Privacy Policy

1. Who we are

Sortfold is run by Sarmad Aslam, an individual based in Pakistan (“we”, “us”). For anything about your data, email msarmadaslam@gmail.com. Under the EU and UK GDPR, we are the “controller” of your personal data: the one responsible for it.

2. What we collect

If you use Sortfold without an account

We make a guest account with a random ID, kept in a cookie in your browser. We do not ask for your name or email.

If you create an account

Your name, your email address and your password. The password is stored only as a scrambled “hash” (scrypt), so nobody, including us, can read it. If you sign in with Google, Google gives us your name, email address, profile picture link and Google account ID.

What you put in

• Tasks: titles, notes, due dates, when you finished them, and their order.
• Habits: names, icons, notes, skips, pauses, and the days you ticked them.
• Journal: each entry’s date, time and text. The text is encrypted.
• Money: amounts, currencies, categories, notes and dates.
• Calendars: the link you paste and a copy of the events in it, both encrypted, and a shortened version of the link to show you.
• The Bin: things you deleted, until you restore them or delete them for good.
• Settings: your time zone and currency.

Technical records

• For each browser you are signed in on: its IP address, its browser type and when the session started and ends, so you can sign out other devices.
• A count of sign-in attempts from each IP address, to stop password guessing. It is deleted within minutes.
• A short log of recent saves, so a change sent twice over a bad connection is applied once. It never contains journal text.
• Our hosting provider’s request logs (IP address, page, time), kept for a short time for security.

We do not collect your location, contacts, photos or advertising IDs. There is no analytics, no advertising and no tracking. Our fonts are served from our own site, so opening a page does not contact anyone else.

3. How we use it, and the legal basis

• To run Sortfold for you: saving and showing your things, signing you in, sending a password reset you asked for. Basis: our agreement with you (GDPR Art. 6(1)(b)).
• To keep it safe: sign-in limits, session records and logs. Basis: our legitimate interest in stopping abuse and protecting accounts (Art. 6(1)(f)).
• Sensitive things in your journal or habits, such as health: the first time you open the Journal, we ask for your clear yes. Basis: your explicit consent (Art. 9(2)(a)). You can withdraw it at any time by deleting those entries; that does not undo what happened before.
• To answer your emails. Basis: legitimate interest (Art. 6(1)(f)).
• To obey the law. Basis: legal obligation (Art. 6(1)(c)).

We never sell or share your data for advertising, never use your content to train AI, never build a profile of you, and never make automated decisions about you.

4. Who can see your data

You. We do not read your content. The only exceptions: you ask us to look at something to help you; we must check a security problem or abuse; or a valid court order requires it. Journal text and calendar links are encrypted in the database, and our servers decrypt them only to show them to you.

Service providers that run parts of Sortfold for us, under contracts that require them to protect your data and use it only for us:

• Vercel Inc. (USA): hosting. Our code runs in Frankfurt, Germany.
• Neon (part of Databricks, USA): the database, stored in Frankfurt, Germany.
• Resend (USA): sends password-reset emails (your email address and the message).
• Google LLC (USA): only if you choose to sign in with Google. Google acts under its own privacy policy for that.

Your calendar provider. When you paste a calendar link, our server collects your events from your provider (for example Google, Apple or Microsoft). The provider sees our server, not you.

The law. We hand over data only when a valid court order or law requires it, and we tell you unless we are forbidden to.

A new owner. If Sortfold is ever passed to a company or another owner, your data moves only under this policy, and we tell you first.

5. Where your data is

Your data is stored in Frankfurt, Germany, in the European Union. Our providers are US companies. Data from the EU, the UK and Switzerland reaches them under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where they are certified, and otherwise under the European Commission’s Standard Contractual Clauses. We run Sortfold from Pakistan, which has no EU “adequacy decision”; we open your data from there only to run and support the service. Ask us for a copy of these safeguards.

6. How long we keep it

• Your things: until you delete them.
• The Bin: things stay there until you restore them, delete them for good, or empty the Bin.
• Your account: until you delete it (Settings, then Delete everything). That removes your account and everything in it from our database at once.
• Backups: our database provider keeps a short rolling history so it can recover from a failure. Deleted data leaves it within 7 days.
• Guest accounts: until you delete them. If your browser’s data is cleared, nobody can open that guest account again, including you.
• Signed-in sessions: until you sign out, or about 400 days after your last visit.
• Sign-in attempt counts: minutes.
• The log of recent saves: until you delete your account.
• Password-reset links: they stop working after one hour.
• Emails you send us: as long as needed to help you, then deleted within a year. Our hosting and email providers keep their own logs for a short time under their policies.

7. Cookies and storage on your device

We use no cookies or storage for tracking or advertising, so there is no cookie banner. Everything below is either needed to sign you in or remembers a choice you made on this device.

On a shared computer, journal words you have not saved stay in that browser until they are saved or you sign out. Signing out removes them.

We do not track you across websites, so “Do Not Track” and “Global Privacy Control” signals change nothing: we already behave as they ask.

8. Security

Connections are encrypted, passwords are hashed, journal text and calendar links are encrypted, and each account is walled off from every other. If something ever goes wrong that puts you at high risk, we tell you without delay. Read more on our Security page.

9. Your rights

Wherever you live, you can see, correct, delete and get a copy of your data.

• Change your name in Settings.
• Delete everything yourself in Settings, at any time.
• For a copy of your data, or anything else, email msarmadaslam@gmail.com.

We answer within 30 days. In the EU and UK you may also ask us to limit or stop using your data, take it to another service, and withdraw consent. You can complain to your local data protection authority (in the EU, see the list of authorities; in the UK, the Information Commission). In the UK you may complain to us first, and we confirm receipt within 30 days.

California and other US states: we do not sell or share personal information. For US health data laws, see our Consumer Health Data Policy.

10. Children

Sortfold is not for children under 13, or under the minimum age in your country if it is higher. We do not knowingly collect data from them. If you think a child has an account, email us and we delete it.

11. Google user data

This section applies if you sign in with Google.

• What we receive: your name, email address, profile picture link and Google account ID.
• How we use it: only to create your account and sign you in.
• How we store it: with your account; the access keys Google gives us are encrypted.
• Who we share it with: nobody, apart from the providers in section 4 as needed to run the app, or when the law requires it. No person reads it, it is never used for advertising, never sold, and never used to train AI.
• How to remove it: disconnect Google in Settings, or delete your account. You can also remove our access at myaccount.google.com/permissions.

Sortfold’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

12. Changes to this policy

If we change this policy in a way that matters, we tell you in the app, and by email if you have an account, at least 30 days before it takes effect. The date at the top always shows the latest version. Small fixes, such as typos, may happen without notice.

13. Contact

Sarmad Aslam, Pakistan. Email: msarmadaslam@gmail.com.