Who this covers
This policy applies to FoldLab’s website and app, including the public origami catalogue, accounts, the creator, community pages, and optional paid features. FoldLab is responsible for the information described here. Some features are available only when enabled; using the public catalogue does not require an account.
External sites linked from a lesson or model have their own privacy practices. Their policies apply when you leave FoldLab.
Information we handle
When you visit
Our hosting and security providers may receive technical request data such as your IP address, browser and device details, the pages or files requested, approximate location derived from your IP address, and request times. We use this to deliver the site, diagnose errors, and protect it from abuse.
When you create an account
Supabase Auth handles your email address, password credentials, account ID, sign-in sessions, confirmation and recovery events, and any authenticator factor you enroll. We do not receive your authenticator app’s one-time codes as a lasting account setting. If Google sign-in is enabled and you choose it, we receive the account information Google makes available through that sign-in, such as your email, name, and profile photo URL.
When you use FoldLab
We store the display name, optional public bio and avatar, saved account preferences, models you explicitly save, model titles and instructions, submissions and review status, likes, tutorial progress and completions, and PDF export usage. Guest preferences and lesson progress are stored on your device. Creator drafts stay in your browser until you choose to save them to an account or export a file.
When billing is enabled
We keep a Stripe customer reference and subscription status so we can grant Pro access and manage the monthly PDF allowance. Stripe handles checkout, payment methods, payment details, invoices, and its customer portal. FoldLab does not receive full card numbers.
When you contact us
We use the email address and information you send us to respond to your request. Please avoid sending passwords, authenticator codes, or sensitive information by email.
How we use it
- Provide lessons, save and sync your models and preferences, resume tutorials, and show liked models.
- Authenticate accounts, support password recovery and two-factor authentication, and prevent unauthorized access.
- Review community submissions, display approved models and public profiles, and respond to reports or rights concerns.
- Process subscriptions, enforce Pro access and PDF limits when billing is enabled, and keep records needed for payments and fraud prevention.
- Operate and improve site reliability, investigate errors, and comply with applicable law.
Where a legal basis is required, we generally process account and purchase data to provide the service you request, security and operational data for our legitimate interests in running a safe service, and records where required by law. We use optional profile and publishing information when you choose those features. We do not sell personal information or use it for behavioral advertising.
Services we use
- Supabase provides account authentication, the Postgres database for saved models and account activity, and storage for uploaded profile photos. Auth emails are sent through the configured email delivery service.
- Cloudflare serves the site, static model and narration files, and evaluates site-wide feature flags. FoldLab does not send account identities to the feature-flag service.
- Stripe hosts checkout and subscription management if billing is turned on. We send your account email and a customer reference to Stripe when you begin checkout. Stripe may collect information under its own privacy notice.
- Google is an optional sign-in provider if that option is enabled and you choose it. A Google photo selected for your profile is loaded from Google’s image service.
- ElevenLabs is used during content preparation to generate some narration from lesson text. Visitors play static audio files served with FoldLab; listening does not send your voice or a synthesis request to ElevenLabs. Account-saved creator models are not sent to ElevenLabs by the app.
- jsDelivr may serve the OpenDyslexic font if you select it and the font is not installed on your device. That request can reveal your IP address and browser details to the CDN.
Cookies and device storage
When you sign in, Supabase session cookies keep you authenticated across pages. FoldLab uses browser storage for appearance, reading and playback preferences, and lesson progress. Signed-in progress and preferences can also sync to your account. Clearing site data or signing out affects the information stored on that device; it does not automatically delete your account data.
We have not integrated advertising or product analytics cookies into FoldLab. Hosting and authentication providers may use technical storage needed for security, delivery, or sign-in. If we introduce optional tracking, we will update this policy and add any controls required by applicable law.
Retention and security
Account details, saved models, preferences, and related activity remain while your account is active unless you delete specific content or request account deletion. You can delete a saved model in your account. Billing records, webhook event identifiers, security logs, and limited backup copies may remain longer when needed for accounting, fraud prevention, dispute resolution, legal obligations, or recovery. Provider log and backup periods depend on the provider and configuration.
We use access controls, database row-level security, validated server actions, and optional two-factor authentication to protect account data. No internet service can promise absolute security. Tell us at hello@foldlab.app if you believe your account or information has been exposed.
Your choices and rights
You can change your account preferences and public profile, remove or unpublish models, reset your password, and manage an authenticator in the app. You can export creator files before removing them. Browser settings let you clear local preferences, progress, and cookies. If billing is enabled, you can manage or cancel a subscription through the Stripe billing portal linked from your account.
To request access, correction, an export of personal information, account deletion, or another privacy right available where you live, email hello@foldlab.app. We may verify your identity before acting. Some records may be retained where law permits or requires it. You may also have the right to object to certain processing or complain to your local privacy regulator.
International processing
FoldLab’s service providers may process information in countries other than yours. Those countries may have different data protection rules. Contact us if you need details about a particular transfer or the protections that apply to it.
Children
FoldLab is a general origami service and does not knowingly ask children below the age permitted by applicable law to create accounts without a parent or guardian. If you believe a child has provided account information without the required permission, email us so we can review and remove it as appropriate.
Changes and contact
We may update this policy as the service changes. We will post the revised version here with a new effective date and provide additional notice when required. For privacy questions or requests, email hello@foldlab.app.