Privacy Policy

Folio ("we", "us", "our") operates the Folio academic writing platform available at usefolio.co ("the Service"). We take your privacy seriously and are committed to being transparent about how we collect and use your data.

For any privacy-related questions, contact us at hello@usefolio.co.

We collect the following categories of information:

— Account information: your name and email address when you register.

— Content you create: documents, source libraries, uploaded files, and notes you store in the Service.

— Usage data: how you interact with the Service, including features used, pages visited, and actions taken.

— Device and technical data: browser type, operating system, IP address, and general location (country/region).

— Payment information: billing details when you subscribe to Pro. Payment card data is processed and stored by our payment provider — we never see or store your card number.

— Document content and metadata when AI features are used.

— A profile photo, if you choose to upload one.

— Content you choose to paste or import for processing — for example, reference text or an AI-chat transcript you import to start a draft.

— Survey responses: if you use Folio Surveyor to run a survey, we process the responses your respondents submit. You control what your survey asks.

Folio does not require sensitive personal data to open an account or use the core writing tools. However, a survey you build with Folio Surveyor may ask respondents for sensitive ("special category") information — such as health, beliefs, or demographic data. Where it does, we process those responses on your behalf, only with the respondent's explicit consent, under the additional safeguards described in section 12. We do not use this data for any purpose of our own.

We use your data to:

— Provide, operate, and improve the Service.

— Process payments and manage your subscription.

— Send you important service-related communications such as account confirmations, security alerts, and billing receipts.

— Send product updates and announcements (you can opt out at any time).

— Detect and prevent fraud, abuse, and security incidents.

— Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your documents or writing content for advertising purposes.

Folio uses AI features (including document analysis, citation suggestions, writing assistance, research discovery, and — in shared documents — an opt-in Scholar AI advisor) that process your content. When you use these features, the relevant material — which may include your document text and titles, your sources, or content you paste or import (such as an AI-chat transcript) — is sent to our AI model providers for processing.

We use Anthropic Claude and OpenAI models for these features. Your content is used solely to generate the requested output and is not used to train AI models.

Some features also query public scholarly databases (such as CrossRef and Unpaywall) to verify citations and fetch source metadata. These lookups send identifiers and titles — not your document.

You can use Folio's core features (writing, citations, export) without using AI features. AI features are opt-in by nature — they only process your content when you actively trigger them.

For more information about how Anthropic and OpenAI handle data, see their respective privacy policies.

Our AI providers are contractually required to handle your data in accordance with applicable privacy laws and not to use it for model training.

We share your data only in the following circumstances:

— Service providers: with trusted third-party vendors who help us operate the Service (such as cloud storage, payment processing, and AI services). These providers are bound by data processing agreements and may only use your data to provide services to us.

— Collaborators you invite: when you share a document, its contents and your name and profile photo are visible to the people you invite to it. You control who has access and can change or revoke it at any time.

— Legal requirements: if required by law, court order, or governmental authority.

— Business transfers: if we merge with or are acquired by another company, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

— With your consent: in any other circumstances, only with your explicit consent.

We never sell your personal data.

We retain your account data for as long as your account is active.

If you delete your account, we will delete your personal data and content within 30 days, except where we are required to retain it for legal or compliance purposes.

Anonymised or aggregated data that cannot identify you may be retained indefinitely for analytics and product improvement.

Depending on your location, you may have the following rights regarding your personal data:

— Access: request a copy of the personal data we hold about you.

— Correction: request correction of inaccurate or incomplete data.

— Deletion: request deletion of your personal data ("right to be forgotten").

— Portability: receive your data in a structured, machine-readable format.

— Objection: object to certain types of processing, including direct marketing.

— Restriction: request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, email us at hello@usefolio.co. We will respond within 30 days.

We use cookies and similar technologies to operate the Service. Specifically:

— Essential cookies: required for authentication and session management. These are always on because the Service cannot sign you in without them; they set no analytics.

— Analytics cookies: help us understand how the Service is used so we can improve it. These are off by default. We set them only after you accept analytics in the cookie banner shown on your first visit, and never before. You can withdraw that consent at any time — from the banner or in Settings → Privacy — and declining or ignoring the banner means no analytics cookies are set at all.

We do not use advertising or tracking cookies, we never track you across other websites, and we do not share or sell cookie data.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, secure authentication, and regular security reviews.

No system is completely secure. In the event of a data breach that affects your rights or freedoms, we will notify you and relevant authorities as required by applicable law.

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

If you believe we have inadvertently collected data from a child under 13, please contact us at hello@usefolio.co.

The Service is operated globally. Your data is stored and processed primarily in Australia (our database provider's Sydney region) and in the United States (our hosting, email, and AI-processing providers), and may be processed in other countries where our service providers operate. These are countries whose data protection laws may differ from those in your jurisdiction.

For transfers of personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (SCCs), together with the equivalent UK and Swiss addenda — so that your data receives a level of protection essentially equivalent to that guaranteed within the EEA.

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR). Folio is the data controller for your account and the personal data described in this policy. Where you use Folio Surveyor to collect responses from others, you are the controller of those responses and Folio acts as your processor under a data processing agreement.

Our legal basis for processing your data is: (a) performance of a contract — to provide you with the Service; (b) legitimate interests — to operate, secure, and improve the Service, balanced against your rights; (c) compliance with legal obligations; and (d) consent — for example, product-analytics cookies, which we set only after you accept them, and which you can withdraw at any time from the cookie banner or in Settings → Privacy.

Sensitive ("special category") data — such as health or belief data that a Surveyor survey may collect — is processed only on the basis of the respondent's explicit consent (Article 9(2)(a)), and you as the survey owner are responsible for obtaining it. Withdrawing consent is as easy as giving it, and does not affect processing that already took place.

You can exercise your access, correction, deletion, portability, objection, and restriction rights directly in the app — Settings → Account lets you export all of your data in a machine-readable format and permanently delete your account — or by emailing us at hello@usefolio.co. We respond within 30 days and never charge for a first request.

You have the right to lodge a complaint with your local data protection authority, though we'd appreciate the chance to resolve any concern first.

The Save to Folio browser extension is a thin client of Folio. It collects no analytics and sends no data to any third party — every network request the extension itself makes goes only to usefolio.co.

Saving a source: when you click the extension icon, choose "Save to Folio" from the right-click menu, or press the keyboard shortcut, the extension reads citation metadata from the page you are on — standard scholarly meta tags, Schema.org and Open Graph data, and any DOI. It does not read page content until you trigger a save. On Google Scholar it reads each result's title and metadata line to offer per-result save buttons.

Saving a link: when you right-click a link and choose "Save to Folio", the extension sends only that link's URL to Folio. Folio's servers then fetch that page to extract its title, authors, and date so the saved record is complete. The extension itself never fetches other websites.

Verify citations: text you paste into the Verify tab is sent to Folio, which uses AI to identify the citations it contains and then checks each against the public CrossRef database to see whether the cited work actually exists. The pasted text is used only to answer your request; it is not used to train any model.

Ask about a page: when you use the Ask tab, the extension sends the readable text of the page you are viewing, together with your question, to Folio, which answers using AI grounded only in that text. The page text is used only to answer your question; it is not used to train any model.

To fulfill these requests Folio's own servers may in turn contact the page you asked to save, the CrossRef metadata service, and Folio's AI provider. The extension itself communicates only with usefolio.co.

Authentication: your Folio session and refresh tokens are read via a content script that runs only on usefolio.co, stored in the extension's own chrome.storage.local, and are not accessible to any web page. They are sent only to usefolio.co/api/extension/*.

Local storage: your access and refresh tokens, plus a small cache of the last 5 sources you saved (for the popup's "Recent" list) and your recently used tags. Clear all of it via the "Sign out" link in the popup footer, or by removing the extension.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the Service at least 30 days before the change takes effect.

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at hello@usefolio.co.

We aim to respond to all privacy-related inquiries within 30 days.