Foluma privacy
Last updated 2 September 2026
Foluma is a free reader for files chosen by the user. EVOZA operates Foluma and does not upload, host, sell or inspect manga files through this account service.
Optional account data
If you choose Apple or Google sign-in, this service stores an internal account identifier, a one-way protected provider identifier, optional provider-supplied name or email, account preferences and security session records. If you create a Foluma profile, it also stores the community username and built-in avatar you choose. You can remove that optional profile at any time without deleting your account or ending its sessions; removal releases the username and clears both profile choices. Provider email and name are never copied into sharing or community-profile data. Sensitive provider fields are encrypted and session tokens are stored only as keyed hashes. There is no public profile lookup or leaderboard endpoint in this release.
Google Drive
Google Drive connection is optional and separate from Foluma account sign-in. General Drive browsing and readers of a shared library use read-only access. A shared-library owner separately gives Foluma access only to files Foluma creates or opens for the app, allowing Foluma to create the private library folder, upload files the owner chooses, maintain its manifest, and add or remove named Viewers. Foluma does not request permission to edit the owner's other Drive files.
Drive access and refresh tokens stay in that reader profile's device Keychain and are never sent to EVOZA's account service. Folder and manifest identifiers, folder listings, filenames, pages, covers and manga contents stay between the person's device and Google. To recover from an interrupted upload, permission change or invitation acceptance, Foluma may temporarily keep an exact-profile record in the device-only Keychain containing the relevant Drive identifiers, a temporary Google resumable-upload session address and expected file name/size, the recipient email entered by the owner, or the private invitation capsule. The upload session address is saved before any book bytes are sent and is used only to ask Google whether that exact upload completed. Those Drive-specific recovery details are never sent to EVOZA's account service. Foluma removes them only after the action is safely completed, expired, or cancelled. Account deletion waits until unfinished Drive work is reconciled; after remote deletion is confirmed, the app idempotently erases that profile's remaining Drive recovery records and credentials from the device.
For shared libraries, the owner enters the exact Google email that should receive Viewer access. The app sends that email and a private one-time Foluma invitation link directly to Google so Google can create the Viewer permission and deliver its notification email; neither is sent to EVOZA's account service. The recipient signs in to the Google account that received access, and Foluma verifies and connects the known folder automatically. The invitation capsule is carried in the link fragment. If the fallback webpage opens, browsers do not send that fragment to this service, and the page contains no analytics or tracking. The capsule is a secret, does not bypass Google's permission checks, and gives no editing or resharing authority.
Foluma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not sold, used for advertising, used to determine creditworthiness, or used to train generalized AI or machine-learning models. It is not transferred or accessed by humans except in circumstances allowed by that policy, such as providing the requested feature, the user's affirmative consent, security, legal obligations, or aggregated and anonymized internal operations.
Shared libraries
If you use library sharing, the service stores a user-entered library name, owner and reader memberships, one-way protected invitation tokens, an encrypted owner-chosen reader nickname, and an encrypted opaque Google permission identifier used to coordinate revocation. The invited Google email is not sent to or stored by this service. No request, response or database field stores the Drive folder or manifest identifier. The service does not receive manga titles, covers, filenames, pages or reading history, and each reader keeps independent progress. Removing a reader in Foluma removes the named Google Viewer permission first and confirms that revocation before removing membership. Foluma never creates an Anyone-with-the-link permission and cannot recall files a reader already downloaded or copied.
For coordinated shared-library Drive changes, each safety lease temporarily stores only a client-generated random operation UUID bound to the internal library UUID plus lifecycle timestamps. The service also stores one library-scoped SHA-256 Drive-account binding digest so another device cannot attach that library to a different owner Drive account. The digest is computed on the device; the raw Google Drive account permission ID is never sent or stored. Neither record receives Drive folder or file IDs, access or refresh tokens, folder or file names, manga or manifest content, file metadata or resumable-upload session URLs. An active same-operation retry can renew the lease to eight days ahead by default, but never beyond 30 days from its original creation; finished or expired leases never reactivate. A terminal lease row is retained for 30 days by default for safe retries, while the account-binding digest remains only until its library is deleted.
Feature requests
If you submit a feature request, the service stores the text, category, submission date, and minimal app/platform context. Account request history is optional and removable. Manga information is never included automatically.
What we do not do
There is no advertising, tracking, sale of data or subscription profiling. Browser cross-origin access is disabled unless an EVOZA-owned origin is explicitly approved.
Retention and deletion
Expired security tokens are pruned automatically. Feature requests are retained for up to 365 days unless removed sooner. Removing only your optional profile clears its username and avatar choice while keeping the account, preferences, sessions, memberships and feature requests. Deleting your Foluma account permanently removes its profile username, avatar choice, account preferences, sessions, memberships and feature requests from this service. A minimal one-way protected deletion marker and receipt are retained to block later sign-in and support separately backed-up restore reconciliation. A same-database marker alone cannot survive restoration of an older backup. If Apple is temporarily unavailable, an encrypted Apple revocation token is retained only while bounded retry processing remains active. The active-service ciphertext is erased immediately when revocation succeeds, the retry limit is reached, or the ciphertext cannot be recovered. The non-secret job outcome is retained for up to 30 days for operational review; the separate deletion marker and receipt remain. An encrypted full-database or revocation-recovery snapshot can contain a token captured while its retry was still pending, so every such artifact is limited to 30 days. The separately retained deletion ledger is token-free. The app also removes that reader's private CloudKit progress/settings records; if iCloud is unavailable, the device queues a retry. Local manga files and files in iCloud Drive or Google Drive are not deleted.
Privacy contact: helloevoza@gmail.com