Privacy
Privacy policy
Last updated
Folie stores the research you put in it and the account that owns it, and as little else as running the service allows. This page says what that is, who else touches it, and how you take it out.
Folie is in early access. This policy describes what the service does today; it is updated in the same change as the behaviour it describes, and the date above moves with it.
What Folie stores
Your account. The email address you sign up with, a display name if you add one, and the credential behind your sign-in: a password held as a hash by our authentication provider, or the identity returned by Google if you sign in that way. Each account belongs to a personal workspace and to any team workspaces you are invited into, and the workspace roster records your role in each.
Your research. Everything you write or upload into a project: manuscripts and their files, datasets and their versions, the links and locations you give for data kept elsewhere (never the files they point to), figures, sources and citations, claims, and the AI-use declarations you choose to add. Every version of a manuscript, whether you save it yourself or Folie records it at the end of an editing session, records who wrote it, when, and whether the assistant took part, because that history is the product. A name you give a version can be read by everyone who can read the project. A PNG or JPEG you upload as a figure, or that comes in a project’s .zip, is stored without the details a camera or editor writes into it, such as where a photo was taken, the camera and any comments; the picture, its colour profile and its rotation stay.
Your autosaved draft. While you edit a manuscript, Folie saves the text you have typed since the last version to your account a moment after you stop typing, so a refresh, a crash or another device does not lose it. There is one draft per person per project. Only you can read it, and only while you can still edit that project: other members, including the workspace’s owner and admins, cannot. It is deleted when it becomes a version, when you discard it, when the project is deleted, or when you delete your account. If you lose edit access to a project, your draft there stays out of everyone’s sight, yours included, until the project or your account is deleted.
When you last opened a project. For each project you are a member of or that was shared with you, Folie keeps when you last opened it and when your visit before that ended, so that opening it can tell you what others saved in between. Only you can read these times, and only while you can still open that project. They are deleted when the project is deleted or when you delete your account. Download your data includes them.
Your provider keys. If you add your own key for an AI provider, Folie encrypts it (AES-256-GCM, with a key held only on the server) before it is stored, never shows it again, and uses it only for the requests you start. You can remove it at any time in Settings.
Security records. Sensitive actions such as adding or removing a key, deleting a project, or changing who is in a workspace write an entry to an append-only audit log that records who acted, what they did, and the network address the request came from. Entries are deleted one year after they are written. Counters used to stop abuse hold a network address, an account, workspace or project id, or a one-way hash of an email address, and are deleted within three days. They never hold your sign-in session or anything derived from it.
Billing. Paid plans are not live. When they are, payments will be handled by Stripe, and card details will never reach Folie; we would hold only the customer and subscription identifiers Stripe issues.
Product analytics. Where the deployment has analytics enabled, PostHog receives page views and product events such as “project created”. It runs without cookies or browser storage, is told not to record your IP address, and never receives the content of anything you write. Sign-in codes are stripped from any URL before it is reported.
Why
To provide the service you signed up for (the contract between us), to keep it secure and to investigate abuse (our legitimate interest), and to meet legal obligations where they apply.
Folie does not use anything you put into it to train a model. The AI provider that answers an assistant request handles it under that provider’s own terms, which for your own key are the terms of your account with them. Some free tiers, including Google AI Studio’s, allow the provider to use requests to improve its models, so use a paid key if that matters to you.
Who else handles it
Folie is built on hosted services. Each one receives only what its part of the job requires.
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Database, authentication and file storage, in the United States (AWS us-east-1) | Everything listed above, at rest |
| Vercel | Hosts and serves the application | Every request, including its network address |
| Resend | Sends sign-in, confirmation and password-reset emails | Your email address and the link in each message |
| Google Cloud | Runs the LaTeX compiler | A project’s source files, only when you compile, kept only for the compile |
| Your AI provider (Anthropic, OpenAI or Google) | Answers assistant requests | The text you ask about and the document context needed to answer, under your own key or the deployment’s where its operator has configured one. With no key on either side, Folie returns sample output and sends nothing. |
| Crossref, OpenAlex, arXiv | Paper search, DOI lookup and arXiv links | Your search text, or the DOI or arXiv id of a paper you add |
| NCBI (PubMed) | Finds the DOI of a PubMed or PMC article you add by link | The article’s PubMed or PMC id |
| The site a link points to, and doi.org | Reads a paper’s title, authors and date when you add a source by link, or when a DOI’s record is only on its own page | Up to six requests from Folie’s server for that page, the first and any redirects, without cookies or anything about your account, so the site sees Folie rather than you |
| Sentry | Error reports, where enabled | The type, message and stack of an error, the page path without its query, and the app version. It is told not to store your network address, and receives no cookies, headers or document content |
| PostHog | Product analytics, where enabled | Page views and product events, without cookies, IP addresses or document content |
| Stripe | Payments, when paid plans open | Your email and the plan you choose; card details go to Stripe directly |
Previews of linked files. A project can link to data kept elsewhere. When a reader chooses Show preview on a Google or Microsoft file, their browser loads the preview directly from Google or Microsoft, which receive that reader’s network address and, if the reader is signed in with them, know who is looking; that sign-in and the file’s own sharing settings decide what the preview shows. Folie sends those companies nothing, fetches nothing from them and never reads the file. Opening a link takes the reader to that site, under its own policy.
Importing from Google Drive. Where this deployment offers it, an editor can import a Google Sheet, a CSV file or an image from their own Google Drive. Their browser signs in to Google in Google’s own window, where Google asks whether Folie may open the files they pick, and only those, so Google knows who signed in and which file they picked. The browser then reads that one file from Google and sends its contents to Folie the way an upload goes. Folie’s servers never receive, keep or use a Google sign-in or token, and make no request to Google. What Folie keeps is the imported dataset or figure, with a line saying where it came from. You can take back Folie’s access to the files you picked in your Google Account, under third-party connections; what you imported stays in Folie, as an upload does.
We do not sell personal data and do not share it with anyone else, except where the law requires it.
Cookies and browser storage
Folie sets these cookies, and no others:
- Your sign-in. A session cookie keeps you signed in. While an emailed sign-in or password-reset link, or a Google sign-in, is under way, a second one pairs it with the browser that started it. Neither is readable by scripts.
- Two preferences. One remembers the theme you chose, and one remembers how you arranged the panes of the project workspace, so a project opens the way you left it. Each lasts a year.
- A change of address. If Folie moves to a new web address and you open a sign-in link sent to the old one, a cookie keeps you on the old address for half an hour so that sign-in can finish. It holds nothing about you.
Your browser also keeps a few interface preferences locally, such as a prompt you dismissed or the model you last picked. There are no advertising cookies, no cross-site tracking, and, because analytics run without cookies, nothing that requires a consent banner.
Sharing you control
- Public projects. Some projects, such as the live demo, are public: anyone with the link can read the manuscript, its sources, data, figures and history, while editing stays with the members. There is no switch for this in the product today, so nothing you create becomes public on its own.
- AI-use records. A record you publish is readable by anyone with its link, which is the point of it. It contains what you declared and the signed hashes that let a reader verify it, never the manuscript text itself.
- Workspaces. Members of a workspace you belong to can see your display name and your role there, and every version you save carries your name for them. Its admins also see the email address an invitation was sent to until it is accepted.
- Shared projects. When a project is shared, its owner and everyone it is shared with see each other’s display names and roles on it, and every version one of them saves there carries their name for the others.
Keeping it, and taking it out
Your data is kept for as long as your account exists. Two controls in Settings → Data controls are yours at any time:
- Download your data gives you an archive of the projects in workspaces you own or administer and of your own autosaved drafts (the fifty you edited most recently, as many as one download holds, with a list of any it leaves out) and of when you last opened each project, then the projects’ images, fonts and PDFs that still fit, with a list of any it leaves out, and each project can also be exported from its Export menu as LaTeX, Markdown, PDF or a submission package.
- Delete account erases your account, your personal workspace and everything in it, and your autosaved drafts in every project, in a single transaction. Where you contributed to a project owned by someone else, your contributions remain so that their history stays whole, but your identity on them is replaced by an anonymous marker. Two things stay as they are, because other people rely on them: an AI-use record you published keeps the name and ORCID iD you signed it with, and the prompt saved with an assistant edit stays in that project’s history. If you want a published record withdrawn, contact us through the support page before you delete your account.
Audit-log entries, including the network address of each request, are deleted one year after they are written, whether or not you still have an account. Abuse counters are deleted within three days. Our hosting provider’s backups can hold a copy of deleted data for a limited time before they roll over.
Your rights
Wherever you are, you can see what we hold (export), correct it (Settings), erase it (Delete account), and take it with you (export and the submission package). If you are in the EU, the UK or another jurisdiction that grants further rights, such as objecting to processing or complaining to a supervisory authority, those rights apply, and the support page tells you how to reach us to exercise them.
Security
Everything travels over TLS. Every table in the database enforces row-level access rules, so the database itself, not only the application, refuses a request for another person’s data. Provider keys are encrypted at rest; the audit log cannot be edited after the fact. Folie is not designed for protected health information or other data governed by a specific regime, and you should not store such data in it.
Children
Folie is not intended for anyone under 16, and we do not knowingly hold their data. If you believe we do, write to us and we will remove it.
Changes
When this policy changes, the date at the top changes with it. A material change will be announced in the product before it takes effect.
Contact
See the support page for how to reach the people who run this deployment.