Privacy Policy

CraftCodely SRL ("we," "us," or "our") operates BeyondFolder at beyondfolder.com — a site that presents our products (Docuyond, Omniyond, Mailyond, NuxtBeyond and the Distribution Framework), publishes free SaaS calculators, and hosts the Directories submission tracker.

This Privacy Policy explains what we collect, why we collect it, and what you can do about it. We are committed to protecting your privacy and to complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using beyondfolder.com, you agree to the practices described in this policy. If you do not agree, please do not use the site.

We use the information above only for the following purposes:

• Providing the service — creating your account, signing you in, and storing the projects and submissions you track
• Account security — verifying your email address, resetting passwords, rate limiting sign-in attempts, and blocking automated abuse
• Service communication — sending transactional email such as verification and password reset messages
• Improving the site — understanding, in aggregate, which pages and tools people find useful
• Legal compliance — meeting our legal obligations and enforcing our Terms of Service

We rely on these legal bases under the GDPR:

• Contract performance — processing needed to give you the account and features you asked for
• Legitimate interests — keeping the service secure and improving it, balanced against your rights
• Consent — where you have explicitly opted in, for example by choosing Google sign-in
• Legal obligation — where the law requires us to retain or disclose information

We do not sell your personal data, and we do not use it to serve advertising.

This section describes our use of data obtained through Google sign-in, in line with the Google API Services User Data Policy, including the Limited Use requirements.

• What we request — the email scope only
• What we store — your email address and your Google account identifier
• What we use it for — solely to create and authenticate your BeyondFolder account. Nothing else.
• What we do not do — we do not sell this data, we do not use it for advertising or profiling, we do not transfer it to third parties except the infrastructure providers listed below that host the data on our behalf, and we do not use it to train machine learning or AI models
• Revoking access — you can disconnect BeyondFolder at any time from your Google Account permissions page. Revoking access does not delete your BeyondFolder account; to delete the account itself, email us at support@beyondfolder.com

We do not sell, rent, or trade your personal data. We share it only with the service providers that make BeyondFolder work, each acting as a processor on our behalf:

• Cloudflare — hosting, DNS, the D1 database that stores your account and tracker data, key-value storage for rate limits, and the Turnstile anti-bot challenge on our sign-in and sign-up forms
• Mailyond (our own email product, operated by CraftCodely SRL) — delivery of transactional email such as verification and password reset messages
• Google — identity verification, only if you choose Google sign-in
• Datafa.st — privacy-friendly, cookieless website analytics

We may also disclose information where we are legally required to do so, or where it is necessary to protect our rights, safety, or property.

• Session cookie — when you sign in to the Directories tracker we set an encrypted, HTTP-only session cookie so that you stay signed in. It is strictly necessary for the tracker to function and expires after 30 days.
• Turnstile — Cloudflare's bot challenge may set its own technical cookie or local storage entry on our authentication pages to distinguish humans from bots.
• Analytics — we use Datafa.st, which is cookieless and does not build cross-site profiles of visitors. It gives us aggregate counts such as page views and referrers.

We do not use advertising cookies, retargeting pixels, or third-party trackers.

• Account and tracker data — kept for as long as your account exists
• Verification and reset tokens — 24 hours and 1 hour respectively, then cleared
• Rate-limit counters — automatically expire, typically within 15 minutes
• Deleted content — deleting a project immediately deletes its submissions and any API keys scoped to it; deleting your account removes your account record, projects, submissions, custom directories and API keys
• Backups and logs — residual copies may persist in provider backups and security logs for a short period before being overwritten

We take the following concrete measures to protect your data:

• Passwords are hashed with scrypt and a per-user random salt; we never store or log the plaintext
• API keys are stored only as SHA-256 hashes — if our database were exposed, the keys themselves could not be recovered from it
• Tokens for email verification and password resets are stored hashed and expire quickly
• Transport encryption — all traffic is served over HTTPS
• Isolation — each account can only read and write its own projects, submissions and API keys; the shared directory catalog is read-only
• Abuse protection — Cloudflare Turnstile plus per-IP and per-account rate limits on authentication endpoints

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority as required by law.

Depending on where you live, you have some or all of the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data; you can edit your projects and submissions directly in the app
• Erasure — request deletion of your account and associated data
• Portability — receive your tracker data in a machine-readable format
• Restriction and objection — ask us to limit or stop certain processing
• Withdraw consent — for example by disconnecting Google sign-in
• Complain — lodge a complaint with your local data protection authority

To exercise any of these rights, email support@beyondfolder.com. We respond within 30 days.

We are based in Romania (European Union). Our providers may process data on servers outside your country, including in the United States. Where data leaves the European Economic Area, those transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

BeyondFolder is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect personal data from children; if you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy as the service evolves. When we do, we will change the "Last updated" date at the top of this page, and for material changes we will notify account holders by email. Continued use of the service after an update means you accept the revised policy.

Questions about this Privacy Policy or about your data:

CraftCodely SRL

Email: support@beyondfolder.com

Location: Romania