Privacy policy

1. Who we are

Ambifold (“we”, “us”) is a product of iDevelop, a business registered in Israel (a sole proprietorship). We make the Ambifold desktop app and run this website, ambifold.com.

We are the controller of the personal data we receive: data from this website, the beta waiting list, our licence server and the emails you send us. The desktop app processes your data only on your computer, under your control. We don't receive that data, so we are not its controller; section 2 explains what the app does with it, and section 2.9 what it sends to our licence server with Pro. When you buy Pro, Paddle, our reseller, is a controller of the data it collects in its own right (section 5a).

Contact: support@ambifold.com. We read every message and answer privacy requests within one month.

2. The Ambifold desktop app

Ambifold is an app that you install and run on your own computer. It keeps folders that you choose in two-way sync with your Google Drive.

2.1 Your files and Google data never reach us

The app talks to Google directly: your files, your Google sign-in and everything the app learns from Google go only between your computer and Google's servers, never to us or to anyone else. The app has no analytics, no advertising and no crash reporting, no telemetry unless you turn on health reports (or use a tester licence, which includes them: section 2.11), and you do not need an account with us to use it. The free edition sends nothing to us at all, unless you send us a problem report (section 2.10) or turn on health reports (section 2.11). With Pro and its free trial, the app also talks to our licence server, only to start the trial, to collect a purchase and to activate and check Pro; section 2.9 says when, and exactly what it sends. If you ask us for help, you may choose to email us logs or screenshots yourself; section 6 explains how we handle them.

2.2 The Google user data the app accesses

When you connect a Google account, Ambifold asks Google for access to your Google Drive files. This is the https://www.googleapis.com/auth/drive permission, which Google's sign-in screen describes as “See, edit, create, and delete all of your Google Drive files”. Ambifold needs this full access because it syncs the folders you choose, including files that were created on the web, on your phone or by other apps. Google's narrower Drive permission only covers files that an app created itself or that you pick one by one, which is not enough to keep a whole folder in sync.

2.3 How the app uses Google user data

Ambifold uses Google user data only to provide the features you see and use in the app: listing your Drive folders so you can pick one, previewing what a sync will do, and syncing files in both directions between the folders you paired. When a sync deletes a file in your Drive, the file is moved to Google Drive's trash, where you can restore it for 30 days. By default, Google Docs, Sheets and Slides are skipped and stay in Drive. If you change that setting, the app downloads converted copies of them (for example .docx files). Editing such a copy never changes the original document: the app asks whether to keep your changes as a new file or discard them. The app changes the original document only if you rename, move or delete a copy: the document then moves to Google Drive's trash, and a renamed or moved copy is uploaded as a plain file.

Ambifold does not use Google user data for advertising, does not sell it, does not use it to assess creditworthiness, and does not use it to develop, improve or train artificial intelligence or machine learning models. Because the app sends Google user data only between your computer and Google, no person at Ambifold reads it, unless you choose to send some of it to us, for example in a log or screenshot when you ask for help (section 6).

2.4 How the app stores and protects it

• Everything stays on your computer. On Linux, the app's settings, sign-in tokens and, with Pro, its licence file are in ~/.config/ambifold/, in files that only your user account can read. Logs, sync previews, the sync records and backups are in ~/.local/state/ambifold/, in folders that only your user account can open. Synced files are in the folders you chose.
• Sign-in tokens are encrypted on your disk. The file that holds Google's sign-in tokens (~/.config/ambifold/rclone.conf) is encrypted with a random key that the app keeps in your desktop's keyring (the standard Secret Service, as GNOME Keyring provides it), the way a browser keeps passwords. The key is never written to a file, a log or a command line; the app hands it to its own rclone helper programs in their environment. If your computer has no keyring that answers, the app does not make a key that it would have to keep next to the file, because that would only look safe: the file then stays readable only by your user account, but is not encrypted, and the app says so on its settings page and in its diagnostics until a keyring is available. The first time the app encrypts an existing file, it keeps a plaintext copy of the old file, readable only by your user account, and deletes it the first time it starts after 7 days.
• Encrypted in transit. All communication with Google uses HTTPS (TLS).
• A private settings page. The settings page is served by the app only on your own computer (127.0.0.1). It opens with a single-use key handed over by the tray icon, and it refuses requests from websites and from other users of the same computer.
• Your computer's own protection applies. Files on your disk are protected by your computer's security, such as your login and disk or home-folder encryption.

2.5 Sharing

The app does not share, transfer or disclose Google user data to anyone. It exchanges Google user data only with Google, as needed to sync the folders you chose, and never sends any of it to our licence server (section 2.9). We do not receive the data, so we cannot share it either.

2.6 Retention and deletion

• Synced files are your files. They stay in your folders until you delete them.
• Backups of files that a sync deleted or overwrote on your computer are kept for the period you set in the app (30 days by default) and then deleted automatically.
• Logs may contain file and folder names. They are kept to a fixed size, and the oldest entries are overwritten.
• Removing a folder pair (Stop syncing in the app) moves it to Recently removed, where you can restore it for 30 days: until then, the app keeps the pair's settings, its sync records and its log. It deletes them after those 30 days, or at once if you choose Remove now there or remove the pair's Google account. Your files on both sides are not touched, and its backups are kept until their period ends.
• Removing an account in the app's settings deletes its sign-in tokens from your computer; the plaintext copy made when the app first encrypts the file (section 2.4) can still hold them: the app deletes that copy the first time it starts after 7 days. You can also revoke the app's access at any time in your Google Account, under Third-party apps and services. If you connected through your own Google client, it is listed there under the name you gave your own Google app; if you used one-click sign-in (section 2.7), it is listed as Ambifold.
• Uninstalling: remove the package (sudo apt purge ambifold, which also removes our package repository from your system), then delete the two folders named in section 2.4 and the autostart entry ~/.config/autostart/ambifold.desktop to remove everything the app stored, including tokens, logs and backups. The key for the encrypted tokens stays in your keyring as an item named “Ambifold settings key”; delete it in your keyring's manager (for example Passwords and Keys). If you created a Google Cloud project for it, you can delete that too. The steps. Uninstalling doesn't cancel a Pro subscription (section 5a) or delete what our licence server keeps (section 2.9).

2.7 The free edition and Pro

In the free edition and the Pro trial, and in Pro whenever you don't use the one-click sign-in described below, the app connects to Google through an OAuth client that you create in your own Google Cloud project, following the app's guide. That project belongs to you, and Google's terms apply between you and Google. The free edition syncs one Google account and up to three folder pairs, and never contacts us, unless you send us a problem report (section 2.10) or turn on health reports (section 2.11). Pro syncs more; the app counts your accounts and folder pairs on your computer, and never tells us how many you have or anything about them. Section 2.9 describes Pro's licence checks.

One-click Google sign-in (Pro). With Pro, you can instead connect a Google account through Ambifold's own Google client, so that you need no Google Cloud project of your own. Google's sign-in screen then names Ambifold (or ambifold.com), and until Google has finished reviewing Ambifold it first warns that it hasn't verified the app. Nothing else changes: your files, everything the app learns from Google and Google's sign-in tokens still go only between your computer and Google, and the tokens stay on your computer, in the same file as with your own client (section 2.4). We never receive them, and our licence server never learns whether, or for which Google accounts, you use one-click sign-in: the app counts the accounts that use it (one per computer while Google reviews Ambifold, up to five once Google approves it) on your computer only. As with any app you sign in to, Google knows that your Google account allowed Ambifold's client, and lists that access in your Google Account, where you can remove it at any time (section 2.6). The free edition, the trial and the beta testers' free Pro don't offer one-click sign-in; tester licences do, and they include the weekly health report (sections 2.11 and 5). One-click sign-in works only while Google lets Ambifold's client sign in, and only while places last: until Google verifies Ambifold, Google allows 100 Google accounts in total.

If we ever add a feature that sends any other data from the app to us, we will update this policy before that feature is released and say exactly what is sent. (The update checks of our package, described in section 2.8, are made by your system's update manager, not by the app.) Problem reports, which the app sends only when you press Send, are described in section 2.10, and health reports, which it sends only if you turn them on, in section 2.11.

2.8 Updates through our package repository

If you install Ambifold from our .deb package, the package adds Ambifold's package repository, apt.ambifold.com, to your system's software sources. From then on, your system's update manager (not the Ambifold app) checks the repository for new versions, usually every few hours, and downloads a new version when you install it, as it does for every other repository.

Ambifold checks for new versions without contacting us: it reads the update list your computer's package manager (APT) has already downloaded, using the local command apt-cache, and sends nothing. APT itself downloads that list from apt.ambifold.com, as with any package source.

These requests go to Cloudflare, which serves the repository for us. Like any web request, they carry your IP address, the files requested, the time, and the name and version of your system's update tool. Cloudflare processes this information as described in section 4. We keep no logs of these requests, and we never link them to you or to your email address.

What we count: only totals, from Cloudflare's statistics, which we read without any IP address: per day, how many requests reach the repository for its list of packages and for each version of the package, and whether a package was downloaded by an update manager or in a browser. From these totals we estimate how many computers use Ambifold and how fast updates reach them: each computer downloads each new list of packages once. We can't tell who made a request, and the totals can't be linked to you. The same applies when you download the package from the beta invite page (section 5). Our legal basis is our legitimate interest in knowing how many people use Ambifold and whether its updates reach them (Article 6(1)(f) GDPR).

You can switch the repository off in your system's software sources at any time; Ambifold keeps working without it, but gets no updates.

2.9 Ambifold Pro and the licence server

Pro and its free trial work with our licence server, license.ambifold.com. It checks that a trial or a licence is valid, keeps count of the computers that use each licence, and signs a small licence file, valid for 24 hours, that the app keeps and checks by itself. The app never sends it your files, file or folder names, Google data, your name, email address or user name, your computer's name, or how many folders or accounts you have.

When the app contacts it: only when you start the trial, buy Pro from the app, enter a licence code, choose Restore on this computer, replace another computer, remove Pro from this computer, renew a cancelled subscription (the server then asks Paddle to take the cancellation back), or click Check now; and, while you have a Pro licence or the trial, about once a day when your computer is on and online, to renew the licence file, which lasts 24 hours. After you click Get Pro in the app, the app asks every few seconds, then less often, for up to 24 hours, whether your payment has gone through, and collects your new licence code if you paid on the same network as the app (section 4). In the free edition, the app contacts the server only if you start the trial, buy, enter a code or choose Restore, and it never does so just because it started.

What the app sends:

• a device code: a one-way code that the app computes from your computer's machine ID (/etc/machine-id) and your Linux user number, or, on a computer without a machine ID, from a random number that the app keeps in its licence file. It lets our server recognise the same computer without learning its machine ID, and it can't be matched with the codes that other apps make from it. The server stores only a further coded form of it;
• your licence code, or the licence file that the server signed earlier (it holds no name, email address or payment details);
• the app's version and your Linux version's name, for example “Linux Mint 22.3”, so that you can tell your computers apart when you replace one;
• which of our signing keys this version of the app accepts and, when you replace a computer, which of your computers it replaces;
• when you buy from the app: a random code that lets the app collect your new licence code.

Like any connection over the internet, a request also shows our server your IP address. We keep only a coded form of it that changes every day, for 48 hours, to limit abuse, as for the signup form (section 5). When the app asks whether a purchase has gone through, the server also compares a coded form of the app's network address with the ones it keeps for the browser that paid (below); it doesn't store the app's.

What the server keeps, and for how long:

The server never stores names, postal addresses, IP addresses, email addresses (we read yours from Paddle only when we write to you), payment details, anything from Google or about your folders, or licence codes that anyone could read.

When something needs our attention, such as a disputed payment or an email that couldn't be sent, the server emails us an alert that names at most an ID, such as Paddle's ID of the order, never an address or a licence code. Its daily summary to us has counts only, and so does our weekly report, which also counts these records.

Where: Cloudflare runs the licence server for us, and its database is kept in a Cloudflare D1 database located in the European Union. Deleted records can remain in Cloudflare's automatic database backups for up to 30 days. We also keep encrypted weekly copies of the database on our own computer, to be able to repair mistakes, and delete each copy after 90 days.

On your computer: the app keeps your licence code, the licence file, your choice of the folders that keep syncing in the free edition and, while a purchase you started in the app is under way, the random code that collects it, in ~/.config/ambifold/license.json, which only your user account can read. It never stores the machine ID or the device code there.

Legal basis: providing Pro and its trial under our terms (Article 6(1)(b) GDPR); and our legitimate interests (Article 6(1)(f)) in preventing abuse of the trial and of licence codes, and in keeping records of a licence after it ends, to answer questions and disputes about it.

2.10 Problem reports

From Ambifold 0.3.0-beta.3, Report a problem… in the app's tray menu lets you send us a problem report without writing an email. The app sends a report only when you press Send, once: never by itself, in the background or again later. In the free edition, this is the only time the app contacts us, apart from the weekly health report if you turn it on (section 2.11).

What is sent:

• what you write under “What happened?”;
• your email address, if you give one, so that we can answer you. We use it only to answer this report;
• the app's version;
• if “Include diagnostics” is ticked (it is by default), the same text as Save diagnostics (section 6): the versions of the app and your system, how it was installed, its settings, your edition, the state of your accounts and folder pairs (named “account A” and “pair 1”, not by their names) and its recent log. It has no file or folder names, email addresses, sign-in data, paths or licence codes, and not your user or computer name. Show what is sent shows you exactly this text before you send it.

Like any request, it also carries your IP address to our website. The app sends nothing else, and nothing from your files or your Google Drive, unless you type it in yourself.

Where it goes: to our website, ambifold.com, at Cloudflare, which at once emails it to support@ambifold.com through SMTP2GO, in its EU data centre: plain text without tracking, with the diagnostics as an attached text file, and your email address, if you gave one, as the address our reply goes to. It then arrives in our mailbox (section 7). The website stores nothing of the report. To limit abuse, it counts reports per hour and per day for each coded IP address, as the beta list's form does (section 5): the code is computed one way with a secret key, changes every day, and the counters are deleted after 48 hours, as section 5 describes. It also counts the reports of each day in total.

Why: to answer you and to fix problems in Ambifold. Legal basis: our legitimate interest in supporting and improving Ambifold (Article 6(1)(f) GDPR), and, when you ask for an answer, taking the steps you ask us to take (Article 6(1)(b)).

How long: only as long as we need it to help you. We delete a report and its diagnostics once the problem is resolved, or earlier if you ask. If we write back to you, the conversation is kept like any email you send us (section 6). SMTP2GO deletes its delivery records after about 35 days (section 7).

If sending fails, the app says so and offers to save the diagnostics as a file, so that you can email them to us yourself instead.

2.11 Health reports

From Ambifold 0.3.0-beta.3, if you agree, the app sends us an anonymous health report once a week. It helps us see how Ambifold works on real computers (which Linux versions, desktops and file systems it runs on, and which kinds of problems come up) and fix what goes wrong. It is off until you turn it on: in the app's settings, under Health reports, or when the settings page asks you, once, a few days after you set up your first folder pair. You can turn it off at any time in the same place, and the app then sends nothing more. We may ask beta testers, and people to whom we give Pro, to turn it on; it stays their choice, and Pro does not depend on it. The one exception is a tester licence (section 5 and terms C9): it includes the weekly health report, so the app sends it while that licence is in use, the same report as for everyone, which Show what is sent shows you. If you'd rather not send it, don't use the tester licence, or ask us to end it.

What is sent, at most once a week:

• the app's version, how it was installed (our package or otherwise) and its edition (“none” until Pro turns on in a later build, then free, trial, Pro or beta, which is Pro given free as a thank-you for testing), never a licence code or the device code of section 2.9;
• the name and version of your Linux distribution (for example “Linux Mint” and “22.1”) and the name of your desktop (for example “X-Cinnamon”);
• how many Google accounts and folder pairs the app has, in ranges (such as “2” or “4-5”);
• for the last 7 days: how many syncs went well, were retried or failed, how long a sync typically took (in ranges), and which kinds of problems and waits came up, as codes with counts (such as “auth_failed: 1”), never their messages;
• the type of file system of your synced folders (such as “ext2/3/4” or “ecryptfs”) and whether your home folder is encrypted with eCryptfs;
• the week of the report (such as “2026-W40”).

It never contains file or folder names, paths, email addresses, account names, anything from your files or your Google Drive (no Google user data), your user or computer name, or any identifier of you, your computer or your installation, and no time more precise than the week. Show what is sent, next to the setting, shows you the exact report the app would send.

Where it goes: to our website, ambifold.com, at Cloudflare (section 4), not to the licence server. Like any request, it carries your IP address. The website stores neither the report nor your IP address: it only adds the report's counts to weekly totals (such as “Linux Mint 22.1: 12 computers this week”), each count on its own, so that no single report can be put back together and nothing in the totals relates to you or your computer. To limit abuse, it counts the reports of each coded IP address per day, as the beta list's form does (section 5): the code is computed one way with a secret key, changes every day, and the counters are deleted after 48 hours. It also counts the reports of each day in total. Only we see the totals, in a summary we send ourselves each week.

Why: to find and fix problems in Ambifold and to decide what to support. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by turning the setting off; with a tester licence, the licence's terms, which include the report (Article 6(1)(b)).

How long: the report and your IP address are not kept. The coded counters are deleted after 48 hours. The weekly totals are anonymous: they describe no person and no computer, and we keep them to see how Ambifold does over time.

If a report can't be sent, for example because you are offline, the app tries again later: after an hour, then less and less often, at most once a day. It never sends more than one report a week.

3. Google API Services: Limited Use

Ambifold's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs, including the Google Drive API, will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

In particular:

• Ambifold uses Google user data only to provide or improve the user-facing features described in section 2.
• Ambifold does not transfer Google user data to others, except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your prior consent.
• Ambifold does not use or transfer Google user data for serving advertisements, including personalised or interest-based advertising, and does not sell it.
• No person at Ambifold reads Google user data unless you choose to send it to us, for example in a log or screenshot for support. We then use it only to help you, and delete it when your issue is resolved.
• Ambifold does not use Google Workspace API data, including Google Drive data, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models, and does not transfer or sell it for that purpose.

4. This website

This website sets no cookies of its own and uses no local storage. It has no advertising and nothing that follows you from site to site. Apart from Cloudflare's page counter and the checkout page, both described below, it loads no resources from other companies (its fonts and images are served from ambifold.com itself).

The site is hosted by Cloudflare. As with any website, your browser sends technical information with each request, such as your IP address, the page requested, your browser's user agent and the time. Cloudflare processes this information on our behalf to deliver the pages and to protect the site against attacks and abuse, and keeps it only briefly, as described in its privacy policy. Cloudflare shows us only aggregate traffic statistics that don't identify anyone. Each week we look at them in total, never by IP address: visits and page views per page, country, device and browser. We do not keep web server logs ourselves and do not use this information to identify visitors. If Cloudflare ever has to check whether a visitor is an automated bot, for example during an attack, it may set a strictly necessary security cookie (__cf_bm or cf_clearance); it is not used for tracking. Our legal basis is our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

Cloudflare's page counter (Cloudflare Web Analytics) runs only for visitors who reach Cloudflare outside the European Economic Area, the United Kingdom and Switzerland. There, Cloudflare adds a small script from static.cloudflareinsights.com to our pages. It sets no cookies and stores nothing in your browser. When a page has loaded, and again when you leave it, it sends Cloudflare the page's address, the address of the page you came from, and how fast the page and its files loaded and responded. Cloudflare uses your IP address only to receive this and then discards it, keeps no query strings (the part of an address after a “?”), and shows us only totals: page views and visits per page, country, device, browser and the site you came from. We use them to learn which pages help people and where they find us. The counter never runs on the checkout page, the beta invite page or the unsubscribe page. If your browser or an ad blocker blocks static.cloudflareinsights.com, nothing else changes for you. Our legal basis is our legitimate interest in knowing how our website is used (Article 6(1)(f) GDPR).

The checkout page, ambifold.com/buy, loads Paddle's checkout (Paddle.js) from Paddle's servers, so that you can pay without leaving our site. Paddle may set its own cookies there and collect technical data about your browser and device, under its own privacy policy (section 5a). The page itself sets no cookies and stores nothing in your browser: it asks our licence server which offers are on sale, asks it to start your order with Paddle and, after you pay, asks it for your licence code (section 2.9). Opened from a link in one of Paddle's emails, it first asks our licence server whether the order in that link may be paid on this page. Our licence server keeps the network addresses of the page's requests about your order, in coded form, for 48 hours, so that only an Ambifold app on the same network can collect your licence code (section 2.9). No other page of this website loads anything from Paddle.

The pricing page, ambifold.com/pricing, asks our licence server which offers are on sale, to show when one is sold out. That request sends nothing beyond what every request to a website carries (see above), and the server keeps nothing from it. The pricing page and the checkout page also ask ambifold.com itself how many one-click sign-in places are left, a number we set by hand; that request, too, carries nothing beyond what every request does, and nothing is kept from it.

The licence page, ambifold.com/account, sends the email address you type to our licence server, only to email you your licence code again (section 5a).

Nothing on this website follows you from site to site, so it treats every visitor the same whether or not the browser sends Do Not Track or Global Privacy Control signals. No third party collects information about your activity across websites through this site.

5. The beta waiting list and the private beta

If you ask for an invite to the private beta, we store:

• your email address;
• your Linux distribution, if you choose one (until 28 September 2026, the form also let you say that you use Windows);
• the date and time of your request, and which version of the consent text you saw;
• which version of the beta terms you accepted with the form's box;
• whether and when you confirmed your request (see below).

You are not legally required to give us your email address. If you don't, we can't send you an invitation.

Confirmation: anyone can type an address into the form, so the first email we send you asks you to confirm that the request came from you. We usually send it right after your request. You confirm with the button on the page that its personal link opens, or by replying to it. We store only a one-way code of the link, which stops working after 14 days. If you don't confirm within 14 days, we delete your address.

Our notices to ourselves: each day with new testers or new questionnaire answers, we email ourselves a short summary: how many people signed up, confirmed and became testers, and the answers to the questionnaire (below), by tester ID, but never your email address. When the confirmation email to you couldn't be sent, we email ourselves a short notice with the number of entries on the list and the distribution you chose, if any, again never your email address.

Abuse protection: to limit repeated submissions, the form counts attempts per hour for each coded IP address. The code is computed one way from your IP address with a secret key that is kept apart from the list, and it changes every day. We do not store your IP address itself, and these counters are not linked to your email address. Our clean-up deletes them after 48 hours. It runs whenever someone uses the form, and we also run it by hand at least once a week, so a counter can occasionally stay for up to a week. The form also refuses addresses of temporary (disposable) email services, by their domain, using a list that is kept with our website's code: no other service is asked, and nothing about a refused address is stored.

Why: to give you your personal link to the beta (when you confirm, or by email when your turn comes), and to tell you when Ambifold is publicly released. Your distribution helps us decide what to test. There will be no Windows version of Ambifold: if you signed up saying that you use Windows, we will send you one email to tell you so, without asking you to confirm first, and delete your entry by 31 October 2026 (if we can't email you by then, we delete it without emailing). We send no newsletter and no other marketing. Our emails are plain text, without tracking pixels or tracked links: open and click tracking are off at SMTP2GO, the service that delivers them (section 7). Each email goes to one person.

Legal basis: your consent (Article 6(1)(a) GDPR and UK GDPR), which you can withdraw at any time without affecting what happened before. For the attempt counters: our legitimate interest in keeping the form free of abuse (Article 6(1)(f)).

How long: until we have told you about the public release (or, if you signed up saying that you use Windows, until we have sent you that one email, and no later than 31 October 2026), and in any case no later than 31 December 2027; earlier if you unsubscribe, ask us to delete it, or don't confirm your request. Then we delete it.

Unsubscribe: every email we send to the list has a personal unsubscribe link, in its text and in its headers, so your mail app may also show an Unsubscribe button. Using it deletes your entry, and your tester record if you have one, at once. The link contains your address and a code that works only for it. You can also reply “unsubscribe” (or “leave”) to any email from us, or write to support@ambifold.com.

Where: the list and the tester records (below) are kept in a Cloudflare D1 database located in the European Union. Deleted entries can remain in Cloudflare's automatic database backups for up to 30 days before they are overwritten. To send an email to several people, we export their addresses to a file on our own computer and delete the file once the email has gone out. Our sending tool keeps a log of what it sent for 90 days: the time, which email, and a one-way code of each address, never the address itself, so that nobody gets the same email twice. The emails are delivered by SMTP2GO (section 7). When we delete your entry, we delete any copies too.

Beta testers

When you get your personal link to the beta (when you confirm your address, if that week still has a place, or later by email), we also keep a tester record, linked to your list entry:

• a tester ID (such as T-7KQ2M), which we use instead of your address in our notes and bug reports;
• the group (wave) you were invited in, or the week, and when;
• when you accepted the beta terms (on the confirmation page or the invite page), and which version of them;
• whether you asked for the two check-in emails;
• when you first used the download button on the invite page;
• whether your invite link was switched off;
• if you answer the questionnaire on your download page: your answers, and whether we picked you as a one-click tester (below).

Your invite link is personal. We store only a one-way code of it, not the link itself, and it stops working 14 days after the invitation unless you accept it. The link in your confirmation email also leads back to your download page; of it, too, we store only a one-way code. The invite page sets no cookies. Using the invite also confirms your list entry.

Why: to run the beta: to give you the download, to know who accepted the terms, and to tell you about new builds and about problems that affect you. Build notes, and warnings about a faulty build or possible data loss, are service messages that are part of taking part in the beta, not marketing. The day-7 and day-30 check-in emails come only if you asked for them.

Legal basis: for running the beta and its service messages, taking part in the beta under its terms (Article 6(1)(b) GDPR); for keeping a record that you accepted the terms, our legitimate interest in being able to show it (Article 6(1)(f)); for warning you about a faulty build after we ended your participation, our legitimate interest, and yours, in keeping your files safe (Article 6(1)(f)); for the check-in emails, your consent (Article 6(1)(a)), which you give with the box on the confirmation page or the invite page and can withdraw at any time.

How long: while you take part. The tester record is deleted together with your list entry: when you leave or unsubscribe, after the release announcement, and no later than 31 December 2027. If we end your participation (for example because an invite link was shared), a copy of Ambifold you installed still gets beta builds through Update Manager, so we keep your record and address only to warn you about a faulty build, until one of those events.

Beta questionnaire

Your download page has a short questionnaire, after the download. It is optional: the download never depends on it. If you answer it, we keep, with your tester record: your Linux version (Linux Mint 22.x, Ubuntu 24.04, Ubuntu 26.04 or another), your desktop, how much is in your Google Drive (under 15 GB, 15 to 200 GB, or over 200 GB), what you would sync (documents, photos, shared folders, Google Docs files), what you use for Google Drive today, whether you will report problems within a week, and when you first answered. Each answer is a choice from a list: there is no free text, nothing about your files, and we never ask your name, country, employer, phone number or Google address.

Why: to choose a few testers for one-click Google sign-in, whom we give a free tester licence (terms C9). We choose by hand, on these answers alone, and we keep whom we picked or skipped, and when, and, if we picked you, when we emailed you your tester licence. To choose, we see the answers by tester ID, in our daily summary (above); we read your email address from the list only to send you the tester licence if we pick you.

Legal basis: taking part in the beta under its terms, which offer the tester licences (Article 6(1)(b) GDPR).

How long: with your tester record: your answers and our choice are deleted together with it, when you leave or unsubscribe, after the release announcement, and no later than 31 December 2027. Until we have chosen, you can change your answers on your download page; you can ask us to delete them at any time.

5a. Buying Pro

Paddle is our reseller. Paddle sells Pro to you as the merchant of record: Paddle.com Market Limited (United Kingdom), or Paddle.com Inc. if you buy from the United States, or Paddle.com (Canada) Ltd if you buy from Canada. At checkout, Paddle collects what it needs to take your payment and to meet its tax and legal duties, such as your email address, your country and postcode, your payment details, and technical data about your browser and device to prevent fraud. Paddle is a controller of that data in its own right, under Paddle's privacy policy. We never see your full card number.

What we receive from Paddle: what you bought and when, its status (paid, renewed, cancelled, refunded or disputed), Paddle's IDs for you, the order and the subscription, and your email address. When our licence server reads an order from Paddle, and in Paddle's seller dashboard, we can also see the rest of Paddle's record of it, such as your country, the amounts and tax, and the kind of payment method (for a card: its brand, its last four digits and the name on it). Our licence server doesn't store these, and we look at them in Paddle's dashboard only to help you, to handle refunds and disputes, and to check Paddle's payouts to us. Our weekly report reads our sales from Paddle only as totals per day, never per person. Our licence server keeps what section 2.9 lists. It doesn't keep your email address, only a one-way code of it, which lets us find your licence when you ask for your code again. When we need to write to you, to send your code, to send it again when you ask, or to give you notice of a change to your subscription's price or to our terms, we read the address from Paddle. We don't use it for marketing.

Your licence email comes from support@ambifold.com through SMTP2GO (section 7), as plain text without tracking, usually within a minute of your payment. If it can't be sent, our server tries again for up to 3 days. If you ask for your code again at ambifold.com/account, our server makes a one-way code of the address you type, only to find your licence, and keeps nothing if it matches no purchase. If it matches, the server emails every licence code bought with it that still works to the address Paddle holds for the purchase, at most once every 10 minutes; while that email waits to go out, it is listed under the same one-way code, which the server keeps for your licence anyway (section 2.9).

Paddle's own emails (such as receipts and emails about your subscription) and its customer portal come from Paddle, under its privacy policy.

Legal basis: delivering and managing the licence you bought (Article 6(1)(b) GDPR); and our legitimate interests (Article 6(1)(f)) in sending you a lost code when you ask, in handling refunds, disputes and abuse, and in checking Paddle's payouts to us.

How long: as in section 2.9: while the licence is active, plus 24 months. Paddle keeps its own records, including those that tax law requires, under its privacy policy.

6. Emails, support and beta feedback

If you email us, for example with a question or to report a problem during the beta, we receive your email address, your message and anything you choose to attach. Logs, diagnostics and screenshots from the app can contain file and folder names from your computer and your Drive, the path of your home folder and your computer's user name. Please remove anything you don't want to share before you send it. A diagnostics file from the app is made on your computer only when you ask for one; you can read it first, and it reaches us only if you attach it yourself or send it with a problem report (section 2.10).

We write our replies from support@ambifold.com in a mail program on our own computer. They are delivered through SMTP2GO, and the conversation, including copies of our replies, stays in our mailbox (section 7).

If you write to us about Pro, we may look up your licence (section 2.9) to help you.

Why: to answer you and to fix problems in Ambifold.

Legal basis: taking the steps you ask us to take (Article 6(1)(b) GDPR), and otherwise our legitimate interest in supporting and improving Ambifold (Article 6(1)(f)).

How long: we delete logs, diagnostics and screenshots you sent once your issue is resolved, and conversations 12 months after the last message, or earlier if you ask.

7. Service providers

We use these companies to run the website, the package repository, the waiting list, the licence server and our email, and Paddle sells Pro for us. We do not sell or rent personal data to anyone.

Cloudflare processes data on our behalf under its data processing addendum, and SMTP2GO under its data processing agreement, which requires the companies SMTP2GO itself uses (its sub-processors) to protect the data to the same standard. Google provides our mailbox under its standard Gmail terms and its privacy policy, not under a data processing agreement with us. Paddle is not our processor: it sells Pro to you in its own name and is responsible for the data it collects, under its own privacy policy. The Ambifold app sends your files and Google data only to Google Drive, as described in section 2; with Pro, it also talks to our licence server, which Cloudflare runs for us (section 2.9); when you send us a problem report, the report goes to our website at Cloudflare, which emails it to us through SMTP2GO (section 2.10); and if you turn on health reports, the weekly report goes to our website at Cloudflare (section 2.11). Your system's update manager contacts our package repository at Cloudflare (section 2.8).

8. International transfers

We are based in Israel, which the European Commission and the United Kingdom recognise as providing an adequate level of data protection. The waiting list, the tester records and the licence server's database are stored in the European Union. SMTP2GO is based in New Zealand, which the European Commission and the United Kingdom also recognise as adequate, and it processes our emails in its EU data centre. Some of the companies SMTP2GO uses are based in the United States; where one of them processes our data outside the EU, the UK or another country recognised as adequate, SMTP2GO's data processing agreement requires the European Commission's standard contractual clauses (with the UK addendum) or another approved safeguard. Cloudflare and Google are based in the United States and operate worldwide. Cloudflare takes part in the EU–U.S. Data Privacy Framework and its UK extension, and its data processing addendum includes the European Commission's standard contractual clauses. Google LLC also takes part in the Data Privacy Framework. Paddle.com Market Limited is based in the United Kingdom, which the European Commission recognises as adequate; if you buy from the United States or Canada, you buy from Paddle.com Inc. or Paddle.com (Canada) Ltd, and Paddle's privacy policy describes how Paddle protects the data it transfers. Email us for a copy of these safeguards.

9. Your rights

Depending on where you live, and in any case if the GDPR or UK GDPR applies to you, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have it corrected, or deleted;
• restrict how we use it, or object to our use of it based on legitimate interests;
• receive it in a portable format;
• withdraw your consent at any time;
• complain to a data protection authority, such as the authority in your EU country, the Information Commissioner's Office in the UK, or the Privacy Protection Authority in Israel.

To use any of these rights, email support@ambifold.com, ideally from the address concerned. It is free, and we answer within one month. We may ask you to confirm that the address is yours.

To complain to us about how we handle your data, email support@ambifold.com with the subject “Privacy complaint”. We acknowledge it within 30 days, look into it without undue delay, and tell you the outcome. You can also complain to a data protection authority at any time.

We do not sell or share personal information as those terms are defined in California privacy law, we do not use it for targeted advertising, and we make no automated decisions about you: we choose one-click testers by hand (section 5).

10. How to delete your data

• Beta waiting list and tester record: use the unsubscribe link in any email from us, which deletes them at once. Or reply “unsubscribe” to any email from us, or write to support@ambifold.com with the subject “Delete my data”: we delete your entry, your tester record, our working copies of them and the emails we sent you, within 30 days and usually much sooner, and confirm by email.
• Emails and problem reports you sent us: ask us, and we delete the conversation and anything you attached or sent with it from our mailbox.
• Pro and its licence: write to support@ambifold.com from the address you bought with, or with your licence code, and we delete your licence records, including the list of your computers, within 30 days; copies in our encrypted weekly backups are deleted as they expire, within 90 days. This ends Pro on your computers at their next check, so ask once you no longer use Pro, and cancel a yearly subscription in Paddle's customer portal first, or it keeps renewing. Trial records hold no name or contact details, so we can't tell which one is yours; they are deleted automatically 24 months after the trial ends. Paddle keeps its own records of your purchase, including those that tax law requires; ask Paddle about those.
• Health reports: turn them off in the app's settings. We keep no report and nothing that relates to you, so there is nothing of yours to delete.
• The desktop app: apart from Pro's licence records, we hold none of its data. Remove the account in the app, revoke access in your Google Account, and delete the app's folders (section 2.6).

11. Children

Ambifold and this website are not directed at children under 16, and we do not knowingly collect their personal data. The private beta is for people aged 18 or older. If you believe a child has joined the waiting list, contact us and we will delete the entry.

12. Changes to this policy

When we change this policy, we update this page and the date at the top. If a change affects how we use your email address, we will tell you by email before it takes effect, and where the change needs your consent (for example, a new kind of email), we will ask for it and not assume it. If a change affects how the app handles Google user data, we will update this policy before the change is released.

Changes on 11 November 2026: section 2.9 now says that, while you have a Pro licence or the trial, the app renews its licence file about once a day, because the file now lasts 24 hours; this replaces the less frequent checks it described before. What the app sends, and what the server stores, have not changed.

Changes on 19 October 2026: corrections, so that section 2 says what the app does. Section 2.3: editing a converted copy of a Google document never changes the document; only renaming, moving or deleting a copy does, by moving the document to Google Drive's trash. Section 2.6: a folder pair that you stop syncing stays in Recently removed for 30 days, with its sync records and its log, so that you can restore it. Sections 2.4 and 2.6: the plaintext copy that the app keeps when it first encrypts the sign-in file is deleted the first time the app starts after 7 days. Nothing about where your data goes has changed.

Changes on 16 October 2026: you can now get the beta at once. You accept the beta terms with a box in the signup form, and we keep which version you accepted; when you confirm your address and that week still has a place, we make your tester record at once and show you your download page (section 5). The form now refuses addresses of temporary email services, using a list kept with our website's code. Your download page has an optional questionnaire, which helps us choose testers for one-click Google sign-in by hand (the new part “Beta questionnaire” in section 5); instead of a notice for each signup, we email ourselves a daily summary without addresses. Section 2.7 now says that the trial and the beta testers' free Pro don't offer one-click sign-in, and that tester licences do and include the weekly health report (section 2.11); section 4 mentions the pricing pages' request for the number of one-click places left.

Changes on 15 October 2026: section 2.8 now says how the app tells you that a new version is available: it reads the update list that your computer's package manager has already downloaded, with the local command apt-cache, and sends nothing to us; the short version is updated to match. Nothing about where your data goes has changed.

Changes on 12 October 2026: the app now stores Google's sign-in tokens encrypted. Section 2.4 describes the encryption and what the app does when your computer has no keyring, and sections 2.2 and 2.6 are updated to match. Nothing about where your Google data goes has changed.

Changes on 5 October 2026: Ambifold Pro. The new section 2.9 describes the licence server that Pro and its free trial use, from version 0.4 of the app, and the new section 5a describes buying Pro through Paddle, our reseller; section 4 describes the checkout page, the pricing page and the licence page, Cloudflare's page counter (which runs only outside the EU, the UK and Switzerland) and the statistics we look at; section 2.8 describes the update checks we count in total; section 2.7 describes Pro's one-click Google sign-in, through Ambifold's own Google client, which doesn't change where your Google data goes; sections 1, 2.1, 2.4 to 2.7, 6, 7, 8 and 10 are updated to match; problem reports and health reports, sections 2.9 and 2.10 since 4 October, are now sections 2.10 and 2.11. The free edition still sends nothing to us, unless you send us a problem report or turn on health reports.

Changes on 4 October 2026: the new section 2.9 describes problem reports, which the app sends only when you press Send, and the new section 2.10 describes health reports, which the app sends once a week only if you turn them on, and of which we keep only weekly totals; the short version and sections 2.1, 2.7, 6, 7 and 10 are updated to match. The website now sends the confirmation email itself, usually right after your request, and you can confirm with its link; we store only a one-way code of that link; we send ourselves a notice of each new request, without your address (section 5).

Changes on 30 September 2026: our emails are now delivered by SMTP2GO, in its EU data centre, without tracking (sections 5 to 8); every list email has a personal unsubscribe link that deletes your entry at once; section 5 describes the tester records of the private beta and the check-in emails; the new section 2.8 describes the update checks of our package repository; section 6 describes diagnostics files and how we write our replies.

Changes on 28 September 2026: there will be no Windows version of Ambifold, so the signup form no longer offers Windows, and section 5 now says what happens to the entries of people who chose it: one email, and deletion by 31 October 2026.

13. Contact

iDevelop (trading as Ambifold), a business registered in Israel
Email: support@ambifold.com