CNRFLDPrivacy Policy
Last updated 28 October 2026
In short: CNRFLD has no accounts and asks for no personal details. Your library stays on your device unless you turn on sync. There are no ads, no analytics and no tracking, and nothing is sold or shared for marketing.
This policy covers the CNRFLD apps for iPhone, iPad and Android, and the sync service behind them. CNRFLD is provided by [YOUR NAME OR COMPANY] (“we”, “us”), who is responsible for the information described here. Questions go to hello@cnrfld.app.
On your device
Everything you keep in CNRFLD is stored in the app on your device: the links you save (address, title, description, the addresses of its image and icon, the site’s name, and your note), when you saved and opened them, Up next, your tags, the sites you follow and their recent posts, the activity log and your settings. You can export it as a backup file at any time.
If your device’s own backup is on (iCloud Backup, or Android’s backup to Google), it may include the app’s data. Those backups are kept by Apple or Google under their terms, not by us.
Requests the app makes
Some features need the internet. These requests go straight from your device, not through us:
- Sites you save or follow. To show a title and picture for a link, the app fetches that page, and to show a site’s posts it fetches its feed, much as a browser would. Those sites see your device’s IP address and the request, as with any visit.
- App updates. The app checks Expo’s update service (run by 650 Industries, Inc.) for small updates to CNRFLD itself. The check includes the app’s version, the platform and your IP address, and nothing from your library.
Sync (optional)
Sync is off until you turn it on. With it on, your devices share one library through our server, which runs on Cloudflare. It stores:
| What | Why | How long |
|---|---|---|
| Your synced library: links, notes, tags and followed sites, including a record of what was deleted | So each of your devices has the same library | Until you delete the synced library |
| Your devices: the name each device gives itself (for example “Alex’s iPhone”, which may include your name), its platform, when it was linked and last synced | So you can see and remove linked devices, and send links to one | Until the library is deleted; removed devices go 90 days after removal |
| Device keys, linking codes, invites and restore keys, stored only in a scrambled (hashed) form | To check that a request comes from one of your devices | Codes expire within minutes and go a day later; used or expired invites and restore keys go after 30 days |
| A scrambled (hashed) form of your IP address, with a count of recent requests | To limit abuse, such as guessing codes | A day |
Nothing on the server identifies you: there’s no name, email address or phone number. Your synced library is encrypted while it travels and while stored on Cloudflare’s servers, but not end to end, so in principle it could be read by us or by Cloudflare. We don’t look at it except to fix a problem you’ve reported, and we never use it for anything else. Cloudflare also keeps short-lived technical logs of requests (such as times, addresses and errors) to run its service.
Restore. If you turn on restore, the app saves a restore key in your iCloud Keychain or Google’s Block Store, so a reinstalled app or a new phone can rejoin your library. Apple or Google keep that key under their terms; we keep only its hashed form.
Camera and Face ID
The camera is used only to scan QR codes while the scanner is open; no pictures are kept or sent. Face ID, Touch ID and fingerprint unlock are handled by your device, which tells the app only whether it succeeded.
Why we use it
We use this information only to provide the features you choose (UK GDPR Article 6(1)(b), performing our agreement with you) and to keep the service secure and working (Article 6(1)(f), our legitimate interest in protecting it).
Who else handles it
- Cloudflare, Inc. hosts the sync service and this website.
- Apple and Google store restore keys, if you turn restore on, and distribute the app.
- 650 Industries, Inc. (Expo) delivers app updates.
Some of these companies process data outside the UK, including in the United States, under the safeguards the law requires, such as standard contractual clauses. We don’t share your information with anyone else, unless the law requires it.
Deleting your data
- Turn off sync (Settings › Sync) to unlink a device. Its copy of the library stays on it.
- Delete synced library removes the library from our server for every device at once. The rest of its records (devices, keys and invites) go within 30 days.
- Remove a device from another device’s list to unlink it.
- Delete the app to remove everything on that device.
As we can’t tell who you are, we can’t find a library for you by name. To act on your rights, use the options above in the app, or write to us from a device in the library and we’ll help.
Your rights
You can ask to see, correct, delete or move your information, or object to how we use it. If you’re unhappy with how we’ve handled it, you can complain to the Information Commissioner’s Office (ico.org.uk) or your local data protection authority.
Children
CNRFLD isn’t aimed at children under 13, and we don’t knowingly collect information from them.
Changes
If we change this policy, we’ll update it here and change the date above. For a significant change, such as collecting something new, we’ll also say so in the app before it takes effect.