Privacy Policy

Last updated: 2026-09-03

The short version

Folium is a local-first application. Your notes, cards, and all other content live in a folder on your device. We do not operate a server, we do not collect telemetry, and we do not see your data.

What data the app stores

• Vault content: notes, cards, quick notes, drawers, folios, and assets are stored as plain files (Markdown/JSON) in the vault folder you choose.
• App state: the search index, settings, and per-device UI state are stored in a .folium/ directory inside your vault and in the app’s platform-standard log directory.
• Logs: diagnostic logs are written to a local log file only. They are never transmitted anywhere.

Optional sync

Sync is entirely optional. The app works fully offline with the “Keep local usage” choice, and nothing ever leaves your device in that mode. Only one sync provider can be connected at a time.

If you explicitly enable sync, you choose one provider:

• GitHub: the app connects to GitHub using the OAuth device flow. The token is stored locally (in the OS keychain on desktop and iOS, or in an app-private storage location on Android) and is used exclusively to push/pull your vault to your own GitHub repository.
• iCloud (macOS/iOS): the vault is mirrored into a folium folder in your own iCloud Drive. No separate sign-in or token is involved; Apple’s privacy policy applies.
• Google Drive: the app authorizes via Google’s OAuth page and stores a refresh token locally (same storage as above). Your vault is transmitted only to the hidden app-data folder of your own Google Drive, over HTTPS; the app cannot see any other Drive files. Google’s privacy policy applies.

In all cases vault content leaves the device only over HTTPS, only to the provider you configured, and only while sync is connected. You can disconnect at any time in Settings; this deletes the stored token and stops all sync network activity.

Network access

The app makes network requests only in these cases:

• Update checks (direct desktop downloads only): on startup, the app queries the project’s GitHub Releases page for a newer version. This request carries no personal data — it is a plain download of a version manifest. Mobile and desktop store editions receive updates through their distribution channel.
• License activation and validation: only when you enter a license key (and at most once every 30 days afterwards, to revalidate it), the app contacts the Lemon Squeezy license API. The request carries the license key and a generic device instance name — no note content, no usage data. Paid app-store editions do not use this license service.
• Sync with the provider you configured: GitHub OAuth device flow and git push/pull, Google OAuth and Drive API calls, or iCloud Drive replication by the OS — only when sync is configured.
• Community drawing libraries (optional): opening Browse libraries downloads catalogue metadata and preview images from libraries.excalidraw.com; choosing a library downloads its drawing shapes. The service receives the network request, including your IP address. Your notes and drawings are not uploaded. Catalogue and package requests omit credentials and referrer information; previews omit referrer information. Library searches run locally.

There is no analytics, no crash reporting service, no telemetry of any kind sent to the developers.

Reminders are local device notifications, off until you enable them in Settings. Folium asks for notification permission only when you enable reminders. Note content is hidden by default; you can explicitly enable notification previews, which may appear on your lock screen. These reminders do not send your notes to a push-notification server.

Third-party services

• GitHub (optional, user-initiated): authentication and vault hosting.
• Google Drive (optional, user-initiated): authentication and vault hosting.
• Apple iCloud (optional, user-initiated): vault replication, handled by the operating system.
• Excalidraw community library service (optional, user-initiated): public catalogue, preview images and drawing-shape downloads.
• Lemon Squeezy (only when activating or revalidating a license key): license verification.

As the merchant of record, Lemon Squeezy retains order, payment, and license-key data (the license key plus a device instance name, revalidated periodically by the app) under its own privacy policy and legal obligations. Deleting local app data does not delete these records — send deletion requests to Lemon Squeezy or support@folium.ink.

Data deletion

Uninstalling the app and deleting your vault folder removes all data. There is no server-side copy under our control — if you enabled sync, delete the remote copy yourself (the GitHub repository, the folium folder in iCloud Drive, or the app-data folder in Google Drive).

Contact

Questions about this policy or your data: support@folium.ink.

Changes

Changes to this policy will be noted in the project’s CHANGELOG.