Privacy policy.

Who we are

Foli ("we", "us") makes the Foli app for iPhone and operates the foliapp.co website. This policy explains what information the app and the website handle, and, mostly, what they deliberately don't.

The app

Your documents stay on your device

Everything you scan in Foli (page images, PDFs, signatures, document names, folders and any text read from a page) is stored on your iPhone. We do not receive it, and there is nothing for us to read.

Sign in with Apple

You can scan and save without an account. To earn leaves, you sign in with Apple. Apple gives us a private identifier for your account, and, only if you choose to share it, an email address (which can be an Apple relay address). We use the identifier to keep your leaf and tree count, and the email only to reply to you or tell you about changes to your account.

Page fingerprints and leaf counts

When you scan a page while signed in, the app works out a perceptual hash of it: a short fingerprint that lets us tell whether two pages look the same, without having the page. It sends that fingerprint, the number of pages, and the date to our server, linked to your Apple identifier. We use this to:

• tell new pages from repeats, so rescanning the same page doesn't earn more leaves,
• keep your leaf total, your tree count and your monthly limit, and
• spot attempts to game the counter.

Checks for blank pages and photos of screens happen on your phone before anything is sent. The fingerprint can't be reversed into your page, and it contains none of the page's text.

Leaves you earn while signed out are kept on your phone for 30 days and sent only if you sign in within that time.

App Attest

To make sure leaf counts come from a genuine copy of Foli, the app uses Apple's App Attest service. It proves to our server that a request came from the real app on a real device. It does not identify you and carries no content.

Planting with Ecologi

We buy trees from Ecologi in one batch each night. Ecologi receives the number of trees we're buying and nothing about you: no name, no email, no identifier and no scans. Your tree certificate is generated by Foli from the project information Ecologi publishes.

Invites

If you share an invite link and a friend joins through it, we record that the two accounts are linked by that invite so we can give each of you 10 leaves. We don't access your contacts.

Advertising and measurement

The iPhone app uses four third-party services. RevenueCat records subscription events, such as a trial starting or a subscription renewing or being cancelled, so we can see how the business is doing. Meta receives those same subscription events and, if you allow tracking when iOS asks you, an advertising identifier, so we can tell which ads bring people to Foli. AppsFlyer counts installs, trials and subscriptions and records which ad brought each one, so we can compare one advertising channel against another on the same terms instead of taking each network's word for its own performance. It tells the network that delivered the ad that an install happened, and nothing more than that. Amplitude counts which screens get used and which steps people give up on, so we can find the parts that don't work and fix them.

None of the four receives your scans, your documents, the text in them, or your page fingerprints.

If you decline the tracking request, no advertising identifier is collected and nothing is linked to you. Meta then receives nothing at all. RevenueCat and AppsFlyer still record that an install, a trial or a subscription happened, because that is how we count them, but with no identifier attached and nothing that points back to you. You can change your mind at any time in iOS Settings, under Privacy & Security, then Tracking.

That tracking request does not govern Amplitude, in either direction. Amplitude receives no advertising identifier and no IP address. What it does receive is linked to your subscription events from RevenueCat, so we can tell whether the people who find the app useful are the people who subscribe. That link is the only one: nothing here is combined with data from outside those two services, sold, or used to target advertising at you. Allowing or declining Apple's prompt neither switches it on nor off. It is on from the start, we say so during setup, and it has its own switch in the app, under Settings, then Privacy, then Product analytics.

Our App Store privacy label is "Data Used to Track You." Apple requires that label whenever an app may share an advertising identifier with a third party, and it applies whether or not you personally allow it.

Copy text

Reading text from a page uses Apple's on-device text recognition. The page is never uploaded for this, and no server sees the text.

iCloud sync (Pro)

If you turn on iCloud sync, your documents sync to your private iCloud account so they appear on your other devices and survive a lost phone. This happens between your device and your own Apple account, under Apple's iCloud terms and encryption. We have no access to your iCloud data. You can turn sync off in Foli's settings, and remove the app's iCloud data in iOS Settings → your name → iCloud → Manage Storage.

Camera and photos

Foli asks for camera access to scan, and for photo library access only if you choose to import an image. Images stay on your device.

The app lock

The lock uses Face ID or Touch ID, with your device passcode as the fallback. Biometric data is managed entirely by iOS and never reaches us or the app itself.

Exports are yours to control

When you export or share a PDF, the app hands it to the iOS share sheet and you decide where it goes. We never see an export. On the Free plan, exported PDFs carry a small Foli footer. The footer contains no tracking.

Deleting your data

• On your phone. Deleting a document deletes it. Deleting the app deletes everything stored in it. If iCloud sync was on, remove the synced copy from your own iCloud account as described above.
• What we hold. Delete your account in Foli under Settings → Account → Delete account, or write to privacy@foliapp.co. We delete your Apple identifier, your page fingerprints, your leaf and tree counts and any invite links. You don't have to give a reason, and we'll confirm when it's done.
• Trees already planted stay planted. Tree orders are kept in our records as counts with no link to you.

Children's privacy

Foli is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, write to privacy@foliapp.co and we will delete it.

Where data is kept and for how long

Fingerprints and leaf counts are stored on servers in the United States for as long as your account exists, and deleted when you delete it. Subscription and measurement data is held by the services above under their own retention settings.

The website

foliapp.co is a static marketing site. It is not the app, it never receives anything from the app, and none of what follows applies to your documents.

Analytics and cookies

The website uses Google Analytics 4 so we can see which pages people find useful and which ones fail them. Here is exactly how it is configured:

• Cookies are off until you accept them. Analytics loads in Google's Consent Mode with storage denied by default. Until you press Accept on the banner, no analytics cookie is written and no visitor ID is kept. We receive an anonymous, aggregate page count and nothing that follows you between visits.
• If you accept, Google Analytics sets its standard cookies (_ga and similar) so returning visits can be recognised as returning. You can change your mind by clearing this site's cookies and site data in your browser, which brings the banner back.
• If you decline, that choice is remembered locally and the banner stays gone. Analytics continues in its cookieless mode.
• No advertising signals, ever. Google's ad-related signals (ad_storage, ad_user_data, ad_personalization) are denied permanently and never granted, even if you accept. We run no remarketing and no cross-site tracking pixels, and no advertising platform receives anything from this site.
• What we measure. Pages viewed, roughly where in the world the visit came from, what kind of device it was, and clicks on the App Store buttons. Analytics never receives your name, your email address, or anything you type.

All of this lives in one auditable file, /assets/analytics.js, if you would rather read the code than take our word for it.

Also worth knowing

• Hosting. The site is served by Vercel, whose infrastructure may keep short-lived technical logs (such as IP addresses) to deliver and secure the site, per Vercel's privacy policy.
• Fonts. Pages load typefaces from Google Fonts, which means your browser requests font files from Google's servers, per Google's privacy policy.

Legal process

We respond to valid legal process only, we read what is asked for, and we object to requests that are overbroad or reach beyond what the process authorises. What we can hand over is limited to what we hold, which is very little by design:

• We hold no documents. Your scans, PDFs and their text are on your device. A demand for them returns nothing, because we have nothing.
• We hold fingerprints and counts. For signed-in users: an Apple identifier, any email Apple shared with us, page fingerprints with dates, and leaf and tree totals. A fingerprint can't be turned back into a page.
• iCloud is Apple's. If you use iCloud sync, that copy sits in your own Apple account, and any demand for it is a matter between the requesting party and Apple.

Where process reaches something we hold, we will notify the person affected before we respond, so they have the chance to object, unless the law or a court order forbids it.

Purchases

Subscriptions are processed by Apple through the App Store. We receive no payment card details. Apple's handling of purchase data is described in Apple's own privacy policy.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export the personal information we hold, and to object to some uses of it. Write to privacy@foliapp.co and we will respond within 30 days. We do not sell personal information or share it for cross-context behavioural advertising outside the app measurement described above.

Changes to this policy

If we change this policy, we will post the updated version here with a new effective date. Changes that would send more data off your device get called out prominently, not buried.

Contact

Questions about this policy or your privacy: privacy@foliapp.co.