Privacy Policy

01Introduction

Effective 7 September 2026. This policy explains what personal data Fold collects, why, where it goes, how long we keep it and what you can do about it. It applies to the Fold iOS app (“Fold - Quit Betting & Gambling”), the website at app-fold.com and the Ally invitation pages at app-fold.com/ally.

We have tried to write it the way we would want to read it: in plain English, with the important bits up front. If anything is unclear, email support@app-fold.com and we will answer.

We only process your data on the legal bases set out in How we use your data. Where we rely on your consent, you can withdraw it at any time (see Your rights).

02Who we are

The data controller is Fold, operated by Robin Basile-Linsolas, an individual developer based in France (9 chemin Abbaye Saint-Pons, France). In this policy, “Fold”, “we” and “us” mean the operator of the app.

For anything to do with your data, including privacy and legal requests, write to support@app-fold.com. This is our single contact address for support, privacy and legal matters.

Fold is a self-help recovery companion for people who want to quit or cut down betting and gambling. It is not a medical device, a clinical or therapeutic service, or a substitute for professional treatment. Our Terms say more about what Fold is and is not.

03What we collect

Here is everything Fold collects or handles, category by category, with where it is stored and why we need it. “On device” means it stays on your iPhone. “Supabase (EU)” means our database hosted on AWS in Frankfurt, Germany.

04What we don’t collect

Fold does not collect or access:

• your precise location — the optional casino alert runs on your phone: it asks Apple Maps for venues around you, exactly as the Maps app does, and Fold never receives or stores your position;
• your contacts;
• your photos;
• your microphone;
• health data from Apple Health or any other source;
• your bank, card or other financial account data. The spend figures you enter during onboarding are numbers you type yourself, not connected accounts;
• your browsing history. Without the optional DNS profile, Fold sees nothing of what you visit. With it, our resolver answers each lookup as it arrives and keeps no record of the domain or of the address it came from (see DNS filter).

Apart from the Superwall SDK (paywall, subscription state and subscription analytics, see Payments) and the AppsFlyer SDK (marketing attribution, see Attribution), we embed no third-party analytics or crash-reporting SDKs: no Firebase, no Mixpanel, no Sentry. If that changes, we will update this policy first.

05How we use your data and our legal bases

UK GDPR and EU GDPR require us to have a lawful basis for every use of your personal data. Here are ours.

Performance of the contract

Providing the app you asked for: creating your account and signing you in, storing and syncing your data so it survives a new phone, running the library, the pledge and the panic button, issuing your Ally invite code, and processing your Fold Pro subscription.

Consent

Some things only happen because you said yes, and you can change your mind at any time:

• Tracking — sharing your advertising identifier with AppsFlyer and Superwall for attribution (iOS asks once).
• Notifications — local reminders and milestones (iOS asks).
• Squad visibility — posting and appearing on the leaderboard.
• Ally — sharing your streak, money-kept estimate and last urge time with the person you invite. To stop for good, use Profile → Delete everything, which deletes the link itself.
• Penny — sending your messages to an AI to get a reply.

Legitimate interests

Keeping the service secure, preventing fraud and abuse, improving the product, and measuring in aggregate which marketing channels bring people to Fold (without your advertising identifier unless you allowed tracking; see Attribution). We only rely on this where your rights and interests do not override ours, and never for anything you would find surprising.

Special category data

Your onboarding answers, your recovery data, your Squad streak and what you share with your Ally can reveal information about your health. We treat everything in Fold as sensitive. Where this information counts as special category data, we process it on the basis of your explicit consent (UK GDPR / GDPR Article 9(2)(a)), which you give by choosing to enter it in Fold. We use the contract basis only for account, sync and subscription mechanics.

You can withdraw that consent at any time with Profile → Delete everything, or by emailing support@app-fold.com. Withdrawal does not affect processing that already happened, but Fold cannot personalise your plan or your money-saved estimate without these answers.

What you have to give us

Nothing here is required by law. To use Fold you need an account (Sign in with Apple, Sign in with Google, or an anonymous account via “Skip for now”) and, for a personalised plan and money-saved estimate, your onboarding answers. Everything else is optional: Squad, Ally, Penny, notifications, tracking and the blocker. You can use the rest of Fold without any of them.

Automated decisions

Fold does not make decisions about you by solely automated means that have legal or similarly significant effects. Penny’s replies and your personalised plan are suggestions you are free to ignore.

06Penny, the AI coach

Penny is a text chat powered by an AI model, not a person. When you send Penny a message, it goes to our server (a Supabase Edge Function), which forwards it to OpenAI in the United States. OpenAI’s model (currently gpt-4o-mini) generates the reply, which comes back to you the same way.

• Under OpenAI’s API terms, your messages are not used to train their models.
• OpenAI may keep messages for up to 30 days for abuse monitoring under its API data-usage policy.
• Your messages travel to the US. See International transfers for the safeguards.

You can stop using Penny at any time. Fold relays your messages to OpenAI as described above, and OpenAI’s 30-day retention applies to them. Any copy Fold holds is covered by the deletion options in Your rights.

07Squad: what other users see

Squad is Fold’s community: a feed of posts, replies and “flame” reactions, plus a league leaderboard ranked by streak. Everything in Squad is shared with other Fold users. Specifically, other users can see:

• your posts, replies and reactions;
• your display name and avatar colour;
• your current streak in days;
• when you were last seen in the app.

Your email and onboarding answers are never shown in Squad. Choose a display name you are comfortable with; you do not have to use your real name.

Moderation. When you report a post or a reply, we store the report: who sent it, what was reported, the reason you chose and a copy of the text at that moment, so the content can still be reviewed after it is deleted. When you block someone, we store the pair of accounts so the block follows you to a new phone. Both are kept on our legitimate interest in keeping Squad safe and in meeting the App Store rules we agreed to; both go when the account they belong to is deleted. A filter also checks every post and reply as it is written, on your device and again on our server; it looks at the text of that post only, and keeps nothing.

You take part in Squad as described in the app. You can delete any of your own posts from the feed, and Profile → Delete everything removes you from the feed and the league along with the rest of your account.

08Ally

An Ally is one trusted person you invite to support you. You share a link in the form app-fold.com/ally/<code>. The code is unique to you, so share it only with the person you mean to.

If your Ally enters your code, they see your name (your first name if you gave one, otherwise your account display name), your streak, your money-kept estimate and when your last urge was, each time they open Fold. Fold does not send them notifications. They do not see your Penny conversations, your onboarding answers or your Squad activity. Removing an ally in the app only clears them from your phone; to stop sharing with someone who has already used your code, use Profile → Delete everything, which deletes the link itself, or email support@app-fold.com.

If someone invites you as their Ally, you will see these figures about their recovery when you open Fold. Please treat what they share with care.

09Our website and Ally pages

app-fold.com hosts this policy, our Terms, our Support page and the Ally invitation pages. The website does not ask you to create an account or enter your recovery data; that all happens in the app.

When someone enters an Ally code, we store the link between the two of you so we can show the Ally the streak, money-kept estimate and last urge time the inviting user shares. We hold that link until either account is erased or until one of you asks us to remove it. If you have been invited as someone’s Ally and no longer want to see their updates, tap “Stop being their ally” in the app (this clears it from your phone) or email support@app-fold.com to remove the link.

10Payments, Superwall and Apple

Fold Pro is an auto-renewing subscription bought through Apple’s In-App Purchase system. Apple handles the payment. Fold never sees your card number, billing address or bank details. Apple’s own privacy policy governs what Apple collects during payment.

We use the Superwall SDK to display the paywall and manage subscription state. Superwall receives:

• purchase events (a trial started, a subscription renewed, a subscription cancelled);
• device information: device model, iOS version, locale and app version;
• an install identifier;
• your advertising identifier only if you allowed tracking.

Superwall is based in the United States. See International transfers. For pricing, trials, cancellation and refunds, see our Terms.

11Attribution and marketing measurement (AppsFlyer)

To know which ad, link or creator brought someone to Fold, and whether that channel leads to trials and subscriptions, the app embeds the AppsFlyer SDK. AppsFlyer is a mobile-measurement provider based in the United States. It answers one question for us, where to spend a small marketing budget, and it is never used to show you ads or to build a profile of you.

What AppsFlyer receives

• the fact that Fold was installed and opened, with the time;
• four funnel events: onboarding completed, a paywall shown, a free trial started, and a subscription started (with the product, price and currency);
• technical details: IP address, device model, iOS version, system language, time zone, carrier and app version;
• identifiers: your device’s vendor identifier (IDFV), an identifier AppsFlyer assigns to your install, and the install identifier we also give Superwall;
• your advertising identifier (IDFA) only if you allow tracking when iOS asks.

AppsFlyer does not receive your email, your name, your onboarding answers, your recovery data, your Penny messages or anything you post in Squad.

How the tracking prompt fits in

Fold asks the tracking question early in onboarding, right after sign-in. AppsFlyer sends nothing until you have answered (or, if the prompt is left unanswered, for a few minutes at most). If you decline, AppsFlyer still receives the install, the funnel events and the technical details above, but not your advertising identifier, and iOS blocks the SDK’s tracking endpoints on your device. Nothing changes in the app.

Separately, Apple sends AppsFlyer a copy of its own privacy-preserving SKAdNetwork install report, which contains no identifier for you.

Legal basis, retention and your choices

• Advertising identifier: your consent, given through the iOS tracking prompt. Withdraw it at any time in iPhone Settings → Privacy & Security → Tracking.
• Everything else AppsFlyer receives: our legitimate interest in measuring, in aggregate, which marketing channels work. You can object at any time (see Your rights).
• Retention: under its services privacy policy, AppsFlyer keeps end-user data for no more than 24 months. To have your device’s record deleted sooner, use the opt-out form below; email us if you want help filing it.
• Opt out of measurement entirely: AppsFlyer offers a device opt-out form at appsflyer.com/legal/opt-out/, or email us and we will file the request for you.

AppsFlyer acts as our processor. Its services privacy policy is at appsflyer.com/legal/services-privacy-policy/. AppsFlyer Inc. is certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US DPF; see International transfers.

12Tracking permission (App Tracking Transparency)

Fold asks once for permission to track you, using Apple’s standard prompt. Here is exactly what your answer changes.

If you allow tracking

Your device’s advertising identifier may be used to measure which marketing campaigns brought you to Fold. This helps us understand where to spend our limited marketing budget. It is shared with AppsFlyer and Superwall for this purpose. It is never sold and never used to build a profile of you for advertising elsewhere.

If you decline

Nothing changes in the app. Every feature works exactly the same. AppsFlyer and Superwall simply do not get your advertising identifier. AppsFlyer still receives the install and funnel events described in Attribution, without it.

You can change your choice at any time in iPhone Settings → Privacy & Security → Tracking.

13Things that never leave your device

A lot of Fold runs entirely on your iPhone, and the data involved never reaches our servers or anyone else’s.

• Screen Time selections. When you choose betting apps and sites to block, Apple gives Fold opaque tokens, not the names. Fold cannot read which apps you chose. The tokens stay on your device.
• SMS filter. If you enable it, the filter extension classifies incoming texts from unknown senders on your device to hide gambling promotions. No message content is sent to Fold.
• Local notifications. Reminders and milestones are scheduled by the app on your phone. We do not run a push server in the current version.
• Audio. The narrated episodes (“The Fold Sessions”) use your device’s speech synthesis, and ambient sounds are generated on device. Nothing is recorded and nothing is streamed.

DNS filter: the one exception, spelled out. The Blocker offers an optional configuration profile, downloaded from app-fold.com and installed by you in iOS Settings. While it is installed, your iPhone sends every DNS lookup (the step that turns a name like example.com into an address) over an encrypted connection to a resolver that Fold runs on a server at OVH in France (EU). That resolver answers in real time: gambling domains, taken from public block lists (Mullvad dns-blocklists and HaGeZi), get an NXDOMAIN answer so the page cannot load; everything else is forwarded to Quad9 or Cloudflare, which see our server, not you. The resolver is configured to keep nothing: no query log, no record of the domains or of your IP address, no per-domain counters, and the web server in front of it has its access log switched off for this route. Help lines and self-exclusion services are never blocked. You can remove the profile at any time in Settings › General › VPN & Device Management — the full steps, and what the filter can and cannot block, are on our Support page.

14Who we share data with

We share personal data only with the service providers below, and only so they can do the job described. Supabase, OpenAI, Superwall and AppsFlyer act as our processors under their standard data-processing terms and use your data only to provide their service to us. OVH hosts our website and DNS resolver as a processor in the EU. Apple and Google act as independent controllers under their own privacy policies for the services you choose to use (sign-in, payment, Screen Time). Quad9 and Cloudflare are the upstream resolvers behind our DNS filter: they receive the lookups we do not block, coming from our server and carrying no identifier of yours. None of them buys personal data from us, and we do not sell personal data to anyone.

We may also disclose data if the law requires it, for example a valid court order, or to protect the safety of a user or the public. We will tell you if we can.

If Fold is ever sold or transferred to another operator, your data would move with it under the same protections, and we would let you know before it happens.

15International transfers

Your account and recovery data stay in the EU. Three of our providers are in the United States: OpenAI (Penny replies), Superwall (paywall and subscription analytics) and AppsFlyer (marketing attribution). When your data goes to them, we rely on recognised transfer safeguards:

• for all three providers, the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK users;
• additionally, the EU-US Data Privacy Framework and its UK Extension where the provider holds a current certification. AppsFlyer Inc. is certified under the EU-US DPF, its UK Extension and the Swiss-US DPF.

You can ask for a copy of the clauses that apply to you by emailing support@app-fold.com.

16How long we keep data

• Your account, recovery data, Squad content and Ally data are kept until you delete them, so the app works and your progress survives a new phone.
• When you use Profile → Delete everything, all of it goes at once and for good: Squad posts, replies and reactions, blocks, reports about your own content, Penny usage, subscription entitlement and Apple transaction records, Ally links and shares, onboarding answers, profile, recovery data — and then the sign-in identity itself. If any part of that fails, we stop and keep the account rather than leave half of it behind, and the app tells you to try again.
• If the in-app deletion will not go through, email us and we complete the erasure by hand within 30 days.
• Backups are purged within 30 days of deletion.
• Squad posts are deleted when you delete them individually or when your account is erased.
• Penny messages pass through our server to OpenAI, which may keep them for up to 30 days for abuse monitoring.
• Purchase records are held by Apple under Apple’s own retention rules; Superwall keeps subscription events as described in its own policy.
• DNS lookups made through the optional DNS profile are not kept at all: our resolver answers them and discards them.
• Attribution data is kept by AppsFlyer for no more than 24 months under its services privacy policy; you can have it deleted sooner through AppsFlyer’s opt-out form (see Attribution).

Data that only lives on your device (Screen Time selections, SMS filter, local notifications) is removed when you delete the app.

17Security

We take reasonable technical and organisational measures to protect your data:

• all data in transit is encrypted with TLS;
• our database uses row-level security, so your data can only be read and written by you, with Squad content and the Ally information you choose to share as the deliberate exceptions;
• access to the database and servers is limited to the operator;
• payment details never touch our systems, because Apple handles them.

No system is perfectly secure. If we ever become aware of a breach that puts your rights at risk, we will notify you and the relevant supervisory authority as the law requires.

18Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify data that is inaccurate or incomplete;
• Erase your data (“the right to be forgotten”);
• Restrict how we process your data in certain situations;
• Portability: receive your data in a structured, machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent at any time for anything based on consent, without affecting what was done before.

How to exercise them

• Delete your account yourself: in the app, go to Profile → Delete everything. This erases the account and everything attached to it from our servers straight away; backup copies are purged within 30 days. You do not need to ask us.
• Delete your own Squad posts directly in the feed.
• Withdraw tracking or notification consent in iPhone Settings (Privacy & Security → Tracking, and Notifications). To be removed from AppsFlyer’s measurement entirely, use AppsFlyer’s opt-out form at appsflyer.com/legal/opt-out/, or email us and we will file the request for you.
• Stop sharing with your Ally as described in the app, or by emailing us.
• Withdraw Squad or Penny consent by no longer using those features and deleting your posts; Profile → Delete everything takes you out of the feed and the league entirely.
• Anything else (access request, data export, correction, objection, or an erasure the in-app button would not complete): email support@app-fold.com. We may need to verify that the request comes from the account holder. We respond within one month; if a request is complex we may extend by up to two further months and will tell you why.

Exercising your rights is free. We will not treat you differently for doing so.

Complaints

If you are unhappy with how we handle your data, we would like the chance to fix it first, so please email us. You also have the right to complain to a supervisory authority:

• United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk;
• France: the Commission nationale de l’informatique et des libertés (CNIL), cnil.fr;
• Elsewhere in the EU/EEA: the data protection authority in the country where you live.

19Children

Fold is for adults who want to stop betting or gambling. You must be 18 or over to use it. We do not knowingly collect data from anyone under 18.

If you believe someone under 18 has created a Fold account, email support@app-fold.com. We will delete their account and data on notice.

20Changes to this policy

We will update this policy when the app changes in a way that affects your data, for example if we add a new provider or a new feature that collects something new. The effective date at the top tells you which version you are reading.

For significant changes we will tell you in the app before they take effect. Where a change needs your consent (for example a new use of your onboarding answers), we will ask for it before doing anything new. If you do not agree, you can delete your data and stop using Fold at any time.

21Contact

For anything about your data, this policy or your rights:

Fold, operated by Robin Basile-Linsolas
9 chemin Abbaye Saint-Pons, France
support@app-fold.com

Our Support page also lists gambling helplines and answers common questions. Our Terms cover subscriptions, refunds and how the app may be used.