Privacy Policy

What we collect

To run the service, we keep:

• Account information: your email address and password, held only as part of authentication.
• Profile information: the username and display name you choose.
• Saved reflections: the text you write, the question it answers, its visibility setting and its dates.
• Published snapshots: copies of reflections you explicitly publish to your personal page.
• Your personal page settings: its address, display name, whether it is enabled and whether you allow search engines to index it.
• Circle relationships: friend requests, invites and accepted friendships.
• Small signals of appreciation (Resonates) and the notes people send each other, including read receipts and any mutes, blocks or reports.
• Account status: freezes and deletion requests.

We do not run advertising and we do not use third-party analytics services. We collect no behavioural tracking beyond what is listed here.

How we use information

• Creating your account and signing you in.
• Saving and showing your reflections to you.
• Providing Your Circle sharing, personal pages and notes between people.
• Running an automated safety check on notes before delivery (see Reflection privacy).
• Keeping the platform secure, preventing abuse, and responding to your requests.

Reflection privacy

Private reflections can be read only by you. This is enforced by the platform's access rules at the database level, not by hiding buttons.

A reflection set to Your Circle is visible to the people you have accepted into your Circle — and to you. A published reflection appears as a snapshot on your personal page, which is not listed anywhere and, by default, is marked so search engines ignore it; the page must be enabled by you before anyone else can see it. If you turn on "Allow search engines to index this page" in your settings, search engines such as Google may show your page, display name and published reflections in search results. You can turn this off at any time; search engines usually remove the page over time, but copies they have already stored may remain visible for a while. Private and Your Circle reflections are never included.

Your reflection history and the dates you wrote things stay private to you: social views never show them.

Your saved reflections are never sent to AI services. The only automated processing of your written content is a safety check on private notes before they are delivered: if a note is flagged, it is not sent, and the result of the check is not shared with the recipient.

Changing visibility updates what is shared: publishing creates a snapshot, and returning a reflection to Private or Your Circle removes its public copy.

Where your data lives

Unfold runs on Lovable Cloud, which provides our hosting, database and authentication; it is a separate service from the AI gateway described below. Your data is processed to provide these features and may be stored or processed outside Indonesia; wherever that happens, the protections described in this policy still apply. The service providers behind Lovable Cloud are listed at trust.lovable.dev/subprocessors.

If you choose to sign in with Google, Google confirms your identity to us; Google's own privacy policy applies to that step.

The automated safety check on private notes is performed through the Lovable AI gateway. Beyond the providers above, no third parties receive your content: no advertisers, no analytics vendors.

How long we keep things

Your reflections and account information are kept while your account is active.

Deleting a reflection removes it. Deleting your account: after you request it, your page goes offline immediately; during a 30-day grace period you can cancel; after that, your account and its content are deleted.

Some short-lived technical logs may be kept briefly for security and troubleshooting. The exact retention periods for those logs are still being finalised.

Your rights

Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and this policy, you can ask to:

• access the personal data we hold about you;
• correct or complete it;
• have it deleted;
• withdraw consent or object to certain processing;
• receive your data in a usable form.

To exercise any of these, write to support@unfoldcards.app from your account's email address. We answer every request.

If you live outside Indonesia, you may also have rights under the data protection law that applies where you live, such as the EU General Data Protection Regulation (GDPR). This policy applies to everyone who uses Unfold, and you can exercise the rights listed above in the same way regardless of where you live.

How we protect your data

Traffic to Unfold is encrypted. Your private reflections are protected by database-level access rules that only you can pass, and the parts of the system that must go around them to run features are tightly limited. Accounts are protected by the platform's authentication, and confirming your email is required before an account is used.

No system is perfectly secure, and we do not claim absolute protection. If you ever believe something has gone wrong, tell us at support@unfoldcards.app.

Cookies and local storage

Unfold stores a small amount of information in your browser's local storage: your sign-in session, your preferred language, your chosen appearance theme, and a remembered invite when you use one. There are no advertising or tracking cookies and no third-party analytics scripts.

Clearing your browser storage will sign you out and reset those preferences; it does not delete your saved reflections.

Changes and contact

If we change this policy in a way that matters, we will tell you in the app before the change takes effect.

Privacy questions, requests or concerns: support@unfoldcards.app.