Privacy Policy
1. Who we are
FOLKO (“the app”, “we”, “us”) is provided by UAB Wantly, company code 307039973, V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania (the “controller” of the personal data described in this policy).
Contact for privacy questions: hello@folko.app
2. The short version
- FOLKO has no accounts and no login. We do not know who you are.
- Your contacts, notes, transcripts, actions and settings are stored in a database on your phone. We do not have a copy of that database on any server.
-
Three things leave your phone, each only when you use the feature that needs it:
- A voice note (the audio), so it can be transcribed and turned into structured notes;
- A voice question (the audio), so it can be transcribed;
- A search question together with the names and facts of your FOLKO contacts, so the question can be answered.
- These go through our server to two AI service providers: OpenAI (speech recognition) and Anthropic (extracting facts and answering questions). Our server does not store the audio, the transcripts or your contacts.
- Audio is deleted from your phone once a note is saved, and a voice question’s audio is deleted as soon as it has been transcribed.
- We use no advertising, no analytics and no crash-reporting services, and we do not track you across apps or websites.
3. What we process, why, and on what legal basis
3.1 Data stored on your device
The following is created by you and stored in the app’s local database (SQLite) and files on your device. We (the controller) do not receive it, except for the parts described in 3.2 at the moment you use a feature:
- people you add: name, role, company, city, where and when you met, phone, email, LinkedIn and other social links, website, tags, notes (“about”);
- notes generated from your voice notes: full transcript, summary, facts, people mentioned in the conversation (“mentions”), commitments, actions and their due dates, connections between people;
- your recent search questions (shown as “Recent searches”);
- your own business card (the details you choose to enter);
- app settings, and a random identifier generated by the app (see 3.2(d));
- the audio of a voice note while it is waiting to be processed or reviewed. After the note is saved, or when you discard it, the audio file is deleted.
Because this data never reaches us, we cannot view, correct, export or delete it for you — you do that in the app (see section 8).
Device backups: On Android, FOLKO opts out of Android’s automatic cloud backup, so this data is not copied to Google Drive by the system. On iOS, the app does not currently exclude its files from iCloud / device backups, so if you have iCloud Backup turned on, Apple includes FOLKO’s local database in that backup under your Apple account.
3.2 Data that leaves your device
Nothing in this section happens until you agree to it. The first time you record a note or ask a question, the app explains what is sent and asks once whether you agree. If you choose “Not now”, nothing is sent, and the app asks again the next time you record or search.
(a) Voice notes — transcription and extraction
When you record a note about someone, the app sends to our server:
- the audio recording (up to 3 minutes);
- the recording language you selected (or none, for automatic detection);
- a list of up to 120 names already in your FOLKO database — names of your contacts, their companies, and names of people mentioned in earlier notes. This list helps the speech recogniser and the AI spell names correctly.
- the random app identifier (see (d)).
Our server forwards the audio, the language and the name list to OpenAI for speech-to-text. It then sends the resulting transcript and the same name list to Anthropic, whose model returns structured notes (name, role, company, city, facts, mentions, commitments, tags). The transcript and structured notes are returned to your phone and stored there.
- Purpose: to provide the voice-note feature you asked for.
- Legal basis: performance of a contract with you (GDPR Art. 6(1)(b)) — the feature cannot work otherwise.
(b) Voice questions — transcription only
When you ask a question by voice, the audio (up to 30 seconds), the language setting and the random app identifier are sent to our server and on to OpenAI for transcription only. The name list is not sent. The audio is deleted from your phone right after transcription.
- Purpose / legal basis: as in (a).
(c) Search questions
When you ask a question (typed, or after a voice question is transcribed), the app sends to our server:
- your question (up to 500 characters);
- for every person in your FOLKO database: an internal ID, name, role, company, city, all facts, tags, and how many days since you last spoke;
- for every person mentioned in your notes: an internal ID, name (if known), profession, company, city, relationship to your contact, a short note, and the name of the contact who mentioned them;
- the random app identifier.
Our server sends the question and this information (at most 400 people and 1,200 mentions) to Anthropic, whose model returns an answer and the IDs of the relevant people. Our server checks the IDs and returns the answer to your phone. Nothing is stored on our server.
- Purpose: to answer the question you asked.
- Legal basis: Art. 6(1)(b).
(d) The random app identifier and technical data
On first use, the app generates a random identifier and stores it on the phone. It is not your phone’s hardware or advertising ID and is not linked to your name, email or phone number. It is sent with each request in (a)–(c) so the server can limit how many requests one installation makes, to protect the service from abuse and from runaway costs.
As with any internet request, our hosting provider receives your device’s IP address and technical request data (time, size, response code).
- Purpose: security, abuse prevention and keeping the service available.
- Legal basis: our legitimate interest (Art. 6(1)(f)) in protecting the service.
- Retention: request counts are kept in the server’s memory only and disappear when the server instance stops. Hosting-provider request logs: see section 6.
(e) What we do not collect
No account data, no email or phone number of yours, no location, no contacts from your phone’s address book (except the one contact you pick, which stays on the phone), no camera images, no advertising identifiers, no analytics, no crash reports.
3.3 Permissions the app asks for
All permissions are requested only when you tap the feature that needs them, and the app keeps working (with that feature unavailable) if you refuse.
| Permission | When | What happens with the data |
|---|---|---|
| Microphone | You tap record, or the microphone in Search | Audio is processed as in 3.2(a)/(b). |
| Camera | You tap “Scan” | The camera image is analysed on the phone to read a QR code. Frames are not stored or sent. |
| Contacts (read and write) | You tap “From contacts”, “Link an existing contact” or “Save to phonebook” | The phonebook is shown so you can pick one person; only that person’s details are saved in FOLKO. FOLKO does not copy or upload your address book. Saving to the phonebook writes to your phone’s contacts, which your phone may sync to your Google or Apple account — that sync is outside FOLKO’s control. |
| Notifications | You set a due date on an action | Reminders are scheduled by your phone locally. No push service is used and nothing is sent to us. |
3.4 Sharing your card and other things you choose to share
-
Your QR card contains only the details you entered, in the mode you choose
(“Public only” or “All contacts”). Anyone who can see or photograph the code can read it. When
the card link
https://folko.app/c#…is opened, the card details are in the part of the link after#, which browsers do not send to the web server. - When you share your card, an error report, or a backup file, you choose the recipient or location through your phone’s share sheet or file picker. We do not receive that data unless you send it to us.
-
To check whether the card web page is online, the app occasionally requests
https://folko.app/cwithout any card data.
4. Information about other people
Most of what FOLKO stores is about other people: those you meet, and those they mention to you. When you record or type it, you decide what is stored, and it stays on your phone; it reaches us and our providers only as described in 3.2(a) and (c).
Your role. If you use FOLKO for your own personal life, keeping notes about people you know is a purely personal activity, and data protection law (GDPR Art. 2(2)(c)) does not apply to it — the same as a paper address book or your phone’s contacts. If you use FOLKO for work (for example, to keep track of business contacts), you decide what is recorded and why, so you are responsible for that information — the same as with any CRM. Keeping in touch with professional contacts is usually a legitimate interest (Art. 6(1)(f)).
Our role. FOLKO is a tool. We do not keep the information you record about other people: it is stored on your phone, and when it passes through our server for transcription or search, the server forwards it to our providers and keeps nothing (sections 3.2 and 6). For that processing we act on your instructions, as a processor (Art. 28).
People you mention. Because we hold no data about the people you mention, we cannot look them up or delete them for them. If someone asks you to remove what you saved about them, delete their profile in the app.
We ask you to record only what you would be comfortable repeating to the person concerned, and to delete a person’s data when they ask you to (Edit profile → Delete contact).
5. Sensitive information
FOLKO is not designed to process special categories of personal data (health, political opinions, religion, sexual orientation, etc.). Please do not record such information about yourself or others. If a voice note contains it anyway, it will be processed as in 3.2(a) like any other content.
6. Service providers (processors) and international transfers
We use these providers to run the features described above. They act on our instructions under data processing terms.
| Provider | Role | Data | Location / transfer safeguard | Retention by provider |
|---|---|---|---|---|
| Supabase, Inc. | Hosts our server functions (the “proxy”) | All data in 3.2, in transit; IP address and request metadata in logs | Supabase Inc. is US-based. | Our functions write nothing to storage or a database. |
| OpenAI | Speech-to-text | Audio, language, name list | USA | API data is not used for training by default; may be retained up to 30 days for abuse monitoring. |
| Anthropic | Fact extraction and answering questions | Transcript, name list, search question and contact/mention data | USA | API data is not used for training by default; retained up to 30 days. |
| Website host for folko.app | Serves the card web page | IP address of whoever opens a card link (no card data) | — | — |
Apple and Google distribute the app and process data about your download and purchase under their own privacy policies; they are not our processors.
7. How long data is kept
| Data | Where | How long |
|---|---|---|
| Contacts, notes, transcripts, actions, search history | Your phone | Until you delete them, delete everything (Settings → Delete everything), or uninstall the app. |
| Your own card and app settings | Your phone | Until you change them or uninstall the app. |
| Audio of a voice note | Your phone | Until the note is saved or discarded; then deleted. Older audio from previous app versions is deleted on the next app start. |
| Audio of a voice question | Your phone | Deleted right after transcription. |
| Anything sent in 3.2(a)–(c) | Our server | Not stored; exists only in memory while the request is processed (seconds). |
| Same, at OpenAI / Anthropic | Provider | See section 6. |
| Random app identifier | Your phone; our server’s memory | On the phone until you uninstall the app. On the server, see 3.2(d). |
| Backup files | Wherever you saved them | Under your control. Backup files are not encrypted — anyone with the file can read it. |
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and object to processing of your personal data, and to data portability.
Because FOLKO has no accounts and we do not keep your data on our servers, we have no stored data that we could link to you, and most rights are exercised directly in the app:
- Access and portability: Settings → Create a backup writes all your data to one file (JSON inside a ZIP).
- Rectification: edit any contact, fact or note in the app.
- Erasure: delete a contact (Edit profile → Delete contact), a fact, an action, or everything at once (Settings → Delete everything). A single deleted contact, fact or action disappears from the app, search and backups and is never sent to our server again; its record is fully erased from the phone when you use Delete everything or uninstall the app.
- Objection / withdrawal: stop using the voice and search features; nothing is sent unless you use them.
For anything else, or to ask what the providers in section 6 may still hold, contact us at hello@folko.app. We will answer within one month (Art. 12(3)).
9. Children
FOLKO is not intended for children under 16. We do not knowingly process children’s data.
10. Security
Data is sent to our server and providers over encrypted connections (HTTPS). API keys for the AI providers are held on the server, not in the app. Data on your phone is protected by your phone’s own security (screen lock, device encryption); FOLKO does not add its own encryption or app lock today. Backup files are not encrypted.
11. Complaints
You can complain to a supervisory authority — in Lithuania, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or the authority in your country of residence or work.
12. Changes to this policy
If we change how data is processed (for example, if accounts, cloud sync or payments are added), we will update this policy and the “Last updated” date, and tell you in the app before the change takes effect.