Privacy
Foldnano is local-first. Your designs are stored in your own browser and are never uploaded to a Foldnano server. There is no tracking, no advertising, and no user accounts. We only count visits anonymously, so we can report how widely Foldnano is used to the agencies that fund it.
Where your designs are stored
- In this browser. Designs are saved in your browser's IndexedDB storage on
this device. Foldnano has no server-side document store, so we cannot see, recover, or
delete your designs. Clearing this site's data in your browser deletes them, so export a
.fn.jsonfile for anything important. - On GitHub, only if you choose. If you connect a GitHub account and sync or publish a design, it is stored in the repository you select, under GitHub's privacy statement. GitHub may process data outside the EU. Check whether the target repository is private or public before syncing.
- In files you export. Downloads (Foldnano JSON, cadnano, oxDNA, mrDNA, and others) go wherever you save them.
Cookies and browser storage
Foldnano only stores what is strictly necessary to provide the features you use, so it does not ask for cookie consent. No cookies are used for statistics or advertising.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| foldnano_alpha_access | Cookie | Remembers that you entered a valid access code during testing. | 30 days |
| foldnano_privacy_notice | Cookie | Remembers that you dismissed the privacy notice. | 1 year |
| foldnano_workspace_help | Cookie | Remembers that you closed the workspace help, so it does not open by itself on later visits. | 1 year |
| foldnano_browser_notice | Cookie | Remembers that you dismissed the notice recommending a Chromium-based browser (shown only in other browsers). | 1 year |
| gh_oauth_state | Cookie | Protects the GitHub sign-in against forged requests. Set only when you connect GitHub. | 10 minutes |
| gh_token | Cookie | Holds your GitHub access token so the app can read and write the repositories you choose. Not readable by page scripts. | 8 hours, or until you disconnect |
| Foldnano database | IndexedDB | Your working copies of designs, editor layout, installed plugins, and GitHub sync metadata. | Until you delete it or clear site data |
Anonymous usage statistics
We use Vercel Web Analytics to count page views and visitors. It sets no cookies and stores nothing in your browser. Each page view records only the page address, referring site, country or region, browser, operating system, and device type. A visitor is recognised by a hash of the request that is discarded after 24 hours, and results are only available to us as totals.
Before anything is sent, Foldnano removes document identifiers and all query parameters from
the page address, so an editor visit is recorded as /editor/[docId]. Your design
content, file names, and GitHub data are never part of these statistics.
Services your browser contacts
None of these receive your designs. Like any website request, they receive your IP address and browser details.
- Vercel. The app is hosted on Vercel, which keeps short-lived technical request logs (IP address, time, requested page) for security and operation, and receives the anonymous statistics described above.
- jsDelivr CDN. When you run a Python plugin or Script Lab, the Python
runtime (Pyodide) is downloaded from
cdn.jsdelivr.net. Your design stays in your browser; the plugin runs locally. - GitHub. Only after you connect GitHub. Requests pass through Foldnano's API proxy so your access token never reaches page scripts; the proxy does not store your files.
- Plugin sources. Installing a plugin from a URL downloads it from that address. Plugins are independent projects with their own terms.
Legal basis and your rights
Request logs, the necessary cookies above, and the anonymous usage statistics are processed on the basis of our legitimate interest in operating a secure service and reporting its use to research funders (GDPR Art. 6(1)(f)). GitHub data is processed only to perform the sync you request (Art. 6(1)(b)). You have the right to access, correct, or erase personal data we hold, to object to processing, and to lodge a complaint with a supervisory authority; in Belgium this is the Data Protection Authority.
Contact
Controller: Prof. Xin Shi, Department of Chemistry, KU Leuven.
Questions or requests: privacy-contact@example.org.
Last updated 2026-09-30.