Privacy, plainly.

Who we are

Foliofolio (“we”) is the data controller for your account data. Contact: privacy@foliofolio.dev. [Operator legal name and address to be added.]

What we collect from you

• GitHub account data when you sign in: your GitHub id, username, name, avatar and public email. We request only the read:user scope — never access to private repositories.
• Public GitHub data used to generate your portfolio: public repositories, their descriptions, languages, READMEs and recent public activity.
• Your CV, if you upload one. The PDF is read in memory, you review what we found, and only the details you confirm become part of your portfolio. The PDF itself is never stored, and phone numbers are never used.
• Portfolio content you create or edit, and up to 10 previous versions of it.
• Payment status. Payments are handled by Stripe; we never see or store your card details. We store your Stripe customer id and what you bought.

AI processing

Free portfolios are built without AI. When you use an AI feature (on Pro, or the free “see how AI would write this” preview), we send the relevant parts of your public GitHub data, the CV details you confirmed, any job description you paste, and your instructions to Anthropic’s Claude API. This data is used only to produce your content. We log token counts per request to manage costs and allowances.

Your visitors’ data (stats)

Portfolio stats are cookie-free and anonymous:

• No cookies, no local storage, no fingerprinting scripts, no third-party analytics.
• A visitor is counted using a one-way hash of their IP address, browser user agent and a salt that rotates every day. The raw IP address is never stored, and the same visitor can’t be recognised across days.
• We store the page, the referring website’s domain (not the full URL), the country, which project was clicked and time on page.
• Visitors with Do Not Track or Global Privacy Control enabled are not counted.

Legal bases

• Contract: to provide your account, generation, hosting and payments.
• Legitimate interest: anonymous, aggregate portfolio statistics; security and abuse prevention.
• Legal obligation: keeping payment records for tax purposes.

Processors

• Vercel (hosting and domains)
• Supabase (database, EU region)
• Stripe (payments)
• Anthropic (AI generation and editing)
• GitHub (sign-in and public data)

Where data leaves the EU, it is covered by the EU–US Data Privacy Framework or Standard Contractual Clauses.

Retention

We keep your account and portfolio until you delete them. Visit statistics are kept for up to 13 months. Payment records are kept as long as tax law requires.

Your rights

You can access, correct, export or delete your data, object to processing, and complain to your data protection authority. Download a copy of your data or delete your account at any time from Account in the dashboard. For anything else, email privacy@foliofolio.dev and we’ll respond within 30 days.