Privacy policy

Folkswise helps families manage a loved one's mail, bills and paperwork, usually an aging parent, grandparent or spouse. That means we hold sensitive health and financial information. This policy explains, in plain English, what we collect, how we use it, and the choices you have.

What we collect

• Account details: your email address and, if you choose one, a password (stored only as a secure hash by our login provider).
• Family details: your family name, your parent's name, state and types of insurance, and the email addresses of family members you invite.
• Documents: photos, PDFs and emails you send us, such as bills, Medicare notices and insurance statements, and the information we read from them (for example sender, amounts, due dates and line items).
• Medicare claims (only if you connect Medicare): with permission given at Medicare.gov, we receive your parent's Original Medicare claims from Medicare, and, if you allow it, basic profile details. We collect them about once a day for as long as the connection is active (about 13 months, then you can renew). We use them only to check your parent's bills. Access keys are stored encrypted, and we never see or store Medicare.gov login details. To show provider names, we look up provider ID numbers (never patient information) in CMS's public NPI Registry.
• Billing: your plan and subscription status. Card details are handled by Stripe; we never see or store your full card number.
• Free tool: if you use “Explain my bill” without an account, we keep your email address and the type of document. The file itself is read once and not stored.
• Basic technical data: standard server logs needed to run and secure the service. We do not put document contents in logs.

How we use it

• To read, sort and check your documents, track deadlines, draft letters you choose to send, and send your family a weekly summary.
• To run your account, take payment, provide support and keep the service secure.
• To send product updates and tips by email, which you can unsubscribe from at any time.

We never sell your data, never use it for advertising, and never share it with anyone except the service providers below, who process it only to run Folkswise. We don't share it with anyone else unless you give specific, explicit consent or the law requires it.

De-identified data: we may use counts and measurements that can't identify anyone (for example, how often our reading of a dollar amount was correct) to improve the service. We don't sell or share de-identified data, and we don't try to re-identify it.

AI processing

We use Anthropic's Claude API to read documents and draft letters. Documents are sent to Anthropic over an encrypted connection only to produce the result you asked for. Under Anthropic's commercial terms, API data is not used to train its models. AI can misread documents, so every result shows its confidence, and you make the final decision on anything you pay, sign or send.

Who processes your data for us

• Supabase: database, login and encrypted file storage.
• Anthropic: AI reading and letter drafting.
• Stripe: payments.
• Postmark: receiving forwarded mail and sending our emails.
• Vercel: hosting the website.

Each provider is bound by contract to protect your data, use it only to provide its service to us, and not to use it for its own purposes.

Who in your family can see what

Everything your family adds is visible only to members of that family. Owners and siblings can add and edit; viewers can only look. Owners decide who is invited and can remove members at any time. Files are kept in private storage and opened only through links that expire after one minute.

Security

Data is encrypted in transit and at rest. Access is restricted by database rules that we test automatically, staff access is limited to support you request and to double-checking documents whose numbers our automatic checks couldn't confirm, and we review access regularly.

If there's a breach: if we learn of a security breach affecting your information, we will email account owners without unreasonable delay (and within the time the law requires), explain what happened and what information was involved, and tell you the steps to take to protect yourself, such as changing passwords or watching for suspicious Medicare activity. We also notify regulators where required, including under the FTC Health Breach Notification Rule.

Keeping and deleting data

We keep your family's data while your account is open. You can delete documents at any time. If you close your account, or ask us to, we delete your family's documents and data within 30 days, except records we must keep by law (such as payment records). Free-tool emails are kept until you unsubscribe or ask us to delete them.

Disconnecting Medicare: when you disconnect Medicare (or the permission expires), we stop collecting claims and delete our access keys right away. When you disconnect, you can also choose to have the Medicare claims we already received securely and completely deleted; otherwise they stay with your family's other records until you delete them or close your account.

Dormant accounts: if a family's subscription has ended and no one has signed in for 12 months, we email the owners, and if no one responds within 30 days, we securely delete the family's data.

Your choices and rights

You can see, download, correct or delete your information, and opt out of marketing email, at any time. Depending on where you live (for example California, Washington or other states with consumer or health-privacy laws), you may have additional rights. We honor these requests for everyone. Email hellofolkswise@gmail.com.

Permission to manage a parent's paperwork

By adding a parent's documents you confirm that you have their permission, a power of attorney, or other legal authority to help manage their affairs.

If Folkswise is sold

If our company is sold or merged and your data would move to a new owner, we will email account owners before it happens. Any change in how your data is used would require your consent, and you can delete your data before the transfer.

Children

Folkswise is for adults. We don't knowingly collect information from anyone under 18.

Changes

If we change this policy in a way that matters, we'll email account owners before it takes effect, explain what changed, and give you the chance to update your settings, disconnect Medicare, or close your account.

Contact

Questions or requests: hellofolkswise@gmail.com