What we hold, and what we do not.

You can point Folean at a project without making an account, without a card, and without telling us who you are. What comes back is produced in the moment and handed to you.

When you close the page it is gone from our side. We keep the plain operational facts any service keeps in order to stay up: that a request happened, when, and whether it succeeded. Those are kept for 30 days and are not linked to a person.

The moment you want the result to persist, something has to be stored. In a paid workspace that is exactly four things:

• Where your project stands, and the history of how that changed
• The evidence behind every claim, unedited, because edited evidence stops being evidence
• The documents and code Folean produced with you
• Any credentials you explicitly chose to save, so a check can run again without asking you each time

Nothing else. We do not build a profile of you, we do not sell anything to anybody, and we do not use your project to train a model. If that last one ever changes it will be asked for, per workspace, and off by default.

A credential is a key to something of yours. If you choose to save one, it is encrypted before it is stored, and it is never shown back to you afterwards. Not in the interface, not in an export, not to support. If you lose it, you replace it, which is the only safe answer.

Folean is built out of models, and models are not trustworthy places to put keys. So a saved credential never appears in readable form inside a model’s context. It is handed directly to the system it belongs to, at the moment it is used, by code that no model writes. A model can ask for a check to run. It cannot read the key that runs it.

Technical note: credentials are encrypted at rest with per-workspace keys, decrypted only inside the execution boundary, and redacted from every log and every prompt.

If real people use your product, their information is inside your systems. You decide what is collected and why. That makes you the controller of it. Folean only ever touches it because you asked us to check something, which makes us a processor acting on your instruction.

In practice this means we never use your users’ data for our own purposes, we act on what you tell us, and if you tell us to stop or delete, we do. It also means the obligations you have to those people stay yours. We can help you meet them and prove that you have. We cannot take them off you.

If data in a Folean workspace is exposed, or we have good reason to believe it was, you are told within 72 hours of us knowing. You are told what happened, what was affected, what has been done, and what you should do.

This is built into the product rather than written into a policy. The clock, the record of what was affected, and the notice itself are part of how the system runs, because a promise that depends on somebody remembering to keep it is not a promise.

Most checks only read. Some can only be settled by writing: proving a backup restores means actually restoring it, and proving protection is enforced means actually attempting a read that should be refused.

Before any of those run, the permission has to be:

• Written down, so there is a record of what you agreed to
• Scoped, naming exactly which action against exactly which system
• Revocable, at any moment, without asking anyone

A general agreement is never enough. Silence is never agreement.

Everything in a workspace can be exported at any time, in formats you can open without us. Delete a workspace and its contents go within 30 days, including from backups, and saved credentials are destroyed immediately rather than on that schedule.

The code and documents Folean wrote were written into your own project. Those were always yours and deleting a workspace does not touch them.

Folean runs on infrastructure and model providers we did not build. They are the only third parties involved, they are bound by agreements that pass these terms down, and they may not use anything of yours for their own purposes. We will keep the current list available and tell you before it changes in a way that matters.

Questions about any of this, or a request to see, export or delete what we hold, go to privacy@folean.com. We answer within 30 days and usually much sooner.

During early access this document will change as the product does. Material changes are announced before they take effect, not after.