Security
Private by default. Plain about the rest.
What protects your account and notes today, stated plainly.
Your account
A verified email, passkeys, and an optional second step.
- Email verified before you can open Folevi
- Passwords found in known data breaches are refused
- Passkeys: sign in with your fingerprint, face or screen lock
- Two-step codes from an authenticator app (TOTP)
- One-time recovery codes, for a lost phone
6-digit code
481927
Encryption
Encrypted on the way to us, and where it’s stored.
- TLS on every connection, with HSTS
- Encrypted at rest by our hosting providers
Not end-to-end encrypted
Our servers process your notes, so search, sharing and sync work.
- For notes no provider may ever read, use an end-to-end encrypted tool
Who can see your notes
You, and the people you share with.
- Admin tools have no content viewer
- Sync logs never hold your text, titles or files
Export and deletion
Your writing is never locked in.
- Any page as Markdown, HTML or PDF
- Your Personal, or a workspace you own or admin, as a ZIP
- Account deletion waits 7 days, then it’s permanent
This website
No third-party scripts, trackers, ad pixels or remote fonts.
- A strict Content Security Policy allows only our own code
- Pages can’t be embedded in other sites
Reporting a vulnerability
Email security@folevi.com with what you found and how to reproduce it.
- Test only accounts and workspaces you own or may test
- Leave other people’s data alone, and don’t load-test or spam
- Give us a fair chance to fix it before going public
Subprocessors
These companies process data on our behalf to run Folevi.
| Provider | Purpose | What it processes |
|---|---|---|
| Convex | Database and backend | Your account record, workspaces, pages, blocks, tasks, uploaded files and the sync operations that keep your devices up to date. |
| Vercel | Web hosting | Serves folevi.com and the web app. Processes requests to our servers, including IP addresses and standard request logs. |
| Resend | Email (sending and the support inbox) | Your email address and the content of the emails we send you, such as verification, security notices and share invitations, and the emails you send to support@folevi.com. Open and click tracking is turned off. |
| Google (Gemini API) | Foli AI (AI assistant) | Only when you use Foli AI: your request and the notes it needs to answer (the open note, or notes found by search that you can already read). Never sent while Foli AI is off. |
| Polar | Payments (merchant of record) | For paid plans and AI credit packs: your email address, billing details, the plan or pack, and internal account ids that link a payment to your account or workspace. Never the content of your notes. Card numbers go straight to Polar; Folevi never sees or stores them. |