Privacy Policy

Last updated: September 16, 2026

This policy describes what information NoFold collects, why, and what we do (and don’t do) with it. It applies to the NoFold website at trynofold.com and the NoFold browser extension.

1. What NoFold is

NoFold is digital self-control software: a website account and a companion browser extension that let you commit to blocking specific websites, including a dedicated, permanent commitment type for pornography. You choose the sites and the commitment category; the extension enforces the block in your browser.

NoFold is not medical treatment, addiction treatment, therapy, a diagnosis, or a guarantee of recovery. It is a tool for following through on a website-blocking commitment you make for yourself.

2. Information we collect

• Account email and password, when you create a NoFold account. Your password is never visible to us in plain text — it is handled entirely by our authentication infrastructure (Supabase Auth).
• The websites you choose to commit to blocking, and the protection category you select for each (Pornography, Social, or Custom), when you create a commitment.
• Timestamps and status for each commitment (when it was created, whether it is active, its minimum-duration and review-eligibility dates), so we can enforce the commitment terms you agreed to.
• A scoped browser-extension connection credential, when you connect the extension to your account. See §5.

3. Information we do not collect

NoFold does not collect: your browsing history, the URLs or pages you visit, page content, search history, screenshots, keystrokes, an advertising identifier, or any log of sites you attempted to visit while blocked. The browser extension does not use Chrome’s tabs, history, or webRequest permissions, and has no way to observe what you do in your browser beyond enforcing the block list you gave it.

A note on network infrastructure: like any web service, the ordinary operation of our servers and our infrastructure providers necessarily processes standard connection information (such as IP addresses) as part of routing and securing HTTPS requests. NoFold does not intentionally use IP addresses to build browsing profiles or track your browsing behavior, and no NoFold application code reads, stores, or acts on IP address data. We cannot promise that no infrastructure or hosting provider ever processes this kind of ordinary network metadata — that is a standard feature of how the internet works, not something NoFold asks for or uses.

4. How we use information

• Account email and password — creating and authenticating your account.
• Website commitment (domain + category) — enforcing the specific protection you chose.
• Commitment timestamps and status — enforcing the minimum commitment duration and review-eligibility rules you agreed to.
• Extension connection credential — authenticating the browser extension’s read-only sync of your committed sites.

We do not use your information for any purpose beyond what is listed here. We do not run analytics, behavioral profiling, or generic “improve our services” data mining on your account or commitment data.

5. Browser extension data

The NoFold browser extension connects to your account using a scoped connection credential generated from your account — never your NoFold account password, and never a full account session.

That credential is stored only in your browser’s own local extension storage. It is used solely to authenticate a read-only request for your current list of committed domains, which the extension then uses to configure your browser’s built-in site-blocking rules. The extension does not send us your browsing activity, and it does not cache or store the domain list itself beyond what your browser’s blocking engine needs to enforce it.

The extension locally remembers only whether it is connected and the time of its last successful sync — both stay on your device and are never sent to us. If your account uses the optional Hard Mode Browser Lock setup, the extension may also read a small managed-policy configuration flag (whether Browser Lock was set up, and its version) from Chrome’s own enterprise policy system — this is local Chrome configuration data, not something NoFold transmits or receives from our servers.

NoFold’s use and transfer of information received through the Chrome extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

6. Website protection commitments

When you create a commitment, we store the domain you entered (sanitized to a plain hostname — never a full URL, path, or query string) and the category you chose. We use this only to enforce the protection you asked for.

Hard Mode commitments do not have a self-service “unblock” button. Pornography commitments are permanent. Social and Custom commitments have a minimum commitment duration before a future accountability-review process can even begin. This is a deliberate product design, not a data practice we can adjust per request.

We do not publish, share, or advertise using the specific domains you commit to protect. We do not use them to build a behavioral profile of you, and we do not log actual visits or visit attempts to those domains.

7. Service providers

• Supabase — account authentication and database infrastructure. Supabase processes your account and commitment data on our behalf, as our infrastructure provider — it does not use your data for its own independent purposes.
• Netlify — hosting for the NoFold website (trynofold.com).

We do not use any third-party analytics, advertising, or tracking service.

8. Data sharing and advertising

We do not sell your personal information. We do not share it with advertisers, data brokers, or any third party for their own marketing or advertising purposes. We do not run advertising of any kind, and we do not use your data for targeted or interest-based advertising, ours or anyone else’s.

We share information only with the service providers described in §7, who process it on our behalf to operate NoFold, and only where required by law.

9. Data retention

We keep your account and commitment data for as long as your account exists. Because Hard Mode commitments are designed not to be self-service-unblockable, commitment records persist for the duration of the commitment even if you no longer wish to be protected from a specific site — that is the product working as intended, not a data practice separate from the product. Our infrastructure providers may retain limited technical backup copies of data for a short period after deletion, as part of their own standard operations.

10. Account deletion

You can delete your NoFold account yourself, at any time, from Account Settings in the dashboard. Deleting your account requires confirming your password and typing a confirmation phrase, and permanently removes your account and account-linked records — including your commitments and your extension connection credential — from our database. This cannot be undone.

Account deletion is separate from, and does not undo, the commitment terms described in §6. Deleting your account stops future enforcement and removes your data, but it is not a substitute for, or a way around, an individual commitment’s unblock terms while your account exists. Account deletion also cannot be used to remove a single commitment while keeping the rest of your account — it removes the whole account.

Browser extension cleanup after deletion: the browser extension enforces commitments independently of your website session, using its own separately issued connection credential. After your account is deleted, that credential stops working. An extension that is online at the time learns this the next time it checks in with our server (this happens automatically, at least every 15 minutes) and then removes its NoFold-managed blocking rules and its stored credential. An extension installation that is offline at the time of deletion keeps enforcing its last-synced rules until it reconnects — we do not claim instantaneous cleanup of a device that is offline.

11. Security

We use several technical safeguards, including:

• Row-level security policies on our database tables, so your data is only ever readable by your own account.
• A scoped, purpose-built credential for the browser extension — never your account password, and never a general-purpose account session.
• Only a one-way cryptographic hash of your extension connection credential is ever stored on our servers — the credential itself is shown to you once and cannot be recovered from our database afterward.
• Encrypted connections (HTTPS/TLS) for all communication with our servers.
• The browser extension requests the minimum browser permissions it needs to function, and nothing more.
• Website-blocking rules are enforced by our server, not decided by the extension on its own.

No security measure is perfect, and we do not claim NoFold is unhackable or guaranteed secure. We describe our actual safeguards honestly rather than making absolute promises.

12. Your choices

You can choose what domains and categories to commit to, and you can choose not to connect the browser extension at all (the website account functions without it, though enforcement then depends on you manually avoiding committed sites). You can request account deletion (§10).

13. Age requirement

NoFold is intended for users age 13 and older. Users under 13 may not create a NoFold account or use NoFold.

We do not knowingly collect personal information from anyone under 13. NoFold has one account model for every user — there are no separate parent, guardian, or child accounts, no parental-monitoring feature, and no age-verification system. If you believe a NoFold account belongs to someone under 13, contact us (§15) and we will look into it.

Privacy requirements for users under 18 vary by jurisdiction. We have not completed a jurisdiction-by-jurisdiction legal review of those requirements; this section will be updated if that changes. As noted at the end of this page, nothing here is legal advice or a claim of certified regulatory compliance.

14. Changes to this policy

If we make material changes to this policy, we will update the “Last updated” date above.

15. Contact us

Email trynofold@gmail.com, or see the Support page.

This page describes NoFold’s actual current data practices. It is not a statement of legal compliance with any specific regulation.