Privacy & safety

Local by default. Bounded by design.

Foldoria is designed so that visual organization does not quietly become filesystem authority. The current prototype has no account, cloud service, telemetry stream or required network connection.

Product safeguards

What the boundaries mean

Existing sources stay read-only

Moving, rotating, recoloring, resizing, stacking, unpacking, posting or removing an external-source object changes Foldoria metadata—not source bytes.

Real writes have one managed root

File mutations are limited to canonical Documents\Foldoria content and require an explicit action plus Rust revalidation.

Paths remain Rust-owned

The React WebView receives IDs, enums, coordinates and opaque references. It receives no generic filesystem, SQL, shell or opener capability.

Public worlds are untrusted

Linked HTTPS worlds are validated, temporary and read-only. A missing-index fallback can inspect one inert page plus bounded public HTTPS styles and signature-validated media, but it never renders HTML, crawls linked pages, runs scripts/forms/login or receives local authority. Neither path can invoke local sources, managed files, programs, terminals or arbitrary JavaScript.

Stored locally

What Foldoria keeps

SQLite is Rust-owned. World passwords and locks are local access controls, not full database or filesystem encryption.

Persisted

  • Worlds, layout and appearance
  • Source references and availability metadata
  • Preferences and player poses
  • Posters, local security metadata and reading progress

Not a Foldoria cloud record

  • No user account or profile service
  • No automatic analytics or telemetry
  • No cloud sync, sharing or collaboration
  • No automatic upload of diagnostic logs

Optional diagnostics: logging is off by default. If enabled, Rust writes bounded local JSONL files; nothing is sent automatically.

This website

Static and tracker-free.

No tracking scripts
The public site uses no analytics, advertising pixels, third-party fonts or CDN assets.

No account or form database
The static host has no sign-in, upload or contact-form backend.

YouTube only after consent
The prepared privacy-enhanced embed makes no request until a video exists and the visitor explicitly starts it.

Server logs may exist
As with ordinary Nginx hosting, operational access and error logs can contain request metadata. The site does not add client-side identifiers.