Privacy Policy

• Account data. Email address and, if you set one, a password (stored hashed). If you use “Continue with Google”, we receive your name, email address and profile picture from Google to create and secure your account.
• Content you provide. Your profile, projects, experience, writing, links, resumes, cover letters, job preferences and settings — the same record that fills your portfolio, resumes and applications.
• Job activity. Saved roles, searches and applications you choose to prepare or track. We never submit an application without your approval.
• Messages. Notes visitors send through your portfolio’s contact form, and job-application emails you choose to forward to Foly for tracking.
• Analytics. If you connect your own Google Analytics property we read its reports for you (see §2). We also keep first-party visit counts for your portfolio so the dashboard works when no GA property is connected.
• Technical logs. Standard server logs (pages requested, timestamps, coarse device/browser info) for security, debugging and abuse prevention.

Foly uses two separate Google grants. Sign-in stays basic; Analytics access is only requested when you explicitly connect it, in context.

• Sign in with Google (scopes: openid, email, profile). Used only to authenticate you, verify your email address and link the Google account to your Foly account. We do not request offline access for sign-in and store no Google refresh token for it.
• Google Analytics connection (optional) (scopes: openid, email, https://www.googleapis.com/auth/analytics.readonly, https://www.googleapis.com/auth/analytics.edit). Requested only when you connect a GA4 property in Settings. Used only to list your Analytics accounts/properties, link the property you pick, and fetch its reports for your dashboard — i.e. we read your Google Analytics to show you your own reports. The refresh token is stored encrypted and used only for those tasks. Platform administrators may view those reports when you ask for support.
• Revoking. Disconnect any time in Dashboard → Settings → Analytics, and also at myaccount.google.com/permissions. Disconnecting deletes the stored refresh token on our side; already-pulled report aggregates remain part of your dashboard history until you delete your account.
• What we do not touch. Foly does not request Gmail scopes and does not read, send or delete your Gmail. Application emails are tracked only when you forward them to your Foly address.

Google user data is used only for the feature you granted it for, never sold, and shared only with the service providers needed to run Foly (hosting, database, email delivery). AI features send only the text needed for the task you asked for (e.g. drafting a cover letter from a posting).

• Platform pages use Foly’s own property. The landing page, public tools and dashboard report to Foly’s own Google Analytics 4 property so we can run and improve the service.
• Member portfolios use their own property. A portfolio sends visits only to the property its owner connected — never to Foly’s property. A signed-in owner’s own visits to their portfolio are not counted (opening the site with ?analytics_debug=1 shows them in GA DebugView instead).
• Consent. Advertising storage is always denied — nothing here is for ads. In the EEA, the UK and Switzerland, analytics storage starts denied (Google receives cookieless pings and sets no cookie) and a banner asks you to Allow or decline. Elsewhere analytics storage defaults to granted. Your answer is stored in an analytics_consent cookie (one year, per site — the platform and each portfolio ask separately) and applied before the first hit.

• Provide, secure and improve Foly: accounts, portfolios, jobs board, resumes and career tools.
• Publish only what you publish: drafts stay private to you until you publish them.
• Send service messages (sign-in links, receipts, security notices). No marketing email without consent.
• Prevent abuse, debug errors and measure aggregate performance.

We do not sell personal data. We share the minimum necessary with subprocessors that run Foly (hosting, managed database, email delivery) and, when you use them, with Google Analytics (your own property) and AI model providers (only the text of the task you run). Job listings credit their sources (company career pages and boards such as Remotive, Arbeitnow and Remote OK); applying happens on the employer’s site under their policy.

We keep account and content data while your account is active and for a short backup window after deletion. Delete your workspace any time from Dashboard → Settings, or write to support@foly.in from your account email with “Delete my data” and we will delete your account data and confirm. Published portfolios stop being served immediately; search engines and caches may take time to drop copies. We may retain narrow security logs as required by law.

Ask us for access, correction, export or deletion of your personal data at support@foly.in. Where the GDPR or India’s DPDP Act applies, you have the rights those laws grant, including withdrawing consent for optional processing such as the Analytics connection.

Traffic is served over HTTPS, passwords are hashed, OAuth tokens are stored encrypted, and access is scoped per workspace. No method is perfectly secure; use a unique password and keep your Google account’s 2-step verification on.

Foly is not for children under 13 (or the minimum age in your country). We do not knowingly collect their data.

When this policy changes materially we will note the new date above and, for significant changes, notify signed-in users by email or in the dashboard before it takes effect.

Foly · https://foly.in · privacy and data requests: support@foly.in.