Privacy

Updated 6 Nov 2026

Your account

What: Your email if you gave one, or your account number. A hash of your password. The country you chose, and the country Cloudflare reported when you signed up. Your two-factor secret, if you turned it on. When the account was made and when you last logged in. Your invite code and who invited you.
Why: To log you in and protect the account, to refuse sign-ups from blocked countries, and to run the free bot server and invite rules.
How long: Until you delete the account. Deleting it removes your email or account number, your password and your two-factor secret. The rest of the record stays, linked to your orders, deposits and swaps.

Balance and deposits

What: Every deposit, purchase, refund and invite credit on your balance. For each deposit: the coin, the amount in dollars and in coin, the exchange rate, the address it was paid to, the transaction that paid it, and the country Cloudflare reported when you opened it. If card payments are offered: Stripe's payment reference.
Why: To credit deposits, keep your balance right and refuse deposits from blocked countries.
How long: No fixed period. Balance entries are never changed or deleted, because together they make up your balance.

Orders and services

What: What you bought, its price, status and renewal dates, and the name you gave it. What it delivered, such as codes, credentials and proxy lists. Settings you enter, such as nameservers, mailbox names, aliases and a VPS's SSH public key. For game, bot and web servers, a login on our server panel under your account's email or number. Mailbox passwords go straight to the email host, and the store does not keep them.
Why: To deliver, renew and support what you bought, and to show it in your account.
How long: No fixed period. Records stay after a service ends.

Texts to rented numbers

What: The number, and every text it receives while it is yours: sender, text, code and time. Texts from banks, payment apps, crypto exchanges and government services are held back and never stored, and only their count is kept.
Why: To show the texts on the number's page.
How long: No fixed period. They stay on your orders page after the number is released.

Swaps

What: The trade ID, the coins and amounts, the exchange with its deposit address and order reference, your payout and refund addresses, the status and times, and your account if you were logged in. Kept with each swap order you create: your IP address, your browser's user agent and the language list your browser sends. Looking at prices or getting quotes creates no swap record.
Why: To show the swap's page and follow its status. The exchanges require their partners to keep the IP address, user agent and language list for every order, to investigate fraud and follow their own rules.
How long: The IP address, user agent and language list: one year from the order, then deleted automatically. The rest: no fixed period.
Swap page: Anyone with the link to a swap's page can open it and see its amounts and addresses.

Abuse reports

What: The reporter's email, the target, the description and the evidence link.
Why: To act on the report and reply to the reporter.
How long: No fixed period.

Connection data

Cloudflare: Cloudflare sits in front of the whole site, so it sees your IP address and every request you make, under its own privacy policy.
Request log: Our web server logs each request: the time, the page address, the response, the referring page and your browser's user agent. Your IP address is not in it. Errors are logged in the same place, with the number of the order, service, deposit or swap involved. The log has a size limit and drops the oldest entries first. There is no fixed period.
Attempt counters: To slow down password guessing and spam, attempts are counted under a keyed one-way hash of your IP address. The counters expire within about an hour.
Country: The store reads the country Cloudflare reports for your connection, to refuse blocked countries and to choose swap exchanges. It is saved only at sign-up and with deposits.
Swap orders: Your IP address, user agent and language list are kept with each swap order for one year, as described under Swaps.

Cookies

sessionid: Keeps you logged in. Set when you log in or sign up, and lasts 14 days or until you log out.
csrftoken: Protects forms against forged submissions. Set on pages with a form, and lasts a year.
ref: Remembers the code from an invite link until you sign up. Lasts 30 days.
Cloudflare: Can set its own cookies to protect the site from attacks.

There are no analytics, tracking or advertising cookies.

Who receives data

Cloudflare: All traffic to the site. Email to support@foldoy.com passes through its email routing. Domain names you search for can be checked with its public DNS.
Email: Mail to support@foldoy.com is delivered to our mailbox at Google, and our replies are sent through Resend.
Swap exchanges: The exchange that runs your swap gets the coins, the amounts and your payout and refund addresses. When it asks, we give it the IP address, user agent and language list kept with its own orders. If a swap opens on the exchange's own website, that exchange collects what it needs under its own privacy policy.
Block explorers: Our server looks up each deposit address to see payments to it: Bitcoin on mempool.space and blockstream.info, Litecoin on litecoinspace.org and BlockCypher, and USDT on TronGrid. Payments on these networks are public.
Monero node: The store's view-only Monero wallet runs on our server and reads new blocks from a public Monero node, and a second node confirms a payment before it is credited. The nodes see our server asking for blocks and transactions. They never get the wallet's keys, so they cannot see who paid.
Suppliers: Only what they need. The domain registrar, Dynadot, gets the names you search for and register and the nameservers you set, and registers each domain in foldoy's name. The VPS host, Vultr, gets your SSH public key, server name, region and system. The email host gets your domain, mailbox names, passwords and aliases, and stores your mail. Phone-number, proxy and gift card suppliers get the product and, at most, a country and an order reference. Traffic you send through a proxy passes through its supplier's network.
Card payments: If card payments are offered, Stripe takes the payment and sees your name and card details.
Authorities: When the law requires us to share.

What we never ask for

Identity: No names, postal addresses or ID documents. An exchange can ask for ID under its own terms if its checks flag a swap.
Wallet keys: No wallet keys or seed phrases. The store's deposit wallets are watch-only on the server, and swapped coins go straight to the exchange.

Selling and tracking

We do not sell data or use it for advertising. The site runs no analytics, tracking or advertising scripts.

Your rights

Anyone can ask for a copy of the data we hold about them, or ask us to correct or delete it. Write to support@foldoy.com. We may ask you to show that the account or swap is yours.

You can change your email and delete your account yourself in Security settings

Some records stay after a deletion: the balance entries behind every account, and the swap records the exchanges require us to keep

In the EU or the UK, you can also complain to your data protection authority

Changes and contact

The date at the top shows when this page last changed. Questions: support@foldoy.com.