Last updated: 21 October 2026
Folkso Privacy Policy
Effective date: 28 September 2026
This policy covers folkso.app, Folkso accounts and the Folkso integrations with ChatGPT, Claude and Grok Bot. It separates what Folkso receives, what other people see and what our service providers process.
1. Who we are
Folkso is run by Oleksandr Plakhuta, an individual based in Bulgaria. He is the controller of the personal data described here and decides why and how it is processed. In this policy “we” means him.
Privacy questions, requests and complaints go to hello@folkso.app. Mail to that address is received by our email provider and read by the operator in a hosted mailbox.
We have not appointed a data protection officer. The law does not require one at Folkso's scale, and we will review this as the service grows. GDPR
2. The short version
A published Folkso profile can appear in results that another user sees in ChatGPT, Claude or Grok Bot. Publishing does not guarantee that you will be recommended. You can search without publishing a profile.
Contact fields never go into search results or to the AI model. Free text is filtered for contacts before it reaches a model, but a filter can miss a disguised contact, so keep contacts in the contact fields. When the assistant shows your own contacts before a request, the model sees them masked.
A request recipient sees the message and task you reviewed, the task conditions as they were when you sent it and a short introduction about you. Contacts are exchanged only after acceptance, and only the ones each side selected. If a selected contact is gone, no other contact is put in its place.
Folkso does not read your assistant's chat history or memory. It receives what the assistant sends in a tool call and stores the search conditions for a limited time.
We do not sell profiles and do not advertise with their contents. We use outside services to run Folkso and process some text with AI. Those providers are told not to train on it. Whether and for how long they keep it is a separate question, answered provider by provider in section 7.
3. What we collect
3.1 Account
Your sign-in email, authentication identifiers, sign-in method, confirmation that you are 18 or older, interface language and account settings. “About you” holds a display name, whether you act for yourself or a business, a company name where given, a short description and optionally a city.
A contact record has a type, a value, a label and whether it is offered for sharing by default. Your sign-in email is one of your contacts. Having it in the account does not mean it is shared in requests. It is shared only when you select it.
You can add a profile photo. The browser crops it, and our server decodes it and saves a new 512-pixel JPEG without camera data, location or other metadata. An AI model checks each photo against our rules before it is saved. If the check does not answer, the photo is not saved.
3.2 Profile
A profile can hold your display name, headline, field, About text, skills, languages, city, time zone, working formats and style, rates and availability. It can also say which proposals you welcome, project terms and hours, investment interests, people you would like to meet, goals, interests, tastes, hobbies, ideas and work links with titles.
Profile fields and contact fields follow different rules. An idea you keep out of search is still stored and can be checked by moderation. Your CV can include things not shown in search. Folkso does not send your CV when a request is accepted.
3.3 Searches through ChatGPT, Claude and Grok Bot
The assistant can send these tool arguments. role, intent, seniority, required_skills, preferred_skills, locations, employment_types, compensation_max, currency, compensation_unit, start_window, context_summary, fit, avoid and shared. It also sends identifiers to continue a search and may send a language code.
context_summary is a short task summary of up to 1,500 characters. fit, avoid and shared describe what matters in a match, what to exclude and what you would like to have in common. We store each search with these fields and record which people were shown, opened or hidden.
After a search, the assistant can also send note_people: a short take on each shown person of up to 240 characters, how close they are to the task and at most one closest pick. A take can say in a few words how the person's way of working suits yours. We store it so the cards in your chat can show it. Only you see it. The person it is about does not, and it is not used for matching.
The task summary appears in the request preview and, if you send a request, goes to the recipient. The other matching notes do not. If an assistant copies them into the message, they become part of what the preview shows, so read it before sending.
Tool descriptions ask the assistant to send only what the current task needs, and never unrelated history, other people's private details or sensitive information. We do not ask for access to the assistant's memory. The assistant's provider decides how it prepares a tool call. We are responsible for what we accept and process.
3.4 Requests
We store the sender and recipient, the message, the task summary, the selected contacts, the status and the dates. When you send a request, the conditions the recipient sees (role, budget with currency and unit, city, type of work and start) are saved with the request. Changing the search later does not change a request already sent.
On acceptance we store the contact values actually exchanged and when. Ratings, useful-request marks, reports, blocks and appeals are separate records. A report or appeal text can contain personal information about someone.
3.5 Connections and notifications
We store which assistant is connected and when it was last used. If you connect Telegram, we store the chat identifier and the Telegram username. The username is added to your contacts, marked as confirmed by the bot and not offered for sharing until you choose to share it.
We record notification settings and delivery status. When you change these settings or unsubscribe, we record the date and which of those actions you used. Our email provider receives your address and the message. Telegram receives the notifications sent through it.
If you turn on browser notifications on a computer, we store the push address your browser gives us and its encryption keys. The notification text is encrypted with those keys, so the push service of your browser's maker cannot read it.
3.6 Data we receive from others
Other users can send you a request, rate a request, report you or block you. Google sends sign-in data when you use Google sign-in. ChatGPT, Claude and Grok Bot send tool arguments and a locale. Providers send delivery, abuse and error events. We do not buy scraped CVs or social network data.
3.7 Technical and security data
Sign-in and hosting process IP addresses, browser and device information, security signals, timestamps and session identifiers. We record usage counters for limits, application errors, staff actions and the cost of AI calls. Error reports hold the error message, the place in the code and the page address without its query string. They do not hold request bodies, headers, IP addresses or people's texts.
AI cost records are totals by day, feature and model, without any account. Connection records say which assistant was used and when, without the conversation.
While analytics is on in your browser, we record site pages you open and choices on the connect page, including the assistant tab and buttons pressed. We record the page language and the source of the visit. This includes UTM tags, which ad platform added a click ID (without its value), the referring site, country from your IP address and device type. We store a hash of the IP address and browser with a salt that changes daily and is deleted after one day. The IP address and browser string themselves are not stored.
A random visit ID and its first source and landing page are kept in this tab’s session storage for up to 24 hours, including across a reload or Google sign-in. After a verified sign-in, the server links the visit to your account. For a new account, we keep a registration-source snapshot to measure which visits lead to registration and later use. A later sign-in does not replace that source. Signing out clears the browser context. Turning analytics off stops this tracking and clears the context; earlier server records remain for the periods in section 9.
Our hosting provider counts page views without cookies or browser storage. Google Analytics counts visits to the site, sign-in, profile and account pages. It receives the page address and title, browser and device data, the approximate location from your IP address and a few events: sign-up, sign-in, profile created, connect buttons pressed and an answer to a request. It does not receive your contacts, your email or the texts of your profile, and it is not loaded on pages whose address carries a one-time key. Section 13 explains how to turn it off.
Microsoft Clarity helps us understand how visitors use public marketing pages through clicks, scrolling, heatmaps and reconstructed session recordings. It starts when you open a public marketing page unless you have turned analytics off in this browser. It receives the page address, IP address, browser and device details, and interaction events. We mask page text for Clarity. It does not run on sign-in, profile, account or staff pages.
When you open a Folkso invitation link, we keep its random code and the visit time in a first-party cookie for up to 30 days. If you create an account during that period, we link the invitation to the new account to measure invitations, even if your sign-in email differs from the invited address. A forwarded link can bring another person, so this identifies the invitation source rather than confirming the recipient's identity. No email address is in the link or cookie. The invitation cookie is not sent to analytics providers. For account acquisition reports, we keep the source label Emailhunt without the invitation code for up to 12 months.
After synchronization, the operator also keeps the invitation outcome in outreach records. Those records currently have no automatic expiry. You can request their deletion at hello@folkso.app.
3.8 Data we derive
We derive embeddings of profiles and searches, matching reasons, ranking signals, moderation outcomes and an internal trust score (section 6.4).
From the profile text we also estimate working style: pace, preferred communication, depth or breadth, planning, sociability, drive and tone, which of nine work values show in the text and which broad worlds of taste it mentions. The estimates use only what you wrote. They never cover health, religion, politics or sexual orientation. We do not show them on your profile or on the cards. When your profile appears in someone's search, that person's AI assistant receives the confident ones as short fixed labels, such as “plans ahead, clear agreements” or “quality over speed”, so it can explain how working together might go. It receives no scores. The estimates do not affect ranking. We also keep them to learn, from accepted and declined requests, whether they improve matching. They are recalculated when the text changes and deleted with the profile. You can object at hello@folkso.app, and we will delete them and stop calculating them for your profile.
From the same text we also note what you say you expect from work: calls or messages, one-off or long-term work, pace, startup stage and hours. A clear note reaches the searcher's assistant with the labels above, such as “wants long-term work”. When one clearly conflicts with a search task, the assistant also gets a short code naming the unmet condition, such as calls_vs_writing. Labels and codes are fixed phrases, never quotes from your profile, and they do not affect ranking. They are recalculated when the text changes and deleted with the profile. You can object at hello@folkso.app in the same way.
An embedding, a score or an estimate linked to an account is personal data. We do not use photos to identify people or to infer protected characteristics.
3.9 Feedback
Feedback you send from your account holds the text, whether it is an idea or a problem, the account page you wrote from, the interface language and your sign-in email so we can reply. If we reply, the reply is stored with it and goes to that email.
4. What ChatGPT, Claude and Grok Bot receive
For search and profile display, the assistant receives the published display name, headline, city and time zone, skills, languages, rates, availability, About text, working preferences, public interests and public ideas, with the reasons for the match. It also receives short labels of working style, values and tastes estimated from the profile text (section 3.8). Work links are shown by title, without the address.
Other people's email, phone and messenger contacts never appear in search results or profiles. When you check your own contacts before sending a request, the model sees them masked and the card in the chat shows them in full so you can choose. Anything shown in the card still passes through the assistant's app.
When you ask the assistant to manage your own account, it can read and change what you ask it to: About you, profile, status and contacts.
A photo is shown in the card by its address. Profile text sent to an assistant becomes part of that user's conversation, and the companies named in section 7.2 process it under their terms and the user's account settings. Our no-training settings with our AI providers do not control another person's ChatGPT, Claude or Cursor account.
Pausing a profile stops it appearing in new results. It does not remove a card already in someone's conversation. We handle correction and erasure requests and take the steps the law requires regarding recipients, but we cannot delete copies in other people's chats. GDPR-ERASURE
5. Why we use data and our legal bases
The bases below are under the EU GDPR and the Bulgarian Personal Data Protection Act. The UK GDPR has the same bases for these purposes. GDPR
| Purpose and data | Legal basis | Who receives it | Retention (section 9) |
|---|---|---|---|
| Invitation sources and new accounts | Service measurement, Art. 6(1)(f) | Folkso only | Raw association, 90 days; outreach outcome as described in section 9 |
| Account and sign-in | Contract, Art. 6(1)(b); security, Art. 6(1)(f) | Hosting and database providers; Google if you sign in with Google | While the account exists |
| Publishing a profile and public ideas so you can be found | Contract, Art. 6(1)(b), within what you choose to publish | Users who search and their assistants; our matching providers | Until you pause, change or delete it |
| Searches, including summary, fit, avoid and shared | Contract, Art. 6(1)(b) | Our matching and embedding providers; the task summary goes to the person you send a request to | 90 days after the last search |
| Requests, task conditions and selected contacts | Contract, Art. 6(1)(b), the action you ask for | The two people; the email provider, Telegram or a browser push service for notifications you enabled | 12 months after the request closes |
| Profile statistics and usage limits | Contract, Art. 6(1)(b); service measurement, Art. 6(1)(f) | Folkso only | 90 days for views, 13 months for limits |
| Site visits, registration sources and choices on the connect page | Service measurement, Art. 6(1)(f), with a browser opt-out | Folkso; the hosting provider counts page views | 12 months |
| Visits and a few actions counted by Google Analytics | Service measurement, Art. 6(1)(f), with a browser opt-out | Google, as our processor | Up to 14 months |
| Public-page interactions in Microsoft Clarity | Service measurement, Art. 6(1)(f), with a browser opt-out | Microsoft, an independent controller | Recordings up to 9 months; section 9 |
| Checks of texts and photos, reports, blocks, trust score | Preventing abuse, Art. 6(1)(f); a legal duty under Art. 6(1)(c) where one applies | Moderation providers; the operator and staff; authorities where the law requires | 12 months after the decision |
| Working-style and expectation estimates for matching | Matching and improving it, Art. 6(1)(f), with the right to object | Assistants of people who search, as short labels; an AI provider computes them | With the profile |
| Tips by email | Our own similar services to people who became users and did not refuse, ePrivacy Art. 13(2) and UK PECR reg. 22(3) | Email provider | While you keep them on; the record of what we sent, 3 years |
| Support and feedback from the account | Contract, Art. 6(1)(b); other enquiries, Art. 6(1)(f) | Email and mailbox providers | 12 months after the matter closes |
| Security and error logs | Art. 6(1)(f) | Hosting, database and error-tracking providers | 30 days to 12 months, section 9 |
| Legal claims and required records | Art. 6(1)(c) for a named duty, or Art. 6(1)(f) to establish or defend a claim | The operator, advisers and authorities where lawful | Only for the specific case, with a review date |
Paid plans are not on sale. Before they are, this policy will describe payment data and the seller.
If you do not give the information an account or request needs, we cannot provide that feature. A photo, hobbies and other optional fields are never required to keep an account or search.
Special categories. Folkso does not ask for health, religion or beliefs, political opinions, sexual orientation, ethnic origin or trade-union membership. A profession or hobby can still reveal such a thing. Leave out anything sensitive you do not want other people to see. We do not treat text in a form as permission to process special-category data, and moderation may ask you to remove it. GDPR
6. Automated processing and AI
6.1 Matching
Who appears and in what order depends on the task, the published profile, the conditions given, availability, the matching notes and, where you have a profile, what you have in common with the person. Hiding a person removes them from that search. AI reorders a shortlist and checks the top results. If that check does not answer, Folkso shows nobody, and the assistant offers to try again in a minute.
The searcher's assistant can use the short labels from section 3.8 to explain how working together might go. They do not change the order.
Matching is a probability, not a verified assessment of a person. Nobody can pay for a higher place. People decide themselves whether to accept a request or agree to anything.
6.2 Checks of texts and photos
Texts of requests and profiles are checked by AI. A request can pass, wait for a person on our side or be blocked. A doubtful profile can stay visible while it waits for review. Contacts in the text are replaced with a mark before the check, so the provider sees that a contact was there, not its value.
Photos are checked for the stated safety categories after the server has removed their metadata. If the photo check does not answer, the photo is not saved. If the text check does not answer, the text goes through and reports remain the safeguard.
6.3 Reports
A report can trigger a temporary restriction or freeze automatically when reports pile up. A report is an allegation, not a finding. The affected person sees the restriction, the reason and how to appeal in their account. The reporter's identity is not shown to the reported person unless the law requires it.
6.4 Trust score
Once a day we calculate an internal trust score for people who send requests. It uses the last 90 days of accepted requests, likes and ratings, reports that were not dismissed, blocks, the share of declined requests, text checks that held or blocked a request, and staff warnings. Payment status is not used while paid plans are not on sale. A low score lowers the daily number of requests and sends each request to a person on our side before delivery. The score is not shown to anyone and is not proof of wrongdoing.
We keep the exact thresholds confidential so they cannot be gamed. You can still ask what affected you and have it reviewed.
6.5 Your rights
You can ask for an explanation and a human review of a decision that affects you, give your view and challenge wrong data or an outcome. Use the appeal in your account or write to hello@folkso.app.
In the EU, Article 22 GDPR protects you from decisions made solely by automated means that have legal or similarly significant effects. Where a person on our side reviews a decision, they can change it. The UK has its own rules on automated decisions under the Data (Use and Access) Act 2025. GDPR UK-ADM
For content or account restrictions covered by Article 17 DSA, the explanation also names the ground and how to challenge it. DSA
7. Who receives your data
7.1 Other Folkso users
People who search see your published profile. A person you send a request to sees the message, the task, its conditions and a short introduction about you. A request does not reveal a paused profile, private ideas or your CV.
After acceptance, each side receives only the contacts the other selected. From then on the other person controls their copy under the law that applies to them. Reports and who searched for you are never shown as profile statistics.
7.2 ChatGPT, Claude and Grok Bot
OpenAI and Anthropic receive the tool results and cards shown in their apps. Grok Bot is made by SpaceXAI LLC and works through the user's Cursor account. Its tool results go to Anysphere, Inc., the company behind Cursor, and to the AI model providers Cursor uses, SpaceXAI LLC among them. Each company processes them under its own terms and each user's settings. See section 4.
7.3 Service providers
| Category | What it does for Folkso | Where | How long it keeps data |
|---|---|---|---|
| Hosting, security and AI routing | Serves the site and API, blocks bots, counts page views, routes AI requests | Frankfurt, with the provider's staff and systems in the US | Logs and usage records for the period of our plan |
| Database, sign-in and file storage | Accounts, profiles, contacts, requests, photos | Ireland | Until we delete the data. No backups on our current plan |
| AI ranking and moderation | Ranks shortlists, checks texts, estimates working style | US | Per its data processing terms |
| AI models | Reading profiles, checking photos, translating, embeddings | US and other regions of the provider | Told not to train on our data, kept per provider terms |
| Sign-in codes, notifications, mail to @folkso.app | Ireland | Delivery logs 30 days | |
| Error tracking | Error reports without people's texts | US | 30 days |
| Support mailbox | Reading and answering mail to hello@folkso.app | US and other regions of the provider | Until we delete the correspondence |
| Google Analytics | Counts visits and a few actions with cookies, section 13 | US and other regions of the provider | Up to 14 months |
The names of these providers are not published because they describe how Folkso is built. Write to hello@folkso.app and we will tell you who they are, which of them processes your data and where. CJEU C-154/21
We use each provider under its data processing terms. A provider's own privacy notice is not our contract with it. GDPR
7.4 Google, Microsoft, Telegram and browser push services
Google handles Google sign-in under its own terms and passes sign-in data to our sign-in provider. Telegram delivers optional bot notifications under its privacy policy. A bot chat is not an end-to-end encrypted secret chat, so do not send sensitive material through it just because contacts were exchanged. Browser notifications travel through the push service of your browser's maker, such as Google for Chrome, Mozilla for Firefox, Apple for Safari or Microsoft for Edge. The text is encrypted end to end. The service sees when a message is sent and to which subscription. Google Analytics counts visits and a few actions on the site under Google's data processing terms, with Google acting as our processor. It runs unless you turn off analytics at the bottom of this policy; Google signals and ad personalization are switched off. What Google receives is listed in section 3.7.
Microsoft Clarity receives data about your use of public marketing pages while analytics are on in your browser, including before you choose in the cookie notice. Microsoft is an independent controller of the data it receives. Its terms allow it to use that data for its own purposes, including advertising; its Privacy Statement explains those uses. We send Clarity a denied advertising-storage signal.
7.5 Authorities and legal matters
We disclose information when a law requires it or when it is needed to establish or defend a legal claim. Emergency disclosure is limited to cases that meet the legal conditions for it.
7.6 Change of ownership
If Folkso is transferred, personal data goes with it under the same protections, and we will give the notice the law requires. A transfer does not allow new uses such as advertising or model training.
8. International transfers
Our database is in Ireland and our functions run in Frankfurt. The operator works with the data from Bulgaria. Some providers in section 7.3 are in the US or process data in other regions, and assistants' providers process what their users see.
For each transfer outside the EU and UK we rely on the EU–US Data Privacy Framework where the recipient is certified for the service concerned, or on the Standard Contractual Clauses (with the UK Addendum) in the provider's data processing terms. On request we will tell you which mechanism covers a given transfer and give you a copy of the safeguards, with commercial terms removed. GDPR
For Clarity, Microsoft says its EU customers contract with Microsoft Ireland Operations Limited and transfers to Microsoft Corporation in the US are covered by Standard Contractual Clauses. Microsoft Clarity FAQ
9. How long we keep data
A daily cleanup job enforces the periods for data we store, unless a row says manual. Providers apply their own periods stated below.
| Data | How long |
|---|---|
| Raw invitation-code/account association | 90 days after recording, or until account deletion if earlier |
| Invitation outcome in outreach records | While the outreach records are retained; no automatic expiry at present (manual) |
| Account, About you, contacts, profile, ideas, photo | While the account exists. Deleting the account removes it at once, and a photo that storage fails to delete is removed by the daily cleanup |
| Working style and expectations from profile text | While the profile exists, recalculated when the text changes. A searcher's assistant receives only short labels and unmet-condition codes (section 3.8) |
| Inactive accounts | After 24 months without a sign-in or assistant use we email you. If you do not sign in within 30 days, the account is deleted. Accounts under an active restriction are kept until it ends |
| Replaced or removed photo | Deleted at once, retried within 24 hours. A cached copy can load for up to 24 hours for someone who already has its address |
| Searches with summary, fit, avoid and shared | 90 days after the last search. If a request was sent from it, the free text is removed after 90 days and the conditions stay with the request |
| Shown, opened and expanded marks | 90 days. A hidden person stays hidden while the search exists |
| Requests, messages, exchanged contacts and ratings | 12 months after the request is answered, cancelled or expires. Deleting either account deletes the request for both |
| Usage counters for limits and edits | 13 months |
| Assistant connection marks | 12 months after the last use. The connection itself lasts until you disconnect it |
| Site visits, sources and choices on the connect page | 12 months. The daily salt for counting unique visitors, 1 day |
| Registration-source snapshot | 12 months, or until the account is deleted if earlier |
| Google Analytics data | Up to 14 months at the provider. Its cookies last up to 2 years |
| Microsoft Clarity data | Session recordings for 30 days; some recordings and interaction data for up to 9 months at Microsoft. Its cookies last up to 1 year |
| Notification queue | 90 days. Records of former tips and product emails, 3 years |
| Reports, decisions, checks and appeals | 12 months after the decision, longer while a restriction or appeal is open. They stay without a link to a deleted account for the same period |
| Staff actions and security log | 12 months |
| AI cost totals | Kept. They hold no account or text |
| Translations of profile and request texts | 30 days |
| AI takes on people shown in your search | 30 days. Only the author of the search sees them. The person does not, and they are not used for matching |
| One-time sign-in links and Telegram link codes | 7 days after use or expiry |
| Browser notification subscriptions | Until you turn them off, the browser cancels them or 12 months pass without opening your account in that browser |
| Error reports and email delivery logs | 30 days at the provider |
| Support mail | 12 months after the matter closes (manual) |
| Feedback sent from the account | 12 months after it is closed, or after sending if it was never closed |
| Backups | None on our current database plan. If we add backups, their period will appear here, and deletions will be repeated after any restore |
Deleting an account removes its records through the database. Kept moderation records can still name a person in their text, so they stay restricted. Removing an account link is not anonymisation.
We cannot delete other people's downloads or assistant conversations. We take the steps the law requires regarding such copies. GDPR GDPR-ERASURE
10. Your rights
Depending on the law and the basis, you can ask for access, correction, erasure, restriction, portability and objection, and you can withdraw consent. You can ask for a human review where the rules on automated decisions require it. These rights have conditions and exceptions, and we will explain them when they matter. GDPR
Settings has an export of your email, About you, contacts and profile. For a full copy, including events, estimates and what providers hold, write to hello@folkso.app. We check identity by replying to your sign-in email and do not ask for ID documents as a rule.
We answer within one month and tell you within that month if we need more time. You can complain to a data protection authority without going through us first. Our lead authority is the Bulgarian Commission for Personal Data Protection (cpdp.bg). You can also go to the authority where you live or work. GDPR-RIGHTS
In the UK, we acknowledge a complaint within 30 days and investigate it without undue delay. This is separate from the deadlines for access and erasure requests. UK-COMPLAINTS
Direct marketing. You can stop product tips and updates at any time, free of charge, in Notifications or with the link in any product email. We keep your choice so we can honour it, and email history for the period in section 9.
United States. Folkso does not meet the thresholds of US state privacy laws today. We answer access and deletion requests from anyone anyway. We do not sell personal information or use it ourselves for targeted advertising. Microsoft’s independent use of Clarity data is described in section 7.4.
11. Google user data
Google sign-in uses the openid, email and profile scopes. Google returns your account ID, email, name and a picture address, and our sign-in provider stores what Google returns with the sign-in record. Folkso uses only the email and account ID. The name and picture are not copied into your profile.
Your Google email becomes your sign-in contact. It is shared with another user only if you select it for a request.
We do not use Google data for advertising or model training. Our use follows the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Folkso in your Google account settings. That does not delete the Folkso account, which you delete in Settings. GOOGLE
12. Emails and notifications
Service emails cover sign-in codes, your requests, your profile status and usage limits. If you sign up and your profile stays unfinished, they also include up to 3 reminders to finish it. You can turn them off in Notifications, except sign-in codes and the email about an upcoming deletion of an inactive account. Restrictions are shown in your account. Profile reminders have their own switch and do not depend on whether product emails are on.
Product emails help you use Folkso and explain what has changed. During your first 2 weeks, we may send up to 4 messages to help you get started, including profile reminders. After that, product emails are at least 28 days apart. Instead of unsubscribing, you can get them less often, without the getting-started series and at least 90 days apart. This category is on by default for new and existing accounts, independently of the former weekly-tips setting. Sign-up explains these emails without asking you to tick a box. You can turn them off in Notifications or unsubscribe through a link in any product email. Unsubscribe links in old tips also turn off this category. Every product email names the sender.
Other emails may end with a one-line suggestion to connect ChatGPT or Claude while product emails are on and you have no active connection. This suggestion has its own setting. Its Hide link also turns off connection invitations. INTELIGO PECR
Telegram and browser notifications on a computer are optional and have their own switches. Folkso does not post new messages into ChatGPT, Claude or Grok Bot. The assistant checks request status when you ask it.
13. Cookies and browser storage
| Name | Set by | What for | How long |
|---|---|---|---|
__Host-folkso-invite | Folkso | Remembers the first invitation before account creation | Up to 30 days; removed after successful attribution |
sb-…-auth-token | Folkso | Keeps you signed in | Until you sign out or the session ends |
NEXT_LOCALE | Folkso | The language you chose | 1 year |
g_state | Google, on folkso.app | Remembers if you closed the Google sign-in prompt | Set by Google |
folkso:signed-in (browser storage) | Folkso | Whether someone signed in on this browser before, so the home page can offer Google sign-in | Until you clear it |
folkso:has-profile, folkso.likeHintSeen, folkso.try.v1 (browser storage) | Folkso | Which button to show, a one-time hint and the “Try it on” card you filled in | Until you clear it |
/sw.js service worker, push subscription, folkso.push-sync, folkso.notify-nudge.hidden (browser storage) | Folkso | Browser notifications you turned on, the last check of the subscription and a hint you hid | Until you turn notifications off or clear it |
_ga, _ga_… | Google Analytics, on folkso.app | Tells one browser from another when counting visits | 2 years |
_clck | Microsoft Clarity, on folkso.app | Keeps a browser ID across visits | Up to 1 year |
_clsk | Microsoft Clarity, on folkso.app | Joins page views into a session recording | Up to 1 day |
folkso:analytics (browser storage) | Folkso | Your analytics setting | Until you clear it |
folkso:acquisition (sessionStorage) | Folkso | The visit ID, first source and landing page, to link a visit to registration | Up to 24 hours or until the tab closes; cleared on sign-out or analytics opt-out |
Sign-in pages load Google's sign-in script from accounts.google.com. The home page and /talent load it only in a browser where someone signed in before and is signed out now. Loading it lets Google read its own cookies. The site also runs a bot check from our hosting provider, which checks in the browser that sign-in and consent requests come from a person.
Google Analytics runs on the pages of the site, sign-in, profile and account, and counts visits and the events listed in section 3.7. It is on unless you turn off analytics at the bottom of this policy. After you turn it off, that browser sends nothing to Google Analytics and its cookies are deleted. The choice stays in the browser, and you can change it here or under “Cookie settings” in the footer of the site. Google Analytics is not loaded on plugin consent, one-time link, unsubscribe and staff pages. It serves counting only, and Google signals and ad personalization are off. The invitation cookie measures which invitation led to account creation. Other non-analytics storage above supports sign-in, security or a setting you chose. Our own visit and registration-source tracking uses the session storage above while analytics is on (section 3.7). Turning analytics off also stops it and clears that storage. Server-side records are described in section 3.
Microsoft Clarity starts on public marketing pages unless you have turned off analytics in this browser. You can turn it off at the bottom of this policy. Clarity then stops collecting new interactions and removes its cookies. Earlier records remain for the periods in section 9. Microsoft also lists possible cookies on its own domains in the Clarity cookie list; our Clarity signal denies advertising storage.
14. Security
Access to account data is limited by sign-in and database rules. Staff pages need a staff role and a second sign-in factor. Staff decisions, contact reveals and photo removals are logged. Viewing a case is not logged.
Data is encrypted in transit and stored with our hosting providers' safeguards. No service is perfectly secure. We assess incidents and notify authorities and affected people when the law requires. GDPR
15. Age
Folkso accounts are for people aged 18 and over. Confirming your age does not prove it. We look into credible reports of accounts of minors and delete them, keeping information only where we must.
16. Changes to this policy
We will tell you about material changes by email or in your account 30 days before they apply, and ask for consent where a new purpose needs it. Changes required by law or an urgent security fix can apply sooner. A new version cannot make a past disclosure lawful or remove a right. The date at the top shows the current version, and earlier versions are available on request.
17. Contact
Privacy questions, rights requests and complaints: hello@folkso.app.
Operator: Oleksandr Plakhuta, Bulgaria.
DSA contact points are in section 22 of the Terms of Use. Data protection requests never need a paid plan or a published profile.
We use cookies to see how the site is used and make it better.