Effective 2026-05-03 · Plain English

Your client data was never a training dataset.

Folden is built for solo and small-firm professionals doing regulated work. Privacy is not a feature here — it's the substrate. This page tells you exactly what we collect, why, and what we don't.

The short version

• · Every artifact you upload is encrypted with a key only you control.
• · Folden never trains on your data. The model we use is shared; your patterns are private.
• · When Folden talks to LLM providers (Anthropic, etc.), client names and identifiers are tokenized first — they see structure, not raw data.
• · You can disconnect any third-party integration instantly. You can delete your account in one click; everything becomes unrecoverable.
• · We never sell, share, or use your data for advertising. Ever.

What we collect — and why

We collect the minimum needed to make the product work for you.

Account

Email, name, profile picture from Google sign-in. Used to identify you and personalize the briefing.

Artifacts and inputs

Documents you upload — your example artifact, case-specific source materials. Encrypted at rest with your per-user data key. Folden cannot read this content without your active session.

Patterns

Edits and refinements you make to drafts, captured as reusable judgment patterns. Lives in your encrypted vault; never used to train shared models.

Third-party integration metadata

When you connect Google Calendar, Gmail, or Drive, Folden pulls metadata only (event titles, email subjects + headers, file names + types). No email bodies, no file contents. All encrypted with your data key before being persisted.

Audit log

Every read, write, decrypt, draft generation, and export is recorded in a cryptographically signed audit chain you can verify. We see when access happened — never the underlying decrypted content.

What we never do

• · Train AI models on your data. The base model (Anthropic Claude) is frozen. Your patterns travel as prompt-time exemplars in your encrypted vault and never leave it.
• · Sell or share data with advertisers. Folden has no ad business. Your data is yours.
• · Read raw client data inside LLM prompts. PII is tokenized at the model boundary — Anthropic, OpenAI, or any other provider sees structural placeholders, not your client's name or financial figures.
• · Mutate your Google data. Every Google scope Folden uses is read-only.

Google API data — specific commitments

Folden's use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.

• · Calendar metadata (event titles, times, attendees) is used to compose your daily briefing and pull meeting context into your drafts. Not used for any other purpose.
• · Gmail metadata (subjects, participants, recency, unread state — never bodies) is used to surface email-aware drafting context. Not used for any other purpose.
• · Drive metadata (file name, type, owner, modified time — never contents) is used to surface recent docs in your briefing and let drafts reference what you've been working on. Not used for any other purpose.
• · Google data is not transferred to humans except (a) at your direction, (b) for security investigations of suspected abuse, or (c) to comply with applicable law.

Where data lives

• · Storage — Cloudflare R2, S3-compatible. Encrypted ciphertext only.
• · Database — PostgreSQL on Fly.io. Sensitive fields are encrypted before insertion; the database never sees plaintext.
• · Encryption keys — AWS KMS. Master key never leaves AWS HSMs. Per-user data keys are generated on first use and bound to your user id by encryption context.
• · Region pinning — EU users' data lives in EU. US users' in US. Compliance enforced at the substrate, not policy.

Right to erasure

Delete your account from Settings and one row disappears: your encrypted data key. Every ciphertext in storage — including backups — becomes mathematically unrecoverable in that moment. No retention exception. We confirm via email when complete.

Disclosure

We will not disclose your data to third parties except (a) when you direct us to, (b) when required by valid legal process — and we will fight overly broad requests, (c) to a successor entity in a merger or acquisition, who must honor this same policy.

Contact

Privacy questions, deletion requests, security disclosures — email privacy@folden.io. We respond within 5 business days.