Privacy Policy
Effective and last updated:
This policy explains how Formaggio (“we,” “us,” or “our”), the provider of folio.ing (the “Service”), handles personal information. For privacy questions or requests, contact contact@formaggio.software. Where data protection law uses that term, we are the controller of personal information processed to operate the Service.
1. No advertising or behavioral tracking
We do not display advertising, sell personal information, share it for targeted advertising, or use advertising pixels, cross-site behavioral tracking, or session replay. We use information to run the workspace, manage accounts, save your work, support users, and keep the Service reliable and secure. App versions, workspace revision numbers, save timestamps, and similar operational records support those functions.
2. Information handled by the Service
- Account information: when you register or sign in, Clerk handles account identifiers, email addresses, profile details, authentication credentials, and session information. An external sign-in provider may supply basic profile information according to the permissions you grant. Our database associates your workspace with your Clerk user identifier.
- Workspace content: board names, descriptions, notes, drawings, shapes, connections, imported content, and related settings. Cloud records also include the active board, a revision number, and an update timestamp.
- Technical information: hosting, authentication, and database infrastructure may process IP addresses, browser and device information, request times, errors, and security logs to deliver and protect the Service. This is operational processing rather than advertising tracking.
- Support messages: if you email us, we receive your email address, your message, and information you choose to include.
3. Guest work, cookies, and browser storage
Guest board content is saved locally in your browser, not automatically uploaded to a cloud workspace. If you explicitly choose to transfer or import it into an account, it is sent to the cloud after authentication. Ordinary page requests can still reach our hosting infrastructure when you use guest mode.
Local storage keeps guest work, pending sign-in transfers, account-scoped sign-in backups and recovery drafts, and import status. A sign-in backup remains in this browser after a successful transfer so you can download your earlier board. Session storage supports sign-in handoffs, view positions, and dismissed prompts. Cookies and similar technologies used by Clerk support authentication and security. These functions are separate from advertising cookies. See Clerk’s cookie documentation.
The installable app uses a service worker and browser caches for public app files and the offline guest editor. It does not intentionally cache authenticated pages or cloud workspace responses. Local recovery drafts can nevertheless contain account workspace content. Signing out does not necessarily erase browser-stored copies. On a shared device, clear this site’s browser data when finished.
You can clear or block cookies, local storage, and cached files using browser settings. Doing so can erase unsynced work and prevent sign-in, autosave, recovery, or offline features from working. Export or otherwise preserve important work first.
4. Why we use information
We use information to authenticate users, store and retrieve workspaces, synchronize changes, recover failed saves, respond to requests, investigate errors and abuse, and comply with legal obligations. We do not use your board content for advertising.
Where a legal basis is required, we rely on performance of our agreement with you for account and workspace features; legitimate interests in maintaining a secure, reliable service and responding to support requests; and compliance with legal obligations where applicable. Where consent is required for a particular use, we will request it and you may withdraw it.
5. Service providers and disclosures
Information is handled by providers as needed to operate the Service:
- Clerk: account management, authentication, and session security. See its privacy information.
- Supabase: storage and retrieval of signed-in workspace content and database metadata. See its privacy information.
- Google Fonts: the site loads fonts from Google’s servers, which receive your IP address and request information when your browser requests those files. See Google Fonts’ privacy explanation.
- Infrastructure and email providers: delivery of the website, operational security, and handling messages sent to our contact address.
Provider processing of information on our behalf is governed by the applicable service agreements; their privacy notices also describe their own processing. Access to workspace content is limited to operational, support, security, and legal needs. We may disclose information where legally required, to protect rights and safety, or as part of a merger or transfer of the Service subject to applicable privacy obligations.
Strategyzer is credited as the source of the Business Model Canvas framework. That attribution does not send your workspace content to Strategyzer. If you follow external links, the destination site handles your visit under its own policies.
6. Retention and deletion
Cloud workspaces are retained while needed to provide your account and until you delete content or request removal. Browser copies remain until replaced, cleared by the app, or removed through browser settings; session data normally lasts for the browser session. We retain support correspondence and operational records only as long as needed for their purpose, security, dispute resolution, or legal obligations. Retention varies by record type and provider; we do not promise a fixed deletion period for all systems.
Deleting a board removes it from the current workspace after a successful save, but exported files, local recovery copies, and retained backups may remain. Contact us to request deletion of both your authentication account and its separate cloud workspace. Deleting a Clerk account alone does not automatically delete the Supabase workspace. After a verified deletion request, we remove or anonymize information we no longer need, subject to applicable law and limited backup or security retention. Residual backups are removed through the applicable backup lifecycle and are not used for ordinary service access.
7. Security and international processing
The Service uses authenticated account access and database policies intended to restrict each cloud workspace to its owner. No online service or device storage is completely secure. Protect your account and device, avoid sensitive records in boards, and keep backups of important work.
We and our providers may process information in countries other than where you live, including the United States, whose laws may differ from yours. Where applicable law requires safeguards for international transfers, those transfers must use an appropriate lawful mechanism, such as contractual safeguards. Contact us for information about safeguards relevant to your data.
8. Your choices and rights
You can edit or delete boards, manage account details through account settings, export boards when signed in, and clear locally stored data. For access, correction, deletion, or an account-level copy of your personal information, email contact@formaggio.software. We may need to verify your identity before fulfilling a request; do not email passwords or authentication codes.
Depending on your location and applicable law, you may also have rights to restrict or object to processing, receive portable data, withdraw consent, appeal a request decision, and complain to your local data protection authority. We will respond within applicable legal time limits and explain any lawful exception. We do not discriminate against people for exercising applicable privacy rights. Because we do not sell personal information or use it for targeted advertising, there is no such processing to opt out of.
9. Children
The Service is not directed to children under 13, or a higher minimum age required locally, and we do not knowingly collect their personal information. Contact us if you believe a child below that age has provided personal information so we can investigate and remove it as appropriate.
10. Policy changes and contact
We will post updates here with a revised date. For material changes, we will provide additional notice through the Service or available account contact details as appropriate. If a change requires consent under applicable law, we will request it before that use begins.
Contact: contact@formaggio.software. See also our Terms of Service.