Privacy

Updated 11 Nov 2026

The short version

Identity: No name, phone number or ID. You log in with your foldoy address. Older store accounts log in with an email or account number until they pick an address.
Password: Your password never leaves your browser. The browser turns it into two values: one is sent to us to log you in, the other stays in the browser and locks your keys. We can't work one out from the other.
Tracking: No analytics, tracking or advertising scripts, and we never sell data.
Payments: Crypto goes straight to the store's own wallets. We never ask for wallet keys or seed phrases.
Mail: Mail between foldoy users is encrypted in the sender's browser, so only the people it is for can read it. With privacy+ on, mail from outside senders is locked with your key the moment it arrives. Our server always sees who mail is from and to, when, and its size. The details are under Mail below.
Where: Mail is hosted in Norway, under Norwegian law.

Your account

What: Your foldoy address; for older store accounts, your email or account number. A hash of the value your browser sends instead of your password, and the salt and settings the browser uses to make it. Your public keys, and your private keys, each locked in your browser with a key only your password produces, so we can't open them. Your recovery email, if you add one. The country Cloudflare reported when you signed up; there is no country field. Your two-factor secret, if you turned it on, encrypted. When the account was made and when you last logged in. Your invite code and who invited you. The address you reserved on our mail domains, if any. Your signed-in sessions: the browser and system, the country Cloudflare reported, and when each started and was last used, with no IP address. The browsers you have signed in from, kept only as a hash of a random cookie. Codes we email you, kept as a hash for 15 minutes.
Why: To log you in and protect the account, to refuse sign-ups from blocked countries, and to run the free bot server and invite rules.
How long: Until you delete the account. Deleting it removes your address, your email or account number, your password hash, your keys, your two-factor secret, your sessions and your aliases, and retires the address and aliases for good. The rest of the record stays, linked to your orders, deposits and swaps.

Balance and deposits

What: Every deposit, purchase, refund and invite credit on your balance. For each deposit: the coin, the amount in dollars and in coin, the exchange rate, the address it was paid to, the transaction that paid it, and the country Cloudflare reported when you opened it. If card payments are offered: Stripe's payment reference.
Why: To credit deposits, keep your balance right and refuse deposits from blocked countries.
How long: No fixed period. Balance entries are never changed or deleted, because together they make up your balance.

Orders and services

What: What you bought, its price, status and renewal dates, and the name you gave it. What it delivered, such as codes, credentials and proxy lists. Settings you enter, such as nameservers, mailbox names, aliases and a VPS's SSH public key. For game, bot and web servers, a login on our server panel under your account's email or number. Mailbox passwords go straight to the email host, and the store does not keep them.
Why: To deliver, renew and support what you bought, and to show it in your account.
How long: No fixed period. Records stay after a service ends.

Texts to rented numbers

What: The number, and every text it receives while it is yours: sender, text, code and time. Texts from banks, payment apps, crypto exchanges and government services are held back and never stored, and only their count is kept.
Why: To show the texts on the number's page.
How long: No fixed period. They stay on your orders page after the number is released.

Swaps

What: The trade ID, the coins and amounts, the exchange with its deposit address and order reference, your payout and refund addresses, the status and times, and your account if you were logged in. Kept with each swap order you create: your IP address, your browser's user agent and the language list your browser sends. Looking at prices or getting quotes creates no swap record.
Why: To show the swap's page and follow its status. The exchanges require their partners to keep the IP address, user agent and language list for every order, to investigate fraud and follow their own rules.
How long: The IP address, user agent and language list: one year from the order, then deleted automatically. The rest: no fixed period.
Swap page: Anyone with the link to a swap's page can open it and see its amounts and addresses.

Mail

Now: The mail servers are being set up. Until your mailbox opens, we keep your address, your keys as described above and your settings.
Between foldoy users: End to end. The sender's browser locks the message, its subject and its attachments with the keys of everyone it is for, and with the sender's own key for the Sent copy. Drafts are locked with your own key. We store only the locked message.
From senders who use PGP: End to end. We publish each address's public key so other mail apps can lock mail before they send it.
From everyone else: Ordinary mail reaches us readable. With privacy+ off, it is stored as it arrived. With privacy+ on, it is locked with your key the moment it arrives; before that moment it is readable to our server.
What we always see: Who a message is from and to, when it was sent or received, and its size. For mail locked on arrival, also its subject.
Mail you send outside: Mail to addresses outside foldoy, without a published key, leaves us readable, and the receiving provider can read it. The composer says which recipients get which before you send.
Your keys: Made in your browser at sign-up. We store the public keys and the locked private keys. A device stays unlocked until you log out: the unlocking key is kept in that browser's storage, never sent to us, and deleted when you log out.
Recovery email: Used only to reset your login password. It can't open your mail. A reset makes a new key, so mail from before opens only with your recovery kit, which you keep and we never see.
Contacts' keys: The first key your browser saw for each contact, so it can warn you when one changes. Stored locked with your own key.
Search: Our server searches only what it can read. Locked mail is searched in your browser.
Mail logs: The mail server logs the time, sender, recipient, size and delivery status of each message, and the address of the server that delivered it. The logs are deleted after 7 days. Your IP address is left out of the headers of mail you send.
Backups: Mailboxes are backed up. Locked mail stays locked in the backups.
Storage: 1 GB on Free, 15 GB on foldoy+, 50 GB on Polar.

Abuse reports

What: The reporter's email, the target, the description and the evidence link.
Why: To act on the report and reply to the reporter.
How long: No fixed period.

Connection data

Cloudflare: Cloudflare sits in front of the whole site, so it sees your IP address and every request you make, under its own privacy policy.
Request log: Our web server logs each request: the time, the page address without anything after a question mark (so no search words), the response, the referring page and your browser's user agent. Your IP address is not in it. Errors are logged in the same place, with the number of the order, service, deposit or swap involved. The log has a size limit and drops the oldest entries first. There is no fixed period.
Attempt counters: To slow down password guessing and spam, attempts are counted under a keyed one-way hash of your IP address. The counters expire within about an hour.
Country: The store reads the country Cloudflare reports for your connection, to refuse blocked countries and to choose swap exchanges. It is saved only at sign-up and with deposits.
Swap orders: Your IP address, user agent and language list are kept with each swap order for one year, as described under Swaps.

Cookies

session: Keeps you logged in. Set when you log in or sign up. It ends after 12 hours without use, 14 days after you log in, or when you log out.
csrftoken: Protects forms against forged submissions. Set on pages with a form, and lasts a year.
device: A random code that tells us this browser has signed in before, so a sign-in from a new browser can send you a warning. Lasts 400 days.
mode: Remembers that you turned on HTML only. Lasts a year.
ref: Remembers the code from an invite link until you sign up. Lasts 30 days.
Names: On foldoy.com each of these names starts with __Host-, which ties the cookie to this site only.
Browser storage: The webmail keeps the key that unlocks your mail on this device in the browser's own storage, until you log out. It is never sent to us.
Cloudflare: Can set its own cookies to protect the site from attacks.

There are no analytics, tracking or advertising cookies.

Who receives data

Cloudflare: All traffic to the site. Email to support@foldoy.com passes through its email routing. Domain names you search for can be checked with its public DNS.
Email: Mail to support@foldoy.com is delivered to our own mailbox on foldoy. Sign-up codes and account warnings are sent from noreply@foldoy.com through Resend, which sees the address and the message.
Swap exchanges: The exchange that runs your swap gets the coins, the amounts and your payout and refund addresses. When it asks, we give it the IP address, user agent and language list kept with its own orders. If a swap opens on the exchange's own website, that exchange collects what it needs under its own privacy policy.
Block explorers: Our server looks up each deposit address to see payments to it: Bitcoin on mempool.space and blockstream.info, and Litecoin on litecoinspace.org and BlockCypher. Payments on these networks are public.
Monero node: The store's view-only Monero wallet runs on our server and reads new blocks from a public Monero node, and a second node confirms a payment before it is credited. The nodes see our server asking for blocks and transactions. They never get the wallet's keys, so they cannot see who paid.
Suppliers: Only what they need. The domain registrar, Dynadot, gets the names you search for and register and the nameservers you set, and registers each domain in foldoy's name. The VPS host, Vultr, gets your SSH public key, server name, region and system. The email host gets your domain, mailbox names, passwords and aliases, and stores your mail. Phone-number, proxy and gift card suppliers get the product and, at most, a country and an order reference. Traffic you send through a proxy passes through its supplier's network.
Card payments: If card payments are offered, Stripe takes the payment and sees your name and card details.
Authorities: When the law requires us to share. Locked mail stays locked: we hold no key that opens it.

What we never ask for

Identity: No names, postal addresses or ID documents. An exchange can ask for ID under its own terms if its checks flag a swap.
Wallet keys: No wallet keys or seed phrases. The store's deposit wallets are watch-only on the server, and swapped coins go straight to the exchange.

Selling and tracking

We do not sell data or use it for advertising. The site runs no analytics, tracking or advertising scripts.

Your rights

Anyone can ask for a copy of the data we hold about them, or ask us to correct or delete it. Write to support@foldoy.com. We may ask you to show that the account or swap is yours.

You can change your email and delete your account yourself in Security settings.

Some records stay after a deletion: the balance entries behind every account, and the swap records the exchanges require us to keep.

In the EU or the UK, you can also complain to your data protection authority.

Changes and contact

The date at the top shows when this page last changed. Questions: support@foldoy.com.