Privacy Policy

1. Information We Collect

We collect only the information needed to provide the Folded service.

Account Information
When you sign in with Google, we receive your name, email address, and profile picture from your Google account. This is used to identify you within your family album and attribute your entries to you. We do not store your name or profile picture on our servers — this information is fetched from Google each time you open the app.

Album and Entry Data
When you create or join a family album, we store the following on our servers:

• Album details: family name, album year, and administrator identity
• Membership records: your email address, user ID, role (admin or member), and membership status
• Entries: photo references, captions, and the author's user ID for each photo entry
• Invitations: invitation tokens and metadata when you invite a family member to join your album

Photos
Photos you add to your album are stored as JPEG files on our secure cloud storage (Microsoft Azure Blob Storage). They are accessible only to members of your album.

Subscription and Billing Records
If you purchase a Folded Pro subscription, we store your subscription tier, expiry date, and a purchase-verification token issued by Google Play. We do not receive or store your payment card details — billing is handled entirely by Google.

Push Notifications
When you grant notification permission on your device, the app registers a device token (Firebase Cloud Messaging / FCM token) with our servers. We store one token per user to deliver push notifications about album activity — for example, when a family member adds an entry, when an invite is accepted, or when a PDF export is ready. This token is updated on each app launch and removed when you sign out.

On-Device Data
The app stores a temporary session token (which expires after 60 minutes), a local cache of album metadata and photo thumbnails, and your local reminder preferences on your device. This data is not transmitted to us independently.

2. How We Use Your Information

We use the information we collect solely to operate and improve the Folded app:

• To authenticate you and connect you to your family album
• To display your name and profile photo to other album members
• To store, display, and export the photos and entries in your family album
• To generate the year-end PDF photo book export
• To manage your album membership and process invitations you send or receive
• To verify and manage your Folded Pro subscription
• To maintain the security and integrity of our service
• To send you transactional and event-driven notifications (such as album invitations, membership changes, and subscription alerts) via email
• To send you push notifications about album activity (new entries, invite acceptances, export completions) via Firebase Cloud Messaging

We do not use your information for advertising, profiling, or any purpose beyond the core app functionality.

3. Where We Store Your Data

Folded stores your data in the following locations:

Our Cloud Infrastructure — Microsoft Azure
Album metadata, membership records, invitation data, photo captions, and subscription records are stored in Azure Cosmos DB. Photos are stored in Azure Blob Storage. Both services are operated by Microsoft Corporation and subject to Microsoft's security and privacy standards.

Your Device
A temporary session token, a local cache of your album data and photo thumbnails, and your local reminder preferences are stored on your device by the Folded app. This data is removed when you sign out.

Firebase (Google) — push notification delivery
Your device's FCM token is stored on our servers and passed to Firebase Cloud Messaging to deliver push notifications. Google receives the device token and notification payload (which does not include photo content or personal data beyond what is needed to route you to the relevant screen). See Google's Privacy Policy for details on how Firebase processes this data.

4. Legal Basis for Processing

If you are in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases under the GDPR (Article 6) for processing your personal data:

• Performance of a contract — providing the Folded service, managing albums, processing invitations, and managing your subscription
• Legitimate interests — maintaining the security and integrity of our service and preventing fraud
• Consent — registering your device for push notifications (Android notification permission). You may withdraw this at any time by revoking notification permissions in your device settings. Withdrawing consent does not affect your ability to use Folded

We do not use automated decision-making or profiling that produces legal or similarly significant effects (GDPR Article 22).

5. How We Share Your Information

We do not sell your personal data. We do not share it with advertising networks or data brokers. We share data only as follows:

Microsoft Azure (data processor)
Our backend infrastructure runs on Microsoft Azure. Microsoft processes your data on our behalf under a Data Processing Agreement.

Other Album Members
Your name, profile photo, and the entries you add to an album are visible to the other members of that album. You can see who the members of your album are at any time within the app. When an album is exported as a ZIP archive, the included album.json file contains the email addresses of all album members at the time of export. This file is part of the downloaded archive and is accessible to the album member who initiated the export.

Google (subscription verification only)
When you purchase a Pro subscription, we send a receipt-verification request to Google Play to confirm your purchase. No personal data beyond the purchase token is exchanged for this purpose.

Legal requirements
We may disclose your information if required by law or in response to a valid request from a competent authority (such as a court order), to the extent required by applicable law.

6. International Data Transfers

We are based in South Africa. By using Folded, your data is processed by Microsoft Azure, which operates datacentres globally (including in the United States, Europe, and Asia-Pacific). These transfers are governed by Microsoft's Data Processing Agreement, which includes the European Commission's Standard Contractual Clauses where applicable.

For South African users, transfers outside South Africa are conducted in accordance with Section 72 of POPIA. Microsoft Azure provides appropriate safeguards through its contractual commitments and internationally recognised security certifications.

7. Data Retention

We retain your data for as long as necessary to provide the service and meet our legal obligations:

• Album metadata, entries, and photos — retained until you delete them from the app, or until we receive and process a deletion request from you
• Album membership records — retained until you leave or are removed from all albums
• Invitation records — deleted automatically when the invitation expires
• Subscription records — retained for 5 years after subscription end, as required for financial record-keeping under applicable tax law
• FCM device token — retained while your account is active; removed when you sign out or uninstall the app
• Session token (JWT) — expires automatically after 60 minutes and is not retained by us
• Email address (account) — retained until you delete your account or we receive and process a deletion request from you

To request deletion of your data, contact us at the address below. We will respond within 30 days.

8. Children's Privacy

Folded requires users to sign in with a Google account. Google requires account holders to be at least 13 years old. Folded is therefore intended for users aged 13 and over.

If you are in the European Economic Area, note that the minimum age for digital consent may be higher (up to 16) in your country. Parents and guardians are responsible for supervising their child's use of the app where required by local law.

If you believe a child under 13 has provided personal information through Folded without appropriate consent, please contact us immediately and we will delete the relevant data promptly.

9. Security

We implement the following measures to protect your data:

• Encryption in transit — all communication between the Folded app and our servers uses HTTPS / TLS
• Encryption at rest — photos in Azure Blob Storage and metadata in Azure Cosmos DB are encrypted at rest by Microsoft Azure
• Secrets management — signing keys and sensitive configuration are stored in Azure Key Vault, not in application code
• Time-limited access — photo download links expire automatically after 60 minutes
• Minimal permissions — our Google Sign-In integration requests only the minimum scopes required (profile and email)

We do not store your Google password or payment card details. Despite these measures, no internet service can guarantee absolute security. If you have a security concern, please contact us immediately.

10. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal data. To exercise any of these rights, contact us at febrevdmerwe@gmail.com. We will respond within 30 days (45 days for California residents).

• Right of access — request a copy of the personal data we hold about you (GDPR · POPIA · CCPA)
• Right to rectification / correction — ask us to correct inaccurate personal data (GDPR · POPIA · CCPA/CPRA)
• Right to erasure / deletion — ask us to delete your personal data (GDPR · POPIA · CCPA). Certain retention obligations may apply (see Section 7)
• Right to data portability — receive a copy of your data in a structured, machine-readable format (GDPR)
• Right to restrict processing — ask us to limit how we process your data in certain circumstances (GDPR)
• Right to object — object to processing based on legitimate interests (GDPR · POPIA)
• Right to withdraw consent — withdraw consent for optional processing (e.g., push notification permissions) at any time without affecting the lawfulness of prior processing (GDPR · POPIA)
• Right to non-discrimination — we will not treat you differently for exercising your privacy rights (CCPA/CPRA)

11. South African Residents — POPIA

Folded is operated by Hercules Le Febre van der Merwe, who acts as the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA).

Information Officer: Hercules Le Febre van der Merwe
Contact: febrevdmerwe@gmail.com

We process your personal information for the purposes described in Section 2 above. The lawful grounds for processing under POPIA are:

• Contractual necessity — to provide the Folded service you have agreed to use
• Legitimate interest — to maintain the security and integrity of our service
• Consent — for push notification delivery (Android notification permission)

Transfers of your personal information outside South Africa (to Microsoft Azure infrastructure) are conducted in accordance with Section 72 of POPIA. Microsoft's contractual safeguards satisfy the requirement that the destination provides an adequate level of protection.

If you believe we have processed your personal information in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: www.inforegulator.org.za
• Email: inforeg@justice.gov.za
• Phone: +27 (0)12 406 4818

12. California Residents — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights.

Categories of personal information we collect:

• Identifiers — name, email address, and a Google-assigned user ID
• Photos, audio, and video — the photos you choose to upload to your family album
• Commercial information — your subscription tier and App Store / Google Play purchase records
• Internet or network activity — a temporary session token stored on your device

We do not sell or share your personal information for cross-context behavioural advertising. We have not done so in the preceding 12 months.

Your California rights:

• Right to know — request details about the personal information we collect, use, and disclose
• Right to delete — request deletion of your personal information, subject to certain exceptions
• Right to correct — request correction of inaccurate personal information we hold about you
• Right to opt-out of sale or sharing — as we do not sell or share your information, no further action is required
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights

To exercise your California rights, email us at febrevdmerwe@gmail.com. We will respond within 45 days as required by law. We do not respond to Do Not Track signals, as we do not engage in cross-site tracking.

13. Changes to This Policy

If we make material changes to this privacy policy, we will update the "last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of Folded after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or your personal data — including requests to access, correct, or delete your data — please contact us:

If you are an EEA resident and not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. If you are a South African resident, you may contact the Information Regulator (see Section 11).