Privacy Policy

1. Who is responsible for your data

The data controller for FolderPls (folderpls.com) is Zeynep Aslı Erhan, an individual developer based in Türkiye. You can reach us about anything in this policy at zeynepaslierhan@gmail.com.

2. Data we process

2.1 Your account

When you sign in with Google we receive, through Firebase Authentication: your Google account ID, e-mail address, display name and profile photo URL. Google's sign-in response tells us whether the account belongs to a Google Workspace organization (its "hosted domain" value); we use that only to show the right plan. If the sign-in response does not tell us, we go by the e-mail domain instead: gmail.com and googlemail.com addresses count as personal accounts, other domains as Workspace. We record when your account was created and when you last signed in.

When you create your account we also record, once, how you arrived: the campaign name from the link you clicked, only if it is on a fixed list of channel names (for example reddit; anything else is stored as "other", and no link as "none"), and your country as a two-letter code looked up from the request's IP address. The IP address itself is not stored. This stays on your account record so we can tell which channels bring sign-ups; it is part of your data export and is deleted with your account.

2.2 Google Drive data

FolderPls requests only the drive.file scope. With it, FolderPls can only see files and folders that you explicitly select in the Google Picker or that you create or upload through FolderPls — not the rest of your Drive.

• Stored by us, for files you label or annotate: the Drive file/folder ID, file name, item type, MIME type and parent-folder ID, plus the labels, label expiry dates, custom properties, notes and file relations you add.
• Shown but not stored: file lists, thumbnails, previews and file contents are loaded by your browser directly from Google Drive using a short-lived access token. They do not pass through or get stored on FolderPls servers.
• Changes in Drive happen only when you ask: if you rename, move, upload, create folders or delete through FolderPls, the change is sent from your browser to Google Drive on your behalf.

2.3 Google access tokens

• A short-lived Google access token (about one hour) is kept in your browser's sessionStorage for the current tab and is cleared when you sign out.
• If long-lived Drive access is enabled, Google gives us a refresh token. It is stored server-side in a database location that no browser — including your own — can read, is used only to obtain new access tokens for you, and is revoked at Google when you disconnect Drive or delete your account.
• We also store a one-way SHA-256 hash of the latest access token and its timestamp, not the token itself.

2.4 Product usage and support

• Product events we record against your account: Drive folder connected (with the number of files), first label applied, auto-tag completed, collection saved, returned after 7 days, upgrade viewed/completed. They are stored in our own database; we do not use third-party analytics or advertising trackers.
• A monthly counter of how many files were auto-tagged, to enforce plan limits.
• Feedback messages you send us from the app.

2.5 Payments

If you buy a paid plan, checkout and billing are handled by Lemon Squeezy, our merchant of record. Lemon Squeezy creates a customer record with your e-mail address; we store the Lemon Squeezy customer and subscription IDs, your plan, seat count (Team) and plan status. Card details are entered on Lemon Squeezy's pages and never reach FolderPls. If you start a free trial, no card is required — we only record the trial's start and end dates.

2.6 Technical logs

Our hosting provider records standard request logs (such as IP address, user agent, requested URL and time) to operate and secure the service. Our application logs redact tokens and personal identifiers.

When the app or one of our servers hits an error, a masked technical error report is also sent to our error-monitoring provider, Sentry (section 5). It does not include your account ID or e-mail address.

2.7 Page-load counts on our public pages

We count how often our public pages are loaded, including when the sign-up or sign-in page is opened from another of our pages. Per day we add one to a total for the referring site or campaign name (for example reddit), the visitor's country, a device type (desktop, mobile or in-app browser) and a page group. We use no cookies or other identifiers for this, we do not store IP addresses or user agents, and we cannot tell which loads come from the same person. The country is looked up from the IP address by our hosting provider and is not kept by us. These are anonymous totals, not personal data. If you don't want your visits counted, turn on Global Privacy Control or Do Not Track in your browser: our pages then send nothing.

3. Why we process it (purposes and legal bases)

• To provide FolderPls — sign-in, labelling, search and filters, Drive actions you request, automatic tag suggestions you request (performance of our contract with you; KVKK art. 5(2)(c), GDPR art. 6(1)(b)).
• To bill paid plans and enforce plan limits (contract; legal obligations for invoicing records — KVKK art. 5(2)(ç), GDPR art. 6(1)(c)).
• To keep the service secure, prevent abuse and fix errors (legitimate interest — KVKK art. 5(2)(f), GDPR art. 6(1)(f)).
• To understand which features are used and which channels bring visitors so we can improve them, using the first-party product events and the anonymous page-load counts listed above (legitimate interest).

We do not sell personal data, and we do not use it for advertising or profiling.

4. Google API Services: Limited Use

FolderPls's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

In particular:

• We use Google user data only to provide and improve the user-facing features of FolderPls that you use.
• We do not transfer Google user data to others except as necessary to provide those features (for example, the service providers in section 5), to comply with applicable law, or as part of a merger or acquisition with your prior consent.
• We do not use or transfer Google user data for advertising, including retargeting or personalised or interest-based ads, and we do not sell it.
• Humans at FolderPls do not read your Google user data unless you give us explicit permission for specific items (for example, in a support request), it is necessary for security purposes such as investigating abuse, it is required by law, or the data is aggregated and anonymised for internal operations.
• We do not use Google Workspace API data (including Google Drive data) to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models.

5. Service providers and international transfers

We use the following providers to run FolderPls. Each processes data only on our instructions and for the purpose listed:

• Google (Firebase Authentication, Cloud Firestore, Google Drive API, Google Picker) — sign-in and database. The Firestore database is located in the European Union (multi-region eur3).
• Vercel Inc. — website hosting and server functions (functions run in Frankfurt, EU; the company is based in the USA).
• Lemon Squeezy — payments (merchant of record), only if you purchase a paid plan.
• Sentry (Functional Software, Inc., USA; reports are stored in Sentry's EU region, Frankfurt) — error monitoring. When something breaks in the app or on our servers, a technical report is sent: the error message and stack trace, the page path without query strings or fragments, browser and device type, language setting, and recent click and navigation events. Before sending we remove cookies, request bodies, access tokens, e-mail addresses and the file names that appear in click traces, and we do not attach your account ID. Sentry's servers see your IP address when a report arrives; we turned off storing it, but Sentry may still derive an approximate country and city from it.
• Anthropic PBC — label suggestions generated by a language model, only when you start auto-tagging and only if that feature is enabled. We send the names, file types and parent-folder names of the files you asked to tag — never file contents. Anthropic's commercial API terms do not allow this data to be used to train its models.

Some of these providers are established outside Türkiye and the European Economic Area, mainly in the USA. Where personal data is transferred abroad, we rely on the safeguards offered by these providers (such as standard contractual clauses) in line with KVKK article 9 and GDPR chapter V.

6. How long we keep data

• Account data, labels, notes, properties, product events and feedback: until you delete your account.
• Drive refresh token: until you disconnect Drive, delete your account, or revoke FolderPls in your Google account.
• Billing records held by Lemon Squeezy: as long as required by tax and accounting law.
• Hosting request logs: kept by our hosting provider for a limited period according to its retention settings.
• Error reports in Sentry: kept for a limited period according to Sentry's retention settings.

7. Export, disconnect and delete — in the app

Open the dashboard, then the settings (gear) icon in the sidebar:

• Export my data — downloads your profile and all file metadata as JSON (tokens and payment IDs excluded).
• Disconnect Google Drive — revokes our Drive access at Google and deletes our copy of the token; your labels stay.
• Delete account — revokes Drive access, cancels your active Lemon Squeezy subscription (if any) so you are not billed again, and permanently deletes your account, labels, notes, product events and feedback. Files in your Google Drive are never touched.

You can also remove FolderPls's access at any time from your Google account: https://myaccount.google.com/permissions

8. Your rights (KVKK and GDPR)

Under article 11 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the EU General Data Protection Regulation (GDPR), you have the right to: learn whether we process your data and request information about it; access and receive a copy; have inaccurate data corrected; have data deleted; restrict or object to processing, including processing based on legitimate interest; data portability; learn the third parties it is transferred to; object to outcomes based solely on automated processing; and claim compensation for unlawful processing.

Most of these you can exercise directly in the app (section 7). For anything else, e-mail zeynepaslierhan@gmail.com; we respond within 30 days. You may also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, to your local data protection authority.

9. Cookies and browser storage

FolderPls does not use advertising or cross-site tracking cookies. We use only storage that is strictly necessary for the service: Firebase Authentication keeps your sign-in session in the browser (IndexedDB), the current Drive access token is kept in sessionStorage, and your language, theme and onboarding choices are kept in localStorage. Because this storage is strictly necessary, no cookie consent banner is shown.

10. Security

• All traffic is encrypted with HTTPS (HSTS); data is encrypted at rest by Google Cloud.
• Database security rules restrict every user to their own data; billing fields and Drive refresh tokens can only be written or read by our server.
• Every API request is authenticated with a verified Firebase ID token.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the competent authorities as required by law.

11. Children

FolderPls is not directed at children. You must be at least 16 years old (or the age of digital consent in your country, if higher) to use it. If you believe a child has given us personal data, contact zeynepaslierhan@gmail.com and we will delete it.

12. Information for US residents (California and other states)

FolderPls is run by an individual developer in Türkiye and is not aimed at a particular US state. This section is a voluntary notice: it describes what we collect and what you can do in the terms US privacy laws such as the California Consumer Privacy Act (CCPA) use. It does not change the rest of this policy.

• What we collect: identifiers (Google account ID, name, e-mail address, profile photo URL); commercial information (plan, subscription and trial status — card details are entered on Lemon Squeezy's pages and never reach us); internet and app activity (product events, request logs, error reports, anonymous page-load counts); your country as a two-letter code, recorded once at sign-up; and the content you add (labels, notes, file names and Drive file IDs). Details are in section 2.
• Where it comes from: you, Google when you sign in, and Lemon Squeezy if you buy a paid plan.
• Why and who receives it: only to run FolderPls (section 3). It is shared only with the service providers listed in section 5, which act on our instructions.
• We do not sell personal information, and we do not share it for cross-context behavioral advertising. FolderPls has no advertising or cross-site trackers.
• How long we keep it: see section 6.

Your choices: you can ask what we hold about you, get a copy, have it corrected, and have it deleted. Export and delete work directly in the app (section 7); for anything else e-mail zeynepaslierhan@gmail.com and we respond within 30 days. We may ask you to confirm that the request comes from the e-mail address of the account. We will not treat you differently for using these rights.

13. Changes to this policy

If we change how we process data, we will update this page and the date at the top. For material changes — for example a new category of data or a new service provider — we will notify you in the app or by e-mail before the change takes effect.

14. Contact

Questions or requests about privacy: zeynepaslierhan@gmail.com