Privacy Policy
Last updated 2026-10-21
Foliary's role
Foliary handles conversations between you and other people. It's your responsibility to tell the other people in those conversations that you are using Foliary. Terms of Service §3 includes a short notice you can copy and send.
That shapes everything below. For your own account details you are our customer and this policy governs what we do. For the contents of your conversations, you are the data controller and we are your processor — we hold that material on your instructions, we do not decide what to do with it, and our obligations to you are set out in the Data Processing Agreement. Whether you are permitted to send us your conversations in the first place is a question about your relationship with the people you talk to, not about your relationship with us.
What we collect
Your account
- Your email address, used to sign in and to email you.
- Your name, and a business name if you give one.
- A password, stored only as a hash by our authentication provider. We never see it.
- Your time zone, so dates read correctly.
- The short description of your business you may write in the app, which is used to improve transcription accuracy and conversation sorting.
Your billing
Handled by Stripe. We never see or store your card number. We store the Stripe customer and subscription identifiers, your subscription status, the price you are on, and when your paid period ends. Stripe's own privacy policy governs what Stripe holds.
Your conversations
Once you set up Voxer to send your conversations to Foliary, Voxer sends us each message as it arrives. For each message we store:
- the message text, or — for a voice message — a transcript of what was said, plus a short AI-written summary and the recording's length;
- who sent it, as the name and account identifier Voxer supplies, and any name you give them yourself in Foliary;
- which conversation it belongs to, that conversation's name and members, and the category it has been sorted into;
- when it was sent;
- a link to the original audio, image or video, hosted by Voxer. We do not copy the audio, the picture or the video onto our systems, except for a history import (below); we keep the address Voxer gave us. ⚠️ Those addresses are Voxer's and are not access-controlled — anyone holding one can open it. That is a property of Voxer, not of Foliary, and it is why Foliary never gives those links to an AI assistant.
If you ask us to import your history, Voxer's export gives us your voice messages as audio files. We keep each file only until it has been transcribed, and then delete it — in any case within 30 days. What we keep afterwards is the same as for any message: the transcript, a summary, its length and Voxer's address for the original.
We capture from the moment you connect, not before. We do not import your history unless you ask us to.
Notes to yourself are never captured. Voxer only sends us conversations that involve at least one other person.
Private Chats are not captured. Voxer does not currently send Private Chat messages to integrations, so Foliary never receives them.
What we do not collect
No advertising identifiers, no tracking pixels, no third-party analytics in the app, no location data, no browsing history. Foliary uses only the cookies needed to keep you signed in to the app. We do not buy data about you and we do not sell data about anyone.
What we do with it
| Purpose | What happens |
|---|---|
| Transcription | Voice messages are converted to text by our AI provider. |
| Summaries | Longer transcripts are summarized. |
| Sorting | Once a day, conversations are categorized as client, team, partner, mentor or ignore. You can change any of them. |
| Serving it back | Through the app, through an AI connection you authorize, and/or as a synced folder of notes. |
| Running the service | Sending you a sign-in link, a welcome, a password reset, and telling you if something breaks. |
| Billing | Taking payment and keeping your subscription current. |
We do not use your conversations to train AI models, and our providers do not train on them on our behalf. Content sent to our AI provider through its business API is not used to train its models and is retained only briefly for abuse monitoring before deletion.
AI tools you connect. When you connect Claude, ChatGPT or another AI assistant, it reads your conversations on your behalf. What that provider does with what it reads — storage, history, training — is governed by your account with them, not by us. Check your settings there.
Our staff do not access the contents of your conversations without your permission. Our internal policies prohibit it. If we need to look at conversation content to troubleshoot a technical issue, we will ask you first. The only exception is where the law requires us to provide access; in that case we will tell you, unless we are legally barred from doing so.
Who else touches it
Our sub-processors, what each one gets, and where:
| Sub-processor | What it handles | Where |
|---|---|---|
| Supabase | The database: your account, your messages, transcripts, summaries | United States |
| Google Cloud | Receiving messages, transcription jobs, the AI connection | United States |
| OpenAI | Transcription and summarization of voice messages; conversation sorting | United States |
| Vercel | Hosting app.foliary.co | United States |
| Stripe | Payments | United States, and Stripe's own global infrastructure |
| Postmark | Transactional email | United States |
| Cloudflare | Domain name resolution only — no traffic passes through it | — |
Your conversations and your account details are stored and processed in the United States; payments — with the name, email and business name you give at checkout — go through Stripe, which also uses its own global infrastructure (see the table above). Foliary is designed for US privacy and data laws and has not been assessed against the laws of any other country. If you are outside the United States, using Foliary sends that data — your account details, your conversations and the personal data in them — to the United States. Read this policy and the Data Processing Agreement before you buy, and make sure that sending your data to the United States meets the requirements where you are; that is something only you can check.
Voxer is not our sub-processor. It is yours: your relationship with Voxer is your own, we receive what Voxer sends us because you told Voxer to send it, and we have no other access to your Voxer account.
How long we keep it
- Your conversations: for as long as your account is open, and for 30 days after you cancel. After that they are deleted. You can export them during those 30 days — see Terms §8.
- Raw incoming messages are held in a short-term log for 30 days and then deleted automatically. That log exists so a message is never lost if processing fails.
- Billing records are kept for 7 years, which is what US tax and accounting practice requires.
- Your account, until you close it.
Your rights
Depending on where you live, you may have the right to see the personal data we hold about you, to correct it, to delete it, to get a copy in a portable form, and to object to some processing. Write to support@foliary.co and we will respond within 30 days.
If you are not our customer but someone they talk to, and you want to know what is held or want it deleted: the material belongs to the customer's account, so we will pass your request to them and support them in answering it. Tell us at support@foliary.co and we will act within 30 days.
We can delete your past messages from a customer's account. Deletion applies to what is already held: new messages in a conversation that continues are captured as usual and are not deleted automatically. To stop future messages being captured, the Foliary customer has to stop communicating with you in regular Voxer conversations while their account is connected to Foliary — Voxer sends Foliary every regular conversation on their account, and Foliary cannot leave one person out. A Voxer Private Chat is not captured, so you can ask them to use one instead.
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in US state privacy laws.
Security
- Every account's data is isolated at the database level, and that isolation is tested automatically before every release.
- Your Voxer connection address is checked against a one-way hash. We also keep an encrypted copy, so we can send the address to you again if you lose it or come back after canceling. The key for that copy is kept outside our database, only the part of Foliary that emails you can use it, and it only ever sends the address to your account's email. If the address is ever exposed, we replace it.
- Connections are encrypted in transit; data is encrypted at rest by our hosting providers.
- Access to production systems is limited to personnel who need it.
If a breach affects your personal data we will tell you within 72 hours of becoming aware of it.
Children
Foliary is for business use and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
We will post changes here and, for anything material, email you before it takes effect.
Contact
support@foliary.co Belim & Co, 132 Veterans Ln, Unit A #320, Doylestown, PA 18901, United States