Third parties and fonts
Updated October 8, 2026. Folio loads its browser scripts and styles from its own origin, including appearance.css for system color preferences. It does not include third-party analytics, session replay or advertising pixels. No remote font service is used. Server services are listed separately below.
Browser scripts
Folio serves app.js, clubs.js, mobile-connect.js, public-page.js, legal-page.js, sw.js and offline-db.js itself. The iPhone build serves mobile.js inside the app. These bundles include the applicable packages listed below; the list also includes server and native packages so their scope is explicit.
| Package | Version declaration | Use |
|---|---|---|
| @capacitor/core | 8.5.3 | Bundled local app code or native runtime |
| @capacitor/ios | 8.5.3 | Bundled local app code or native runtime |
| @radix-ui/react-avatar | 1.2.7 | Bundled local app code or native runtime |
| @radix-ui/react-slot | 1.4.0 | Bundled local app code or native runtime |
| @x402/core | ^2.28.0 | Server payment/authentication code |
| @x402/evm | ^2.28.0 | Server payment/authentication code |
| class-variance-authority | 0.7.1 | Bundled local app code or native runtime |
| clsx | 2.1.1 | Bundled local app code or native runtime |
| jose | ^6.2.12 | Server payment/authentication code |
| lucide-react | 1.53.0 | Bundled local app code or native runtime |
| motion | 14.0.0 | Bundled local animation code; no external service or tracking |
| react | 19.3.0 | Bundled local app code or native runtime |
| react-dom | 19.3.0 | Bundled local app code or native runtime |
| tailwind-merge | 3.7.0 | Bundled local app code or native runtime |
| tw-animate-css | 1.4.0 | Bundled local app code or native runtime |
| viem | ^2.57.3 | Server payment/authentication code |
Native purchase SDK
RevenueCat purchases-ios 5.94.0 is linked through Swift Package Manager for App Store purchase validation and restoration. It receives billing data and the Folio account identifier; documents and audio are not sent to RevenueCat.
Fonts
The CSS declares local/system fallbacks: -apple-system, BlinkMacSystemFont, system-ui, system (a local Apple-font alias), Segoe UI, Roboto, Helvetica Neue, Noto Sans, Arial, Georgia, Times New Roman, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Noto Color Emoji, ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, Liberation Mono, Courier New, serif, sans-serif, monospace. A device uses the fonts available locally; none are downloaded from a font provider. Generated styles also include Tailwind's system and monospace fallback stacks.
Server and infrastructure services
- Cloudflare Workers, D1 and R2: app delivery, private account data, documents, generated audio, sync and operational request metadata.
- Google Accounts and Google OAuth/JWK endpoints: identity and verified email during sign-in; no embedded Google tracking script.
- Apple identity endpoints (appleid.apple.com): optional identity and verified email sign-in; no embedded Apple tracking script.
- Stripe API and hosted Checkout: purchase/subscription processing and payment details on Stripe's page.
- Resend API: transactional payment confirmation email delivery. No marketing email is sent by this code.
- Cloudflare Tunnel: encrypted connection to the Folio-operated Mac for local document classification and AI questions.
- PayAI facilitator (facilitator.payai.network) and Base RPC (mainnet.base.org): optional agent USDC payment verification and settlement; blockchain transactions are public.
- Folio-operated Mac: local document extraction, speech generation and AI inference. Model and extraction dependencies are declared in requirements files and local configuration; no hosted paid voice-generation service receives uploads.
Dictionary definitions
Word definitions are supplied by FreeDictionaryAPI.com from Wiktionary under CC BY-SA 4.0. Each lookup links to its original Wiktionary entry. We select a short set of definitions for display. If that provider is unavailable, Folio uses Free Dictionary API and displays the source and license supplied with each definition. Only the selected word is sent to these providers; book passages are not.
Tracking changes
Adding analytics, replay or advertising requires a fresh privacy review and an opt-in consent mechanism that prevents loading before consent. Such tools must never receive form, document-question, club-chat, payment, recording or health-field contents. Current app functionality requires no tracking consent banner because those tools are absent.