the project, and those figures never identify an individual.
Under the Australian Privacy Principles you can ask us to:
Email team@qalarc.com, quoting your token (the scan page shows it). We aim to respond within 30 days. Because we hold no other identifier, the token is the only way we can locate your data — if you have cleared your browser storage we genuinely cannot find it, which is a consequence of collecting so little.
The simplest deletion is immediate and needs no request: clear this site's data in your browser, and stop using the site. Anything still stored server-side expires on its own within 90 days.
If you are unhappy with our response you may complain to the Office of the Australian Information Commissioner (OAIC).
Volkus is for adults. You must be 18 or over. The scan includes an automated age estimate and blocks anyone it reads as under 18. Age estimation is imperfect and is a safeguard, not a guarantee. If we learn we hold data from a person under 18 we will delete it — write to team@qalarc.com.
All traffic is served over HTTPS with HSTS. Content is served with a strict referrer policy and a permissions policy that limits camera access to this site. Administrative endpoints require a separate secret. No system is perfectly secure, but the strongest protection here is structural: we do not hold the data most worth stealing, because face imagery never reaches our servers.
The demographic label is produced by a machine-learning model and will sometimes be wrong. Ethnicity, gender and age are not neatly detectable from a face, and every such model carries the biases of its training data. Published accuracy figures for the models are on the home page. The label affects nothing outside this site: it does not gate access, pricing, or any consequential decision. If it is wrong you can dispute it, and that dispute is itself part of the experiment.
If we change this policy we will update the date at the top and, for anything material, note it on the home page. Volkus is a young project and its mechanics are still evolving; we would rather tell you plainly when something changes than quietly revise the text.
Privacy questions, access and deletion requests, and complaints: team@qalarc.com.