The short version
FoldRender has no account system and no analytics, and we receive no personal data about
you. It is not true that nothing ever leaves your device — pushing to a git remote uploads
your files to that remote, because that is what pushing is. What is true is that nothing
leaves except at your instruction: to GitHub when you sign in, clone, pull or push; briefly
through a sign-in relay of ours during the one-tap sign-in; and to DeepWiki when you ask it
to read a repository's generated documentation or to answer a question about it. Each is
described below. The one thing that moves without your asking each time is the backup
Android itself performs, which copies app data to your Google account rather than to us if
you have it switched on; it has a section of its own below.
What stays on your device
- Your documents and repositories. Files are read through Android's
Storage Access Framework, from folders you pick yourself, and cloned repositories are
written to the app's own storage. The app never uploads them anywhere on its own — the one
exception is a git push, which sends your commits to the remote you configured, at the
moment you ask for it.
- Reading preferences — theme, font size, recent files, the folder you
last opened — in app-private storage.
- Which app a file came from. When another app hands FoldRender a
document — a chat app, your mail, the system file manager — the app works out which one
and keeps the answer beside that file, so the list of things sent to you says where each
came from instead of showing a row you cannot place. It asks Android for the name of an
app already installed on your phone; it asks the internet nothing, and no request this
app makes contains the answer. Over time it adds up to a record of which apps you
receive documents from, which is why it is named here rather than folded in with the
font size.
- Your commit identity — the name and email address you enter for git.
They stay on the device, and they are written into every commit you make, so they travel
to the remote when you push. That is how git works, and it is why the fields are yours to
fill in rather than something we collect.
- Your GitHub username, read once after sign-in so the app can show who
is signed in and label commits.
- Your GitHub access token, if you sign in. It is kept in app-private
storage, encrypted with a key held in the device keystore, and is used only to talk to
GitHub. Signing out deletes it; so does uninstalling the app.
- Your Devin API key, if you enter one to read a private repository's
DeepWiki. Same storage, same keystore, and it is sent only to DeepWiki.
What leaves your device
- GitHub (
github.com and api.github.com), only
when you sign in, clone, pull, or push. Those requests go straight from your phone to
GitHub and are covered by
GitHub's privacy statement.
- Our sign-in relay (
foldrender.dev/api/gh/), only during
a one-tap GitHub sign-in. GitHub requires a client secret to turn an authorization code
into a token, and an app cannot keep a secret, so that one exchange happens on our server.
It means the relay sees your GitHub access token for the moment it performs that
exchange. It keeps nothing: no database, and the token is never written to a
log. Our host (Vercel) keeps
standard request logs, which record the request URL, so treat the one-time authorization
code as seen by the host even though the token is not. The token comes back to your phone
encrypted and bound to a nonce that never left it. If you would
rather no server of ours were involved at all, use Use a code instead — device-code
sign-in talks only to GitHub.
- DeepWiki (
mcp.deepwiki.com, or mcp.devin.ai
if you have entered a Devin API key), only when you ask to read a repository's generated
documentation, or ask a question about it. What is sent is the repository name, and — if
you asked a question — the words of that question, which are yours to choose, and, so that a follow-up makes sense, up to three earlier questions from the same conversation. Not
your code, and not the contents of anything you have open. Their handling is covered by
Devin's privacy policy.
- Your files, on a git push — to the remote you configured, when you
press push. Nothing is pushed automatically.
- Whatever a document itself points at. A README with a badge, an HTML page whose pictures or stylesheet live on a server — the app fetches those the way any reader would, from the host the document names, when you open it. That request carries your IP address to a host we neither choose nor see, and nothing about you is added to it. A document that references nothing remote makes no such request.
- Nothing else. No telemetry, no crash reporting service, no advertising
SDK, no third-party analytics anywhere in the app.
Android's own backup
Everything in the section above stays on your device as far as FoldRender is concerned:
the app sends none of it anywhere. Android itself is a separate matter, and this page would
be misleading without saying so. If you have backup switched on — it is on by default on
most phones — the system copies app data to your own Google Drive and restores it when you
set up a new phone or transfer to one. It goes to your Google account, not to us: we have
no access to it and no copy of it.
FoldRender deliberately keeps things out of that copy. Your GitHub access token, your
Devin API key and the local push token are excluded, which is what makes it true that
signing out deletes the token and so does uninstalling. The list of folders you have opened
is excluded too, and with it the record of which app each file came from, because a list of
the apps you receive documents from should not reach your cloud storage by a back door. So
are the questions you have asked DeepWiki and the repositories you looked up: a question is
someone thinking out loud about work they may not have shipped.
What is still carried is the way you have set the reader up — theme, font size, reading
width — and the address of the last document you had open, so that a new phone opens where
the old one left off. Everything else the app holds stays on the device it was made on: your
folders and recent files, your clones and their git history, your commit identity, your
credentials, and the questions you have asked. If you would rather even that much were not
copied, Android's own settings turn backup off — on a Pixel under System, then Backup; on a Samsung phone under Accounts and backup, then Google Drive.
The local push endpoint
FoldRender can open a small HTTP endpoint so a machine on your own network can send a
document straight into the reading pane. It is off by default, binds only
while you have it switched on, requires a token generated on your device, and only ever
accepts documents — it never serves your files back out. It is reachable from your local
network only, never from the internet.
Permissions
The app requests one Android permission, INTERNET, which is what git
operations and GitHub sign-in need. Access to your files comes from the folders you choose in
the system picker, not from a storage permission.
It also declares one package visibility filter. That is not a permission and grants
nothing: it is what lets the app ask Android the name of an app that can receive shared
files, so a document sent to you by a chat app can be labelled with that app's name instead
of an identifier you would have to decode. It matches only apps that can receive shared
content, and the app deliberately does not request the blanket permission that would let it
see everything installed on your phone.
This website
foldrender.dev uses Umami to see which pages get read — it is loaded on the home page
and on the guides, not on this policy page. It records page views and an approximate region
derived from your IP address. It sets no cookie, and it gives you no identifier that lasts
from one day to the next, which is why this site asks you to accept nothing before you read
it. Our Umami is self-hosted on a DUOCODE TECHNOLOGY server at fluentdojo.com, so those page
views leave foldrender.dev. We do not use any of it to build advertising profiles, and the
site shows no ads. Hosting is Vercel, whose servers keep standard request logs.
Until September 2026 this site loaded Google Analytics 4 instead, which stored a client
identifier in a _ga cookie. It has been removed, and nothing here loads it any
more.
None of this touches the app: FoldRender itself still contains no analytics of any kind.
Children
FoldRender is a developer tool and is not directed at children under 13. Since we collect
no data at all, we hold no information about anyone, children included.
Changes and contact
This policy is provided by DUOCODE TECHNOLOGY (registration LA0087244-A), Malaysia, the
developer of FoldRender, and it is the privacy notice required by section 7 of Malaysia's
Personal Data Protection Act 2010. If it changes, the updated version will be posted here
with a new date. Questions about privacy in FoldRender can go to
duocodetechu@gmail.com.
This notice is published in English, in Chinese and in Bahasa Malaysia. Where the
versions differ, the English version prevails.