Privacy policy

This policy explains how Foliyo handles information when you use our website, CLI, MCP integration and hosted pages.

Last updated: 30 September 2026. This service is provided by Foliyo. Contact: hello@foliyo.io.

Information we collect

• Account and connection information: email address, workspace name, password hash and salt when you use a password, account creation details, sign-in sessions, OAuth client registrations and access credentials. If you use Google sign-in, we receive the identity information needed to verify your email and connect your account.
• Work you provide: page HTML and associated assets or URLs, titles, design guides, sender profiles, projects, recipient names and email addresses, access settings and replies submitted by readers. Content can contain personal information you choose to include.
• AI tool inputs: the content and arguments your AI tool sends to Foliyo to carry out your request. Foliyo does not retrieve your complete chat history. Data deliberately included in a tool call is received by Foliyo.
• Readership information: when tracking is enabled, page openings, timestamps, browser identifiers, browser user-agent information, referring URLs, reading duration and section activity. Personalized links and email gates can associate activity with a named recipient or email address.
• Payments and support: subscription and Stripe customer identifiers, plan and billing status, and information you send in support requests. Stripe handles payment details; Foliyo does not ask you to send card information through an AI tool.
• Technical information: requests necessarily pass through our hosting infrastructure, which can process IP addresses and operational logs for delivery, security and troubleshooting. Foliyo also records security actions, timestamps, response outcomes and keyed identifiers derived from IP addresses and signed-in user IDs. These application security records exclude submitted passwords, access tokens, document contents and raw email addresses.

Data returned to ChatGPT and other connected AI tools

When you authorize the Foliyo MCP integration, the connected AI provider receives the results of the tools it calls on your behalf. Results can contain personal information at the top level, inside nested objects and lists, and inside returned document or design-guide text. The same result may appear as readable text and structured data. The categories and purposes are:

• Workspace setup and branding: your plan or feature entitlement, default sender selection, sender identifiers, labels, personal or company display names, logo URLs, colours, footer preferences and design instructions. Guide names, source URLs, summaries and requested guide text help the assistant prepare work in the right style. Setup tools also return project names, labels, descriptions, hub URLs, format and access defaults, and references to saved senders, guides and recipient groups. Recipient-group lists contain labels and member counts; reading a specific group returns its members’ names and optional email addresses.
• Documents and versions: page identifiers, slugs, titles, descriptions, URLs, project association, presentation format, source HTML and included assets or external URLs. Source HTML, design text and titles can contain any personal information you or your assistant supplied. Page lists include creation and update dates to find the correct work; revision history includes content-version dates, revision numbers and retention limits to identify and restore the right version. Source tools return the edit-permission flag and current revision needed to avoid overwriting another edit.
• Sharing and access: access settings, permitted email domains, verification requirements, expiry dates, view limits, tracking settings, recipient names and optional email addresses, and recipient identifiers needed to revoke a link. Publishing and link-retrieval tools return the page’s sharing PIN where recoverable; publishing and hub-creation results can return personalized recipient URLs containing a link token. These are access-sensitive sharing details for the requested deliverable, not your account password or sign-in credentials. Share them only with intended readers. General project-context and editing responses do not return stored hub PINs or raw recipient tokens.
• Readership and feedback: an opened/not-opened result and, where your plan allows, view counts, unique-reader counts, anonymous-view counts, first and last viewing dates, estimated active reading duration, section names and time per section. Reports can contain recipient names and email addresses, whether a recipient link was revoked, whether someone is on the recipient list, and whether activity was attributed through a personal link, an entered email address or both. Per-reader section summaries use a display name, email or an anonymous reader label, without the underlying browser-tracking identifier. Replies include the reader’s supplied name or email where available, reply text and submission date. These fields support the viewing report or feedback you requested. Anonymous visits do not reveal an email address, and personal links or unverified email entries do not prove a person’s identity.
• Action results and document checks: success or deletion/revocation status, saved record identifiers, publication/update status, the count of recipients notified when you request notifications, export and management URLs, availability flags and export limitations. Preflight returns prepared HTML and validation issues, which can include document section names, asset paths or URLs from the submitted work so the assistant can repair it.

We limit these tool results to approved fields, including nested records. We do not return account password hashes or salts, authentication tokens, raw browser-tracking identifiers, IP addresses, user-agent strings, referring URLs, internal content fingerprints, debugging records, stack traces or request/session identifiers through these MCP tools. Operational errors return a general message. This does not prevent personal information that you intentionally put in a document, guide, reply or other free-text field from being returned when that content is requested.

Foliyo receives the arguments explicitly sent by your AI client and does not retrieve the rest of your conversation. You control which workspace you connect, which requests you make, what personal information you provide and when you revoke the connection. The AI provider may retain previously returned results under its own policies, even after you delete the original record or disconnect Foliyo.

How we use information

We use information to authenticate you, publish and update your work, apply access restrictions, provide readership reports and notifications, process subscriptions, answer support requests and protect the service against misuse. We do not use Foliyo tool inputs to train our own AI model.

Who receives information

• People with access to your pages: published content is available to people permitted by your chosen access settings. An unrestricted page is accessible to anyone who obtains its URL. A private-looking URL is not a substitute for access restrictions.
• The publishing workspace: its authorized users and integrations can receive content, recipient information, replies and readership reports according to their permissions.
• Connected AI providers: when you use ChatGPT, Codex, Claude or another client, Foliyo returns requested tool results to that provider. Its separate policies govern its handling of your conversation and these results. Disconnecting Foliyo does not delete copies already returned to a provider.
• Service providers: Railway hosts the application; Resend delivers service emails, including verification and activity notifications; Stripe processes subscriptions; Zoho hosts our support inbox. Google handles sign-in if you choose it. Our pages can load fonts from Google Fonts.
• Destinations you configure: webhooks receive the event information you enable. External images, fonts and embeds within published content can send browser requests to their respective providers.
• Legal and security purposes: information may be disclosed where required by applicable law or needed to investigate abuse or protect users and the service.

Providers and recipients may process data outside your country. Foliyo does not offer a customer-selectable data-residency region.

Retention and deletion

Our current storage behaviour is as follows. Credential expiry is different from deletion of stored records.

• Account information, saved guides, senders, audiences and projects are retained while stored in your workspace, without a fixed automatic age-based deletion schedule. You can delete supported saved objects through the integration and request account-data deletion by contacting us.
• Published pages remain until deleted. Up to 10 previous content revisions are retained within a 15 MiB history budget per page; older revisions are discarded as new ones exceed these limits. Deleting a page removes its active page record, retained content revisions and availability, but does not automatically erase its historical readership events or copies held by recipients and other providers.
• Readership events and related records currently have no automatic retention cutoff. Contact us to request removal of personal data. We do not claim that these records expire after a fixed number of days.
• Sign-in sessions expire after 30 days. OAuth authorization codes expire after 60 seconds and are removed when consumed. Email verification codes expire after 10 minutes. Expired records are not necessarily immediately erased from storage.
• Viewer and recipient cookies last up to one year, email-gate cookies up to 90 days and PIN-gate cookies up to 24 hours. You can remove cookies through your browser.
• Optional research pilots record publishing outcomes, connection type and timestamps for 30 days after enrollment, with up to 2,000 events. Feature requests and optional notes are private. Pilot measurements contain no document content, prompts, recipients or reader identities. Withdraw and delete them from the Pilot page, or download your data there. Pilot data expires 90 days after enrollment and is removed during activity, startup and hourly while the service runs; older copies may remain in backups under their retention policy. Enrollment does not authorize marketing or public testimonials.
• Application security records are limited to the most recent 2,000 events and are pruned after 30 days, during activity, startup and hourly while the service runs. Older records may remain in backups or hosting-provider logs under their separate retention policies. Abuse-prevention counters expire after their short enforcement windows and are removed during subsequent checks.
• Billing records, support correspondence and hosting-provider logs follow their operational and legal retention requirements. There is currently no single automated deletion timetable across these systems. Ask us about a specific record when making a deletion request.

Your controls

You can delete pages, change supported page settings, turn viewing analytics off for a page through the integration, revoke recipient links, remove saved workspace objects and revoke a connected tool's access in Settings. Revoking a connection prevents future authenticated access using that credential; it does not delete published work.

You can also request access, correction or deletion of personal information through hello@foliyo.io. We may verify your identity and the relevant workspace's authority before acting. If you received a Foliyo from someone else, contact that sender about their use of your data as well. Rights and exceptions depend on applicable law, including any right to object, restrict processing or complain to a supervisory authority.

Clearing cookies removes browser identifiers and saved sign-in or gate state. It does not erase server-side records or prevent all future page activity from being recorded. Avoid including confidential or sensitive personal information in support messages or unrestricted pages.

Policy changes

We will update this page when our practices change and revise its date. Contact us if you have questions about a change.