Korfi Privacy Policy

1. Controller and contact

1.1The controller of your data is Artur Witoś, a sole trader, address: Wólka Zatorska 16, 07-217 Wólka Zatorska, Poland, NIP: 5681625642, REGON: 386254514, entered in the Central Register and Information on Economic Activity (CEIDG) (“Korfi” or “we”). Contact on personal data matters: hello@korfi.app. [TO BE DECIDED: whether a data protection officer must be appointed (Article 37 GDPR); we assumed not]

1.2Our role regarding file contents. We process the contents of your files only to provide the Service at your instruction. We do not use them for advertising, profiling or training models. [TO BE DECIDED: how to classify Korfi’s role regarding file contents: controller or processor. For private users we assumed that Korfi is the controller of Account data and technical data and processes file contents on the user’s instruction. Business users who are controllers of the data in their files conclude a data processing agreement (DPA)]

1.3Paddle as an independent controller. Payments for paid Plans are handled by Paddle as the seller (Merchant of Record). Paddle is a separate, independent controller of payment and purchase data, not our processor: it determines the purposes and means of processing that data on its own. Its rules are described in the Paddle privacy policy. You exercise your rights regarding that data against Paddle (privacy@paddle.com, preferences.paddle.com).

1.4For people without an Account (recipients of Share Links, people who send through Buckets or by email to an Inbox, people who report abuse) we are the controller of the data to the extent described in section 3.

2. In brief

• You sign in with an email address and a code, with no passwords. From your Account we know your email address, file and folder names and metadata, your list of devices, and the technical data needed for operation and security.
• In Standard folders the server sees the contents of files and may process them (search, OCR). In Private and Vault folders the contents are encrypted end-to-end on your Mac: the server sees only ciphertext, names and metadata.
• We keep files in Cloudflare R2 under EU jurisdiction. Some processing (the Cloudflare network, the AI Assistant) may also take place outside the EEA, on the safeguards described in section 6.
• The AI Assistant uses Claude by Anthropic. Korfi does not store the contents of prompts or replies, only usage metadata.
• Paddle handles payments as an independent controller. We do not see your card number.
• There is no advertising, profiling or sale of data. The Website uses no cookies or analytics.
• You can download your data (a JSON export), delete your Account (after a 30-day cooling-off period) and lodge a complaint with the President of the Personal Data Protection Office (UODO).

3. What data we process and where it comes from

Account and sign-in

Account data

email address, Account identifier, status (active or blocked), storage limit, creation date, information about the invitation used (the code only as a hash, an administrator’s note), the version and date of acceptance of the Terms, notification settings. Source: you and Korfi (invitation, limits).

Sign-in and security

one-time codes (only as HMAC hashes, with the number of attempts and the validity time), a TOTP secret (encrypted), backup codes (only hashes), passkeys (public key, credential identifier, use counter, authenticator type, key name, dates), temporary passkey requests (hashes), notifications about a passkey being added, action confirmation codes (hashes). Source: you and your devices.

Sessions and devices

a hash of the session token, the device name (the computer name set in macOS, which may contain your name), a public session identifier, the dates of creation, last use and expiry (a session lasts up to 90 days), revocation status, the time of the last confirmation of a critical action, second-factor error counters. We do not store an IP address or browser name in the session record. Source: the App.

Files and their contents

File and folder metadata

names (also in Private and Vault folders), folder structure, size, MIME type, dates, privacy level, the Protected mark, the Archive area and the end of the lock, description, status, version history (planned, with the name of the uploading device), the SHA-256 hash (only for unencrypted files, for duplicate detection). Source: you and the App.

Keys

the key of each encrypted file, stored wrapped with the master key, and the master key wrapped with your Recovery Key. We have no way to unwrap them. Source: the App.

Contents of Standard files

we store them in Cloudflare R2 under EU jurisdiction (Cloudflare encrypts data at rest). The server may process them for the features you use. Source: you, and also people who send through Buckets or by email to an Inbox.

Contents of Private and Vault files

we store only ciphertext. The server does not have the key to read it. Source: the App.

Extracted text and search index

in Standard folders: text from files (when you upload, the App extracts it from PDFs with a text layer and from text files; planned: server-side text extraction and OCR, vectors for search by meaning, and automatic descriptions and tags) is stored in the search index, always separately for each Account. In Private folders, text, OCR and tags are computed locally on the Mac, and only an encrypted extract reaches the server. In Vaults we do not process contents at all.

Third-party data in files

your files may contain other people’s data, including special categories of data (for example medical documents). We do not require it and do not analyse it for any purpose other than the features you use. For the most sensitive documents we recommend a Private folder or a Vault. You are responsible for the legal basis on which you store such data.

AI Assistant

Prompts and replies

what you write to the Assistant, its replies and the file excerpts the Assistant retrieves at your instruction pass through Korfi’s Worker and Cloudflare AI Gateway to Anthropic. Korfi does not store them: each call carries a header that turns off content logging in AI Gateway and skips the gateway cache. The contents do not reach our database or logs.

Usage metadata

for each call we store the Account identifier, the requested and served model, token counts, cost, the stop reason, whether usage was estimated, and the time. To Anthropic we send not the Account identifier but a pseudonymous hash (HMAC); to AI Gateway we pass metadata with the Account identifier for billing. Usage data is visible to the Korfi administrator.

Anthropic

processes the contents of calls under its own terms. It publicly states that it deletes API data from its systems within 30 days, with exceptions (for example, longer where its usage policy has been breached). [TO BE DECIDED: confirm in the agreement with Anthropic the retention of API data and that it is not used for training]

Share Links, Buckets and the Inbox (third parties)

Share Links

the link identifier (stored as a hash), the link to the file, mode, expiry date, download limit and counter, the password hash (PBKDF2 with a salt and a pepper), counters of failed attempts and lock-outs. To limit password guessing we store events of failed attempts marked with an HMAC hash of the IP address, not the raw IP address, for no longer than an hour. The recipient of a link does not create an Account. Their IP address is technically visible to Cloudflare as the network provider.

Buckets (planned)

files sent by people without an Account, their names, sizes and the time of sending, the Bucket’s title, an optional name the sender gives, and the data they include in the file. We do not require them to have an Account. The owner of the Bucket decides what data to accept. [TO BE DECIDED: the fields of the Bucket form; a description of Cloudflare Turnstile once deployed (an invisible captcha on Bucket pages and link password pages)]

Inbox email (planned)

the sender’s address, the subject, the time, the outcome (accepted, sender rejected, no attachments, limit or size exceeded, error) and the number of files stored, the list of senders you have added, the alias, and attachments from messages accepted into the “Inbox” Folder. We reject messages from unauthorised senders. [TO BE DECIDED: whether we store the body of messages other than attachments; the retention period for Inbox logs is in the section on retention]

Payments, communication and reports

Payments

payment and purchase data (name, email address, country, billing address, VAT number, payment method) is collected and processed by Paddle as an independent controller. From Paddle we receive only the information needed to provide the Service, for example the customer and subscription identifiers, the Plan purchased, status, dates and email address. We do not see the card number. [TO BE DECIDED: the exact list of fields received from Paddle (webhooks) once payments are deployed]

Communication

emails sent from the korfi.app domain through Cloudflare Email Sending (sign-in and confirmation codes, security notifications, moderation decisions, informational notifications) and the correspondence you send us.

Invitation requests (planned)

an email address, an optional note (up to 500 characters), the language, the status of the request and an HMAC hash of the IP address used to limit abuse of the form. Source: you, through the “Request an invitation” form.

Abuse reports

the reporter’s data (name, email), the description and identification of the content, our correspondence, decisions and preserved evidence (metadata and, where necessary, a copy of the blocked content).

Administrator audit log

the administrator’s actions on accounts and invitations (the administrator’s email address, the action, the target identifier, details, time). The administrator panel shows the email address, storage used, limit, AI usage and Account status; it does not show file contents.

Technical data and your device

Technical data

our Workers record only error messages, without file contents, the contents of AI prompts or codes. Cloudflare, as the network and security provider, processes IP addresses and request headers in its own logs. [TO BE DECIDED: confirm the Workers logs (observability) configuration and the retention period of Cloudflare logs]

The App on your Mac

the session token and, once encryption is turned on, the master key sit in the macOS Keychain on your computer. File previews and the local index of Private folders also stay on your device. We have no access to them. The App checks for updates at updates.korfi.app, sending the version, system and architecture.

The korfi.app Website

does not use cookies, analytics, or external fonts and scripts. The passkey page connects to our API only to finish an action you started in the App, and removes identifiers from the address before sending the request.

3.1Providing an email address is a condition of opening an Account. The remaining data results from the features you use. Without it, the feature will not work.

4. Purposes and legal bases

1. Account and provision of the Service

Running the Account, sign-in, storage, search, versions, sharing, Buckets and the Inbox. Basis: Article 6(1)(b) GDPR (performance of a contract).

2. Features operating on the contents of Standard Files

Text extraction, OCR, search index, descriptions and tags (planned). Basis: Article 6(1)(b) GDPR, to the extent of the features you run or turn on.

3. AI Assistant

Carrying out your instruction (Article 6(1)(b) GDPR). Billing of usage, control of costs and abuse: Article 6(1)(f) GDPR (our interest in covering costs and protecting the Service).

4. Security

Two-step sign-in, passkeys, attempt limits, abuse detection, account isolation, audit log. Basis: Article 6(1)(f) GDPR (the interest in the security of the Service and its users) and the security obligation under Article 32 GDPR.

5. Link recipients, and people sending to Buckets and the Inbox

Enabling a feature chosen by the User and protecting against abuse. Basis: Article 6(1)(f) GDPR. The Account owner is, as a rule, the controller of the data they accept.

6. Communication and support

Codes, security notifications, informational notifications (which you can turn off), replies to your messages. Basis: Article 6(1)(b) and (f) GDPR.

7. Billing

Handling information about Plans and subscription status (Article 6(1)(b) GDPR) and keeping accounting and tax records (Article 6(1)(c) GDPR). Payments and purchase data are processed by Paddle as an independent controller on its own bases.

8. Abuse reports and moderation

Receiving and assessing reports, restricting content and accounts, statements of reasons and appeals, preserving evidence for 90 days. Basis: Article 6(1)(c) GDPR (obligations under Regulation (EU) 2022/2065) and point (f) (protection of the Service and third parties). We process data on suspected offences only to the extent required by law (Article 10 GDPR). [TO BE DECIDED: the basis for processing data on offences and passing it to authorities (Article 10 GDPR, Article 18 DSA)]

9. Legal obligations and requests from authorities

Carrying out requests from courts, the prosecutor’s office, the police and other authorised authorities, tax and reporting obligations. Basis: Article 6(1)(c) GDPR.

10. Claims and evidence

Establishing, exercising and defending claims, protecting rights. Basis: Article 6(1)(f) GDPR (our interest in defending against claims).

11. Development and statistics

Aggregated data on usage, costs and errors, without tracking behaviour on the Website. Basis: Article 6(1)(f) GDPR.

12. Invitation requests

Handling an invitation request and protecting the form against abuse. Basis: Article 6(1)(b) GDPR (steps taken at the person’s request before entering into a contract) and point (f).

4.1Where we rely on a legitimate interest, you may object (section 8). We do not send marketing messages. If we start to, we will do so only with your consent (Article 6(1)(a) GDPR), and you will be able to withdraw it at any time.

5. Recipients and processors

5.1We do not sell data or share it with advertisers. We pass data only to those entities we need to provide the Service, under agreements compliant with Article 28 GDPR, or to separate controllers where the service you choose works that way.

Cloudflare, Inc. and group companies (processor)

hosting and infrastructure: Workers (the code of the API and the Website), D1 (database), R2 (files, under EU jurisdiction), Email Sending and Email Routing (messages), AI Gateway (the proxy to AI models), network and DNS. Planned: queues, workflows, vector search, Workers AI, Durable Objects and Turnstile. Data processing agreement and list of sub-processors.

Anthropic, PBC (processor)

Claude models for the AI Assistant, only when you use it. Anthropic data processing agreement.

Paddle (independent controller)

the seller of paid Plans (Merchant of Record): payments, invoices, taxes, refunds, first-line billing support. Paddle privacy policy.

Advisers and service providers

lawyers, accountants and IT service providers, to the extent necessary and under confidentiality or processing agreements.

Public authorities

courts, the prosecutor’s office, the police and other authorities, where the law obliges us to (see the rules in the Terms, in the section on moderation).

People you share Files with

recipients of Share Links. You decide who you give a link to.

Legal successor

if another entity took over the Service, data could pass to it on the same terms. [TO BE DECIDED: whether to include this clause and how to inform users]

5.2Only authorised persons have access to data at Korfi, and only to the extent needed for their tasks.

6. Transfers outside the European Economic Area

6.1Files are stored in Cloudflare R2 under EU jurisdiction, which Cloudflare guarantees for the storage of objects. [TO BE DECIDED: confirm that the D1 database was created with EU jurisdiction. Jurisdiction cannot be changed after the database is created, and the configuration in the repository does not contain this setting for D1]

6.2This does not mean that all processing takes place exclusively in the EU. Cloudflare Workers run in a global network, close to the user, so API requests (including metadata and email addresses) may be handled in data centres outside the EEA as well. Requests to the AI Assistant are processed by Anthropic, which is based in the USA.

• Cloudflare, Inc. (USA). According to its data processing agreement, Cloudflare bases transfers of data from the EEA on certification under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), and where the certification does not apply, on standard contractual clauses (Decision (EU) 2021/914). [TO BE DECIDED: check Cloudflare’s current certification status on the DPF list]
• Anthropic, PBC (USA). The Anthropic data processing agreement bases transfers of data on standard contractual clauses (modules 2 and 3). We do not promise that AI processing takes place exclusively in the EU.
• Paddle. Paddle.com Market Limited (United Kingdom) and other Paddle group entities are responsible, as independent controllers, for their own transfers of data. Paddle states that it uses standard contractual clauses and other safeguards. [TO BE DECIDED: the status of the Commission’s adequacy decision for the United Kingdom]

6.3You can find copies of the standard contractual clauses in the providers’ public data processing agreements, and you can obtain information about the safeguards by writing to hello@korfi.app.

7. How long we keep data

7.1We keep data only for as long as needed for the purpose for which we collected it, or as the law requires. Below are the periods for each type of data.

8. Your rights

8.1You have the right to: access your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), object to processing based on a legitimate interest (Article 21), and withdraw consent if you have given it (Article 7(3)).

8.2Download my data. In the App you will find the “Download my data” function, which prepares a JSON export of your Account data: profile, the list of folders and file metadata, sessions, settings and AI usage. You download the Files themselves separately in the App. [TO BE DECIDED: the scope of the export and the availability of the function in the released version; until then, export on request at hello@korfi.app]

8.3Delete account. The “Delete account” function postpones deletion for 30 days, during which you can cancel it. After that period we delete the Account in full. Exceptions: Files in the Archive disappear when the lock ends, preserved evidence after the preservation is released, and copies of metadata in the database history up to 30 days after deletion (see the Terms, the section on termination of the contract).

8.4You exercise your rights by writing to hello@korfi.app. We will reply without undue delay and at the latest within a month (Article 12(3) GDPR; if necessary, we may extend this period by two months, informing you of that). We may ask you to confirm your identity.

8.5Limits resulting from encryption. We cannot read or hand over the contents of Files from Private and Vault folders, even at your request, and if you lose your Recovery Key we will not be able to recover them for you. For those files we respond as to metadata.

8.6Data at Paddle. You exercise your rights regarding payment and purchase data against Paddle (privacy@paddle.com, preferences.paddle.com). Third-party data in Buckets and files: if your data ended up in another User’s Bucket or file, address your request to that User; we will help within the limits of the law.

8.7You have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). Residents of other EU countries may contact the authority in their own country.

9. No profiling and no advertising

9.1We do not profile Users, run advertising or sell data. We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you (Article 22 GDPR). The AI Assistant does not classify or assess people.

9.2Decisions to restrict content or an Account as part of moderation are made by a person. If we ever use automated tools for this, we will describe them in the Terms.

10. Cookies and similar technologies

10.1The korfi.app Website does not use cookies or local storage for analytics, advertising or preferences, and does not load external scripts, fonts or tracking resources. The App keeps the session token in the macOS Keychain, which is not a cookie. [TO BE DECIDED: once Cloudflare Turnstile is deployed on Bucket pages and link password pages, describe what data it processes and whether it stores anything on the device (Article 399 of the Electronic Communications Law); check local storage in the App]

11. Email messages

• Transactional, always: sign-in and confirmation codes, Account security notifications (for example about a passkey being added), moderation decisions, information about changes to the Terms and Account deletion. They cannot be turned off, because they are necessary for the Service to work securely.
• Informational, can be turned off in settings: for example “link expires tomorrow”, “you are running out of space”, “new files in a Bucket”.
• Marketing: we do not send any.
• People outside Korfi: we do not send messages to recipients of Share Links, people sending through Buckets, or senders to an Inbox, or to addresses that Users indicate in the Service. The Inbox only receives messages.

12. Security

12.1We apply technical and organisational measures proportionate to the risk, in particular:

• end-to-end encryption of the contents of Private and Vault folders (XChaCha20-Poly1305, a separate key for each file, the master key in the Keychain);
• encryption of connections (HTTPS) and encryption of data at rest on the Cloudflare side;
• sign-in with an email code, optional 2FA (TOTP) and passkeys, confirmation of critical actions;
• account isolation: identity always taken from the session, every query for data limited to the Account, another person’s resource returns “not found”;
• short-lived, signed addresses for uploading and downloading Files (up to 15 minutes);
• attempt limits, hashes instead of raw codes and passwords, an administration panel behind Cloudflare Access with an audit log;
• a personal data breach response procedure, including notification of the President of UODO within 72 hours and notification of individuals where the law requires it.

12.2No system is completely secure. Take care to secure your Mac and email inbox, and your Recovery Key. Report a suspected incident to hello@korfi.app.

13. Children

13.1The Service is intended for people who are at least 16 years old. We do not knowingly collect data from people younger than that. If you think a child has opened an Account, write to us and we will delete it. You report content involving the exploitation of children at abuse@korfi.app.

14. Changes to this Policy

14.1We may change this Policy when the Service, the law or the way data is processed changes. We will notify you of material changes in advance by email or in the App, and we mark the current version with a date. We provide earlier versions on request.

14.2The Polish version is binding. The English version is a translation provided for convenience. The version of 25 October 2026 is a draft for legal review.