Who is responsible
GoodFolder is operated by Carlos Marcial in Portugal. For the hosted service at trygoodfolder.com, Carlos Marcial is the data controller. Email [email protected] for privacy questions or requests.
If you run the open-source version yourself, the person or organisation running that installation controls its data. This policy does not describe their practices.
Data we handle
- Account data: your email address, sign-in records, approved computers, invited collaborators, and revocable service credentials.
- Folder data: folder and file names, file contents, saved versions, change summaries, comments, proposals, and the people or agents connected to that history.
- Billing data: your plan, storage use, subscription state, and Stripe customer or subscription identifiers. Stripe handles payment-card details; GoodFolder does not store them.
- Support and service data: messages you send us, security and activity records, delivery status for account emails, and enough technical information to diagnose a failed request.
- Limited product analytics: page views and named actions such as opening a timeline or starting checkout, with counts and broad context. Analytics events exclude file names and file contents. We disable automatic click capture, session recording, heatmaps, surveys, and persistent browser storage.
Why we use this data
We use personal data for four purposes:
- To provide the service you asked for: sign you in, store and sync folders, show their history, restore saved versions, manage collaborators, and answer support requests. The legal basis is performance of our contract with you.
- To bill for hosted plans, keep accounting records, and meet tax or other legal duties. The legal bases are performance of our contract and compliance with legal obligations.
- To secure GoodFolder, investigate abuse, keep an activity record, and learn whether core product actions work. The legal basis is our legitimate interest in running a safe and reliable service.
- To send product or marketing messages when you have asked for them. The legal basis is consent, which you can withdraw.
GoodFolder does not sell personal data. We do not use folder contents for advertising.
AI-written Save labels
When you make a Save without supplying a label, the hosted service may send OpenRouter a change summary and a capped text excerpt so a language model can write a short label. File names or text from a changed file may appear in that excerpt; media contributes names rather than its bytes. A failed model request falls back to a local summary and never blocks the Save. OpenRouter may route the request to the configured model provider, so its provider terms also apply to that request.
Who receives data
We share only what each provider needs for its job:
- Stripe processes checkout, subscriptions, invoices, and payments.
- Resend delivers one-time sign-in links and service emails.
- PostHog receives the limited product analytics described above through its EU service.
- OpenRouter and the selected model provider process the small change excerpt used for an AI-written label.
- Infrastructure and object-storage providers host the service, database, folder history, and large files.
A service or assistant you approve, including a Muse connector, receives only the folders and actions allowed by the scopes you select. Its own privacy terms govern what it does after receiving that data. We may also disclose information when law requires it or when necessary to protect people, the service, or legal rights.
International transfers
Some providers operate outside the European Economic Area. When personal data crosses borders, we rely on an adequacy decision or contractual safeguards recognised by EU law, as applicable. Contact us if you want information about the safeguard used for a particular provider.
How long we keep it
- Account and folder data stays while your hosted account is active, unless you delete a folder or ask us to erase eligible data sooner.
- After hosted access ends, protected folder data remains available in read-and-export mode for 30 days, then enters scheduled deletion.
- Unaccepted uploaded proposal files expire after seven days.
- Billing, fraud-prevention, security, and audit records remain as long as reasonably needed for legal duties, disputes, and service safety.
Deleting a folder permanently removes its stored content and history from the live service. We may keep the minimum record needed to prove that the deletion occurred.
Security
GoodFolder uses one-time email sign-in, short-lived or revocable credentials, encrypted network connections, scoped service access, and activity records. The internal file-transport service has no public port and does not receive an end-user credential. No internet service can promise perfect security, so keep the backup you already trust.
Your rights
Depending on where you live, you may ask to access, correct, export, restrict, object to, or erase personal data. You may also withdraw consent where consent is the legal basis. Email [email protected]; we may need to confirm that the account is yours before acting.
People in the EEA can complain to their local supervisory authority. In Portugal, that is the Comissão Nacional de Proteção de Dados (CNPD).
Children
The hosted service is not directed to children. If you believe a child supplied personal data without the permission required by local law, contact us so we can investigate and remove it where appropriate.
Changes to this policy
We will update the date at the top when this policy changes. If a change materially affects how we use account or folder data, we will give account holders reasonable notice through the service or by email.