Privacy at Foleo

Who we are

Foleo is operated by Contraverse Inc., a company based in Ontario, Canada. Contraverse Inc. is responsible for the personal information described on this page. For any privacy question or request, email [email protected].

The desktop app

The Foleo macOS app opens folders on your Mac and does not require an account. It does not include analytics or telemetry that reports on your files or your usage, and your documents stay on your Mac unless you publish them with Foleo Publish, which uploads only the files you choose to publish.

The app periodically asks downloads.foleo.app whether an update exists. That request carries no document content. We count it with the country it came from, the referring site, and the browser family, without storing your IP address.

This website and downloads

foleo.app does not run advertising trackers or third-party analytics scripts and does not set marketing cookies. The site is served through Cloudflare, which processes standard request information such as IP address and user agent to deliver and protect it.

When you download the app, we count the download together with the country it came from, the website that referred you, your browser family, and any campaign tag in the link. We do not store your IP address with that count.

Publish accounts

If you join the waitlist or create a Publish account, we store your email address, your invitation status, and your account and organization details, such as your handle. A waitlist signup also stores how you found us, such as the campaign tags on the link you followed, and the signup form uses a Cloudflare bot check.

We send one-time sign-in codes through Resend from mail.foleo.app, and each code expires after five minutes. We keep a log of the emails we send, with the address but not the message, for one day, and delivery-status events for 30 days.

Signing in records the browser you used and may record your IP address. Signing in from the desktop app stores the IP address and browser of that sign-in attempt with the one-time code. Session cookies are set only on the publish.foleo.app dashboard, never on this marketing site. API keys are stored only as one-way hashes. We also keep security records, such as when keys are created or content is deleted, and we log when Foleo staff look up account records to support you.

Content you publish

Files you publish, with their titles and page addresses, are stored on Cloudflare and served at your foleo.site links. We use that content only to host and serve it at the addresses you choose and to investigate abuse reports. We do not sell it, show ads against it, or use it to train AI models.

Unpublishing makes reader links return 404 without deleting your files. Deleting starts a 30-day restore window, after which the copies Foleo holds are purged.

People who read published pages

Published pages do not set tracking cookies and do not load analytics scripts. We count page views for each page and path so their owners can see usage, without recording the reader's IP address or browser. Password-protected pages set a cookie for 12 hours once the password is accepted, and a private-page preview sets one for a few minutes. Cloudflare processes standard request information to deliver and protect every page.

If a reader clicks Open in Foleo and is not signed in, the Foleo dashboard sets a first-party cookie for 90 days that remembers the campaign link they followed, so a later waitlist signup can be attributed to it.

Active HTML pages run code written by their publisher, which may collect information under that publisher's own practices, not Foleo's.

Agents you connect

When you connect an AI agent such as Claude, ChatGPT, Codex, or Cursor, we store the app's name as the app or its published identity document supplies it, the permissions you approved, when you connected, and when the app last obtained access. Access tokens are stored only as one-way hashes. When you approve an active HTML publish, we record a fingerprint of the exact HTML you approved.

A connection expires after 90 days, and you can revoke it at any time from your account's agent connections page. An app you never approve is deleted after one day. Foleo receives only what an agent sends to its tools, such as a document to publish. It never sees the rest of your conversation with the agent.

Security and abuse prevention

To limit abuse, rate limits use salted or keyed one-way hashes of IP addresses, grouped by short time windows, instead of the addresses themselves. Service logs record the kind of request, its path, its result, and how long it took. They do not record cookies, authorization headers, or the content you publish, and we do not extend Cloudflare's default log retention.

If you report a page at publish.foleo.app/report, we keep what you submit, including your email address if you give one, so we can investigate.

How we use information and who processes it

We use personal information to provide your account and host what you publish, which is necessary to perform our agreement with you, and to secure the service and prevent abuse, which is our legitimate interest.

Foleo runs on Cloudflare, which hosts the service, stores content and data, and delivers pages, and it uses Resend to send email. These providers process data only to provide their services to us. Because they operate globally, your information may be processed outside your country, including in the United States, under the data processing terms those providers offer.

We do not sell personal information, share it for cross-context behavioral advertising, or share it with advertisers. We disclose information only when the law requires it or when it is needed to protect people from harm.

How long we keep data

We keep account information while your account is open. Deleted content can be restored for 30 days and is then purged. Sign-in codes expire after five minutes and agent connections after 90 days. Email logs are kept as described above. Rate-limit records hold only hashed values, and service logs are short-lived. Security records are kept longer.

When you ask us to close your account, we delete the published content we hold for it. Erasing the account itself, including its email address and sessions, is currently a manual step that we complete when you ask, except for records we must keep to meet a legal obligation or to prevent abuse.

Your rights

You can ask to see, correct, export, or delete the personal information we hold about you by emailing [email protected]. We answer within 30 days. You can unpublish or delete your content and revoke agent connections yourself at any time, and you can ask us to close your account.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or to the data protection authority where you live.

Children

Foleo Publish is not intended for anyone under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has given us information, email [email protected] and we will delete it.

Changes and contact

If this policy changes, we will update the date at the top of this page and tell account holders in advance of a material change. If we want to use your information for a new purpose, we will ask for your consent first. The current version always lives at foleo.app/privacy. Questions about privacy: [email protected].