Privacy Policy
Last updated: October 12, 2026
This Privacy Policy explains how Oleg Burlaca, a sole proprietor operating under the brand FolderFeed (“FolderFeed”, “we”, “us”), collects, uses, and protects personal data when you use FolderFeed at https://www.folderfeed.com (the “Service”).
For privacy questions or requests, contact: [email protected]
1. Summary
- FolderFeed shows activity from your Google Drive folders as a feed. It only reads your Google data; it never modifies or deletes your Drive files.
- The Google data used to build your feed (file metadata, activity, comments, people) is fetched directly by your browser from Google and cached in your browser (IndexedDB). We do not copy your Drive content into our own servers or database.
- We do not receive a long-term Google credential (refresh token). Access to your Drive exists only while you are signed in and using the app, and ends when your session ends.
- We store a small amount of account and billing data in the cloud (see section 3).
- Payments are handled by Paddle, our Merchant of Record. We never see or store your card details.
- Analytics and error monitoring are off until you enable them.
- We do not sell your personal data or use Google user data for advertising.
2. Who is responsible for your data
For the data described in this policy, Oleg Burlaca (FolderFeed) is the data controller. Paddle acts as an independent controller for payment and billing data it processes as Merchant of Record (see section 6).
3. Data we process
3.1 Account data (stored in the cloud)
When you sign in with Google through Firebase Authentication, we receive and store:
- your name, email address, and Firebase user ID;
- plan and trial information, and last-login timestamps;
- a per-user encryption key used to encrypt part of your local browser database (see 3.3).
This data is stored in Google Cloud Firestore (Firebase), configured in the nam5 (United States multi-region) location.
3.2 Google user data (accessed through Google APIs)
With your consent on the Google sign-in screen, FolderFeed requests read-only access to:
| Google data | Why we need it |
|---|---|
| Basic profile and email | To sign you in and identify your account |
| Drive activity (Drive Activity API v2) | To list which files changed in your monitored folders and who changed them |
| Drive files, folders and metadata, comments, shared-drive information (Drive API v3) | To show file names, folder hierarchy, and new comments/replies and assignments |
| Contacts / people information (People API) | To show names, email addresses and profile photos of people who performed activity |
This data is requested by your browser using short-lived access tokens (about one hour) and is used only to display your feed to you. It is held in your browser’s local storage (IndexedDB) on your device. It is not transmitted to our servers and not shared with anyone.
3.3 Data stored in your browser
Your browser stores, per user: folder settings, activity records, file metadata, folder hierarchy, comments and replies, and people records. Selected sensitive fields (comment and reply content, file titles, and certain people/registry fields) are encrypted using a key stored in your account. Not every field is encrypted. Because this data lives on your device, it is not synchronized between your devices, and clearing your browser data removes it.
3.4 Billing data
When you subscribe, Paddle collects payment details and processes the transaction. We receive and store billing identifiers and status needed to run your subscription: Paddle customer and subscription IDs, subscription status, plan, and relevant dates. Our webhook handling also receives your email address and transaction/subscription identifiers. We do not store payment card numbers.
3.5 Optional analytics and error monitoring
These are disabled until you enable them; your choice is stored in your browser’s local storage, and you can change it at any time.
- Firebase Analytics (Google Analytics 4): events such as Google login/sign-up and pricing, checkout, and purchase events (including transaction ID, currency, totals, and product/price identifiers). It may use identifiers such as cookies or app instance IDs.
- Sentry: application error and performance monitoring. Events are associated with your Firebase user ID, not your email address.
3.6 Technical data
Our hosting provider (Firebase Hosting) and infrastructure may process standard technical data such as IP address, browser type, and request logs for security and operation.
4. How we use data and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide the Service: sign-in, building your feed | Account data, Google data (processed in your browser) | Contract; your consent to Google permissions |
| Manage subscriptions, trials, and access | Account and billing data | Contract |
| Security, abuse prevention, and troubleshooting | Account and technical data | Legitimate interests |
| Analytics and error monitoring | Analytics/Sentry data | Consent |
| Legal, tax, and accounting obligations | Billing data | Legal obligation |
| Respond to your support requests | Email and message content | Contract / legitimate interests |
5. Google API Services User Data Policy
FolderFeed’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Google user data is used only to provide and improve the user-facing feed features you see in the app.
- We do not transfer Google user data to third parties, except as necessary to provide the Service, to comply with law, or as part of a merger or sale with your notice.
- We do not use Google user data for serving advertisements, nor sell it.
- No humans read your Google user data. Our servers do not receive it, and we have no access to the data cached in your browser.
You can revoke FolderFeed’s access at any time at https://myaccount.google.com/permissions. Because we never hold a long-term credential, access ends when your session ends.
6. Who we share data with
We use the following service providers (processors/sub-processors) to run the Service:
- Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Hosting, Firebase Analytics, Google APIs): authentication, hosting, backend, and storage. Google Privacy Policy
- Paddle.com Market Limited (Merchant of Record): payments, taxes, invoicing, and the customer portal. Paddle processes payment data as an independent controller. Paddle Privacy Policy
- Functional Software, Inc. (Sentry): error and performance monitoring, if you enable it.
We may also disclose data if required by law or to protect rights, safety, and security. We do not sell personal data.
7. International transfers
Our providers may process data in the United States and other countries. Where personal data is transferred from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the providers’ standard contractual clauses or equivalent mechanisms.
8. Retention
- Browser-local data remains on your device until you clear your browser storage or remove the app’s data.
- Account and billing records are kept while your account is active and as needed afterwards for legal, tax, accounting, and dispute purposes. You can ask us to delete your account data at any time (see section 9).
- Analytics and monitoring data is kept according to the retention settings of Google Analytics and Sentry.
9. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, restrict, or export your personal data, to object to processing, and to withdraw consent at any time (without affecting prior processing). To exercise a right, including a request to delete your account data, email [email protected]. We may need to verify your identity. We will respond within the period required by applicable law (generally within one month).
Other controls available to you:
- Revoke Google access: https://myaccount.google.com/permissions
- Analytics and Sentry: change your consent choice in the app at any time.
- Browser data: clear site data in your browser to remove locally cached feed data.
- Billing data: manage or cancel your subscription via the Paddle customer portal.
You also have the right to lodge a complaint with your local data protection authority.
10. Security
We use reasonable technical and organizational measures: HTTPS, Firebase security rules that restrict profile, key, and billing records to the owning authenticated user (with writes performed only server-side), verification of Paddle webhook signatures, short-lived Google access tokens, and encryption of selected local data. No system is completely secure, and we cannot guarantee absolute security.
11. Cookies and local storage
We use browser local storage and IndexedDB for the app to function (feed cache, settings) and to remember your analytics/monitoring consent. Analytics and monitoring technologies are not activated until you consent.
12. Children
The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. The “Last updated” date shows the latest version. For material changes, we will give reasonable notice, for example in the app or by email.
14. Contact
Oleg Burlaca (FolderFeed) Email: [email protected]