What Fold keeps, and where.

Fold is designed to minimize what a service operator can learn. This notice describes the shipped default service at fold.bruket.co; a self-hosted relay has its own operator and policy.

On your devices

Fold stores account keys, device keys, contacts, conversations, message bodies, attachments, drafts, settings, receipts, and on-device memory in an encrypted application store. Your device and filesystem can still expose access patterns, backups, crash data, or plaintext while Fold is unlocked. Fold does not send message contents to an analytics service.

On the relay

The relay stores opaque mailbox capabilities, sealed envelopes, encrypted bundles and recovery vaults, public handle cards, signed Pages and posts, public images, key-transparency entries, and short-lived call-routing state. Private-message bodies, contact names, and conversation identifiers are not fields in the relay envelope table.

The service and its infrastructure providers can observe IP addresses, request time, route category, byte size, response status, and opaque capability identifiers. Those facts can reveal communication timing even when content stays sealed. Application logging is designed to use route templates rather than capability-bearing URLs.

Public material

A handle, Page, public post, public comment, link, and public image are deliberately public once published. They can be copied by other people and caches. Withdrawing authorization or deleting at the current relay cannot recall copies held elsewhere.

Optional discovery

If you bind an email address or phone number, Supabase Auth and the configured delivery provider process that identifier and a short-lived verification code. The binding service stores a keyed digest used for discovery and the Fold account key it maps to; it is not a Fold login or recovery credential. Requests are rate-limited and replay-protected. A validated delivery job may retain the address and one-time code in Cloudflare Durable Object storage for up to one hour while it makes at most five bounded delivery attempts, then deletes it.

Recovery and linking

Encrypted recovery vaults and device-link staging bundles are stored under high-entropy capabilities. A capability holder may fetch the encrypted bytes; cryptographic keys remain necessary to open them. Abandoned staging resources expire. Fold cannot recover an account without the recovery material you chose.

Retention and deletion

Sealed message envelopes and epoch claims expire under the relay policy shown inside Fold. Acknowledged envelopes are removed. Public content and encrypted vaults remain until their authorized deletion path is used. “Delete everywhere” asks the configured providers to delete what the account controls and then reports any failure; it cannot delete recipient copies, screenshots, exports, or external backups.

Infrastructure and transfers

The default relay and download service use Cloudflare infrastructure; optional identity binding uses Supabase Auth and configured email or SMS providers. Their processing locations can differ from yours. Fold does not sell personal data, run advertising, or include a third-party tracking SDK.

Your choices

You can use Fold without a phone number or email, choose a storage posture, disable optional discovery, self-host a compatible relay, export recovery material, inspect a custody receipt, withdraw public material, or delete an account through the app. Diagnostic export previews exactly what will be included.

Questions

Use Fold support for a privacy question and the private security route for a vulnerability. Material changes to this notice will appear in the changelog before a new release relies on them.