Privacy policy

01 · Who we are

ReviewFold is operated by INFINITE FLOW COMPANY LIMITED, a Hong Kong company ("we", "us"). This policy covers reviewfold.com and the ReviewFold service. Public information pages do not require an account.

02 · Information we collect

• Account information: email address, name where supplied, account identifier, email verification status and, if provided by your sign-in provider, a profile image URL. Email/password accounts store a password hash, not the password in readable form. Social sign-in also supplies a provider-specific account identifier.
• Sign-in and security information: session identifiers, sign-in IP address, browser user agent, verification or recovery tokens and request counters used to prevent abuse. Our infrastructure providers also process connection and security logs.
• Analysis information: the app store link and storefront you select, collection settings, public review text, review identifiers and metadata (such as reviewer display name, rating and date where available), generated reports and processing records.
• App tracking (where enabled): the app and storefront you follow, whether it is your own app or a competitor, your weekly email preference, collected public reviews, category definitions, update results and weekly email delivery records. Public review collection and categories for the same app/storefront may be shared across subscribers; your account and tracking preferences are not shared.
• Payments. When you subscribe, PayPal processes your payment. We receive your PayPal subscription and transaction identifiers, payment status, amounts and dates, so we can provide your plan, handle refunds and keep required records. We do not receive or store your full card or bank details. PayPal's own privacy statement applies to the information you give PayPal.
• Support messages: your email address and information you choose to include when contacting us. Please do not send passwords, access tokens or unnecessary sensitive information.

Account data is required to create and maintain an account. You can choose email/password instead of social sign-in. Declining required account information prevents account creation. Store links and review data are needed to perform the requested analysis.

03 · How we use information

We use this information to authenticate users, verify email addresses, recover accounts, operate review collection and reporting, preserve analysis results, answer support requests, troubleshoot failures and protect against misuse. We may review relevant records to resolve a support or security issue and meet legal obligations.

We do not sell personal information, build advertising profiles or send marketing email through account verification and password recovery messages. We do not use Google sign-in information to train AI models.

Where App tracking is enabled, we use the selected public reviews to update categories about once a day and send a weekly summary when you have enabled weekly emails. You can disable weekly emails without stopping tracking, or stop tracking from App tracking. This does not cancel your subscription. The confirmation link in an email only controls weekly emails for that tracking entry.

04 · Google and Apple sign-in

Google: when you choose Sign in with Google, we request basic identity permissions (openid, email and profile). We use your Google account identifier, email, verification status and available profile information to create or find your ReviewFold account. We do not request Gmail, Drive, Calendar or other Google content. Google tokens are used during authentication and are not retained in our account database. Your Google identity information is stored with our hosting provider for account operation; it is not sent to our review-analysis model provider.

ReviewFold's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including applicable Limited Use requirements.

Apple: when you choose Sign in with Apple, Apple provides an account identifier and may provide your name and email. If you choose Hide My Email, we receive the relay address rather than your personal email. Apple authorization tokens are stored encrypted for account integration and potential authorization revocation. Apple sign-in is under testing and is not yet fully validated.

Your Google or Apple password is entered with that provider, never into ReviewFold. Their own privacy policies apply to the information they process.

05 · Service providers and international processing

We use these providers for specific service functions:

• Cloudflare: website hosting, database storage, analysis execution, access control and connection security.
• Resend: delivery of account verification, recovery, subscription confirmation and enabled weekly tracking emails. It receives your email address and the message, including any account or weekly-email management link.
• PayPal: subscription payment processing and refunds.
• Feishu: our company email and support correspondence, including account or privacy requests you send us.
• Google and Apple: authentication when you choose the corresponding sign-in method.
• Xiaomi MiMo: semantic analysis, tracking review categorization and wording of reports. Review titles, bodies, ratings and temporary reference identifiers may be sent to its API. The current analysis pipeline does not send ReviewFold account details or separate reviewer-name fields, but public review text can itself contain personal information.

Service data may be processed outside Hong Kong through these providers' infrastructure. We do not restrict all processing to Hong Kong or guarantee a particular storage location. Provider processing and retention are also governed by their service terms and policies; we do not claim that every provider has a zero-retention or no-training arrangement.

We may disclose information where necessary to comply with law or protect the service and users. We do not make saved reports publicly shareable through these information pages. Saved reports are subject to account ownership and access controls.

06 · Cookies and security

We use essential cookies and browser storage for authentication, access control, returning to a report and remembering interface choices. We do not currently install advertising or third-party behavioral analytics cookies. Blocking essential cookies may prevent sign-in or protected access.

We use HTTPS, account access controls, password hashing and encrypted Apple tokens. Access to operational data is limited to people and providers who need it for the service. No storage or transmission method can guarantee absolute security.

07 · How long we keep information

We retain account information while the account is maintained and analysis records while they are needed to provide saved reports. Accounts and reports are not automatically deleted after a fixed number of days. Account sessions expire after 30 days unless renewed; verification and recovery links have shorter expiry periods. Expiry of a session or link does not itself erase the related account.

For App tracking, routine cleanup removes review records older than the 90-day review window and weekly snapshots more than 90 days after creation. Current category definitions and their supporting examples may remain while the app is tracked. Monitoring-only processing records are cleaned up after 90 days once processing and cost settlement have completed; unresolved processing records can remain until resolved. Saved one-off reports are separate and do not inherit this 90-day monitoring window. Stopping your tracking does not erase shared public-source data still used by other subscribers. We stop collection when no eligible subscriber is tracking the source.

We review retention as the service develops and handle deletion requests through the contact below. Some information, including subscription and payment records, may need to be retained for security, unresolved requests, accounting, tax or other legal obligations. Provider-managed logs and backups can have separate retention schedules.

08 · Your choices and rights

You can request access to or correction of personal data we hold about you, and ask us to delete your account or applicable personal information, by emailing accounts@reviewfold.com. We may need to verify your identity before acting. We will explain any legal or technical limitation rather than promise deletion of data we do not control. There is currently no self-service account deletion page.

You can also withdraw Google or Apple authorization in your provider's account settings. Revoking that authorization does not automatically delete your ReviewFold account or saved data. A public reviewer can contact us about personal information in an analyzed review and identify the relevant app and review. We cannot remove the original review from the app store.

Your rights under applicable law, including Hong Kong's Personal Data (Privacy) Ordinance, are preserved. Hong Kong privacy complaints can be directed to the Office of the Privacy Commissioner for Personal Data. The service is intended for adult app professionals, not children.