FoldawayPrivacy Policy
In short. The Foldaway app does not collect your data. It reads your menu bar locally to do its job, and nothing about your screen, your icons or your usage is sent to us. The only personal data we handle is the email address attached to your purchase, which we receive from Paddle so that we can email you a licence key, and the ordinary server logs produced when your Mac checks for an update or your browser loads this site.
1. Who is responsible
The controller of the personal data described here — and the "business operator handling personal information" (個人情報取扱事業者) under Japan's Act on the Protection of Personal Information — is:
WATRIX LLC (WATRIX合同会社)
1-4-7-1406 Seishincho, Edogawa-ku, Tokyo 134-0087, Japan
Representative: Wataru Takahashi, Representative Partner
Japanese Corporate Number: 6011703002284
Privacy contact: support@watrix.jp
Your purchase is made from Paddle, which acts as Merchant of Record. For the payment data you enter at checkout — card details, billing address, tax identifiers — Paddle is the controller in its own right, not our processor. That processing is described in Paddle's Privacy Notice. We never see or receive your card number.
We have not appointed an EU or UK representative under Article 27 GDPR, because our processing of EEA and UK residents' data is limited and occasional. If you consider that this position is wrong in your case, write to us and we will review it.
2. What the Foldaway app does on your Mac
To fold icons away, Foldaway uses macOS Accessibility permission to see and move menu bar items. If you turn on real menu bar glyphs, it uses Screen Recording permission to capture the small area of the menu bar occupied by an icon so it can redraw it in the panel.
These captures and readings stay on your Mac. They are not stored beyond what is needed to draw the panel, and they are never transmitted to us or to anyone else. Your settings, group names and app registrations are kept in macOS preferences on your own machine. Foldaway contains no analytics, no telemetry, no crash reporting service and no advertising SDK.
The app's only outbound network request is a periodic check for a new version against foldaway.app. That request necessarily reveals your IP address and the app and macOS version to our hosting provider, in the same way that visiting any website does.
3. What we handle, why, and on what legal basis
| Data | Where it comes from | Why | Legal basis (GDPR) |
|---|---|---|---|
| Email address, plan purchased, transaction identifier, country of purchase | Paddle, when a purchase completes | To generate and email your licence key, and to answer support requests about your licence | Art. 6(1)(b) — performance of a contract |
| The content of emails you send us, and your email address | You | To answer you | Art. 6(1)(b), or Art. 6(1)(f) — our legitimate interest in responding to enquiries |
| Server logs: IP address, timestamp, requested URL, user agent | Your browser or the app's update check | To serve the site and updates, and to keep them secure and available | Art. 6(1)(f) — our legitimate interest in operating and securing the service |
Under Japan's Act on the Protection of Personal Information, we use this personal information only for the purposes stated above (利用目的). We will not use it for a materially different purpose without first telling you.
We do not use your data for advertising or profiling, we do not run behavioural analytics on this site, and we do not sell personal information.
4. A note on your licence key
Your licence key encodes the email address it was issued to, together with the issue date and the plan, and is signed with our private key. This is how activation works offline. It means that anyone you show your licence key to can read the email address inside it. Please treat your key as you would a password.
5. Cookies
Pages on foldaway.app set no cookies of our own and carry no third-party analytics or advertising tags. When you click a buy button, Paddle's checkout is loaded and Paddle sets the cookies and local storage it needs to run the checkout and to prevent fraud; those are described in Paddle's own notice.
6. Who we share it with
We do not sell, rent or trade personal data. We disclose it only to the following service providers, which act on our instructions (in Japanese terms, 委託先) and are bound by contract to use it only for the purpose we specify:
| Provider | Role | Where it processes data |
|---|---|---|
| Paddle (Paddle.com Market Limited and affiliates) | Merchant of Record, reseller, payment and tax handling. Sends us the purchaser's email address. | United Kingdom, EEA, United States |
| Resend (Resend, Inc.) | Sends the licence key email on our behalf | United States |
| Vercel (Vercel Inc.) | Hosts this website, the update feed and the function that issues licence keys; produces the server logs described above | United States and other regions |
We may also disclose personal data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims.
7. International transfers
We are established in Japan, and the providers above process data in the United Kingdom, the EEA and the United States. Transfers out of the EEA and the UK rely on the European Commission's and the UK's adequacy decisions where they apply, and otherwise on Standard Contractual Clauses (with the UK Addendum where relevant) included in our providers' data processing agreements.
For the purposes of Article 28 of Japan's Act on the Protection of Personal Information, we entrust personal data to providers located in the United States and the United Kingdom, as set out in the table above. We take the measures described in that Article on an ongoing basis, and we will provide further information about those measures on request.
8. How long we keep it
| Data | Retention |
|---|---|
| Licence key emails, and the purchaser email address behind them, held in our email provider | 24 months from issue, then deleted |
| Support correspondence | 24 months from the last message in the thread |
| Server logs | As retained by our hosting provider in the ordinary course, typically no more than 30 days |
| Transaction and tax records | Held by Paddle as Merchant of Record, under its own policy and the tax-record retention periods that apply to it |
We keep no separate customer database of our own.
9. Security
Traffic to this site and to our licence-issuing function is encrypted with TLS. The private key used to sign licences is held as an encrypted environment secret and is never present in the app or on your Mac. Webhook calls from Paddle are verified by HMAC signature before we act on them. No system is perfectly secure, but we take measures appropriate to the limited data we hold.
10. Your rights
Everyone. Write to support@watrix.jp and we will act on your request without undue delay, and in any event within one month.
If you are in the EEA or the UK, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw any consent you have given. You also have the right to lodge a complaint with your national supervisory authority (in the UK, the Information Commissioner's Office).
If you are in Japan, you may request disclosure, correction, addition, deletion, suspension of use or cessation of third-party provision of your retained personal data under Articles 33 to 35 of the Act on the Protection of Personal Information. Requests go to the contact address above. We may need to verify your identity before acting; the simplest way is to write from the email address used for your purchase.
If you are a California resident, you have the right to know what personal information we collect, to have it deleted, to have it corrected, and not to be discriminated against for exercising those rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. We do not knowingly collect the personal information of anyone under 16.
11. Children
Foldaway is not directed at children, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes
We may update this Privacy Policy. The current version is always on this page with its effective date. If a change materially affects how we handle your personal data, we will say so clearly here, and where the law requires it we will notify you directly.
13. Contact
Questions, requests or complaints about privacy: support@watrix.jp, or by post to WATRIX LLC, 1-4-7-1406 Seishincho, Edogawa-ku, Tokyo 134-0087, Japan.