Your work is personal.
Here’s how we handle it.
Folio is designed around a personal, signed-in workspace. This policy describes the features in this version—not promises about certifications or services we don’t provide.
Your account and profile
Folio stores your display name, email address, sign-in provider identifiers, and the preferences you choose. Google and GitHub sign-in require a verified provider email. Optional gender, country, and forms of address are used only for your profile and personalization, not for eligibility or access. You can edit or clear optional answers in your preferences.
Your workspace
Projects, tasks, ideas, activity, notification preferences, search history, and saved filters are stored in the deployment’s Neon-compatible PostgreSQL database. Backend requests are scoped to the signed-in user. Settings offers a JSON export of workspace data. The landing page uses a dedicated synthetic example workspace—not private user captures.
Authentication and cookies
Folio uses an HTTP-only, SameSite session cookie and single-use OAuth state with PKCE. HTTPS deployments use Secure cookies. Sessions expire after 30 days and can renew while active. Logging out revokes the current server session. Local storage remembers the visual theme and existing view preferences. Rate-limit records use hashed request identifiers and limited expiry windows.
Google Calendar
Calendar access is separate from signing in with Google. You choose which calendars to display, and write access is optional. Calendar credentials are retained server-side with the existing encrypted-token storage. Disconnecting in Settings removes the stored Calendar account and event mirror, without deleting events in Google Calendar.
Local AI and approved actions
WebLLM model inference happens in your browser on compatible hardware. Model files download from public model hosts, which receive ordinary download-request information such as your IP address. Conversations are not sent to a paid AI inference provider. Usage metadata and approved, structured action parameters are sent to Folio’s backend. Those parameters can include the content you ask Folio to save. Conversations currently live in browser memory, not the usage database.
Third-party providers and retention
Google, GitHub, the hosting provider, the PostgreSQL provider, and model hosts process requests under their own policies. Workspace records remain until removed through Folio or by the deployment administrator. Current sessions can be revoked by signing out; Calendar access can be disconnected in Settings. This version does not yet include a self-service account-deletion workflow.
Keep sensitive information out of prompts
Do not put passwords, API keys, government identifiers, or other unnecessary sensitive details into your workspace or AI prompts. No security system is infallible. For the terms governing this preview, read Terms of service.