Privacy
Fold is built so your tasks stay on your own devices. We don't have an account for you unless you choose Fold Pro, and even then we can't read your tasks.
Who we are
Fold is made by MMHMM Studio Ltd, a company registered in England and Wales (company number 17105722), whose registered office is at 14 Grey Towers Gardens, Wyke Lane, Nunthorpe, Middlesbrough TS7 0GF ("we", "us"). We're responsible for your personal data under the UK GDPR. Questions, or a request about your data: hello@foldtasks.com.
Using Fold without Pro
- Your tasks, streams and plans are kept in a database on your computer (in the browser version, in your browser's own storage). They aren't sent to us.
- Tokens and links for your apps (Notion, Jira, Linear and so on) are kept in your computer's secure store: the macOS Keychain, Windows Credential Manager, or encrypted storage in your browser. Never in a file or a log.
- Fold talks to your apps directly from your device, using the tokens you gave it. What those apps do with your data is covered by their own privacy policies.
- Connecting an app with one click (such as "Connect with Notion"): you sign in on that app's own page. For most apps, the last step of that sign-in (and renewing it later, for apps whose sign-ins expire) needs Fold's own app password, so it passes through sync.foldtasks.com, which adds it and hands the result straight back to your device. It stores and logs nothing. Microsoft sign-in in the desktop app comes straight back to your device.
- Google Calendar (if you sign in with Google): Fold only reads your calendars and events (read-only access), to show your meetings next to your tasks on your own devices. That data is kept on your devices, never sent to us, never shared or sold, and never used for advertising or to train AI models. Fold's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Your app connections between your devices (with Pro sync): sign-ins and calendar links travel sealed, inside the same encrypted sync as your tasks, so our server can't read them. Each device keeps them in its own secure store.
- The browser version can't reach most apps directly (Notion, Jira, GitLab, Linear, Asana, Todoist, Microsoft and calendar links don't allow it), so those requests pass through a relay on foldtasks.com. It only reaches those apps, streams each request through, and stores and logs nothing.
- Updates: the app checks GitHub for a newer version, which means GitHub sees your IP address. Nothing else is sent.
- Diagnostics only leave your computer if you copy a report and send it to someone yourself. Reports contain no task content and no tokens.
With Fold Pro
Sync needs an account, so with Pro we keep:
- Your email address, to sign you in (we email you a one-time code) and to match your purchase.
- Your devices' names and public keys, so only your devices can sync, and passkeys if you save one (their public part only).
- Your synced data, sealed. Your streams, plans, Fold tasks and, if you choose, your app connections, encrypted on your devices before they're sent. We hold them but can't read them: the key never leaves your devices (and your recovery key, if you keep one).
- Your plan: whether you have Pro or a founding licence, when it renews or ends, and the payment provider's customer reference.
We use this only to run sync and your plan. We don't sell it, share it for advertising, or use it to train anything.
Anonymous usage and error reports
To fix problems and see what's useful, Fold sends us a small anonymous summary once a day, and a report when something goes wrong. You can turn this off any time in Settings → General → Share anonymous usage.
- Sent: Fold's version, your platform and language, the week you first opened it, whether you finished the welcome, how many of each kind of app are connected (such as "Notion: 2"), how many streams you have, whether you have Pro, and how often features are used (counts). Error reports say where something went wrong, with the error message cleaned of anything personal.
- Never sent: your tasks or anything in them, the names of your workspaces, projects or streams, emails, tokens or links.
- Not tied to you: each install sends a random ID that changes every month. We keep these counts for 13 months.
Report a problem (in Help) sends what you write, your email if you add one, and, if you leave it ticked, a diagnostic report with no task content or tokens. We keep it in our private issue tracker until it's resolved.
Payments
Checkout is run by Stripe, which sells Fold Pro and founding licences to you as the merchant of record. Stripe collects your card and billing details and handles tax and receipts under its privacy policy. We never see your card number; Stripe tells us your email and what you bought.
AI assistants
If you connect an AI assistant (such as Claude or Cursor) in Settings, that app can read your tasks through Fold on your computer, and what it does with them is covered by its own terms. Fold doesn't send your tasks to any AI service itself.
Who helps us run Fold
- Cloudflare: hosts foldtasks.com, the browser version, the relay and the sync service.
- Stripe: payments, as merchant of record.
- Resend: sends sign-in codes by email.
- GitHub: hosts app downloads and update checks.
Some of them process data outside the UK, under the safeguards the law requires (such as the UK's international data transfer agreements). Cloudflare, GitHub, Stripe and Resend each cover this in their data processing terms, using the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
The website
foldtasks.com uses no cookies and shows no ads. We count visits with Cloudflare Web Analytics, which is cookieless: it tells us how many people visit, which pages they read, where they came from (such as a search engine) and their country and type of device, without identifying you or following you to other sites. Like any website, its host briefly handles your IP address to deliver the pages.
How long we keep things
- Sign-in codes expire after 10 minutes; web sign-in sessions after 30 days.
- Your account and sealed data are kept while you use Pro. Tell us to delete your account and we will, within 30 days; your devices keep their own copy.
- Stripe keeps payment records for as long as tax law requires.
Your rights
You can ask to see, correct, export or delete the personal data we hold, or object to how we use it. Email hello@foldtasks.com. If you're not happy with our answer, you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
If we change this policy in a way that matters, we'll say so on this page and, if you have Pro, by email before it takes effect.