Technical notice on every network flow

Last technical revision: 20 October 2026.

FoldEngine runs on the Mac (two editions: Mac App Store and a direct Developer ID edition) and on iPhone and iPad (the companion app, from the App Store or TestFlight). The flows below say on which devices they happen; the full privacy notice, with legal bases and retention, is docs/legale/Informativa-privacy.md in the app.

FoldEngine is designed without advertising, cross-app tracking, analytics SDKs, user accounts, or sale of personal data. Research files and the local SQLite registry remain in the user-selected project directory or the macOS App Sandbox container.

The dashboard resource card samples aggregate CPU and memory load, memory pressure, storage capacity, aggregate byte counters for active network interfaces, thermal/power/battery state, public processor/GPU and Mac model names, core counts, Metal allocation, system uptime, the count of applications reported by NSWorkspace, and FoldEngine's own CPU/memory footprint. It does not inspect application names, network destinations or payloads, serial numbers, platform UUIDs, user activity or file contents. Samples remain in a short in-memory graph, are discarded when the view closes, and are never stored or transmitted. The Mac model identifier also leaves the Mac through Contribute, described below, when the user switches it on. macOS does not expose a public App Store-safe GPU-load percentage, so FoldEngine does not estimate or claim one.

Network processing

• UniProtKB receives user-entered searches and public protein accessions to return protein metadata and FASTA records. These requests can reveal research interests to UniProt and ordinary connection metadata such as IP address and request time to the service operator.
• When Autopilot is enabled and the selected project's cloud-processing consent is valid, an empty queue may trigger one bounded UniProtKB search per Autopilot activation. The request asks for at most eight reviewed human proteins of 3–400 residues and includes a static term set derived from the selected mission category (priority, oncology, neurodegeneration or rare diseases). Returned accessions are deduplicated and revalidated locally; if the search has no usable candidate, FoldEngine may instead try its documented fixed fallback set of five public accessions. The resulting accession metadata and FASTA are fetched through the same ordinary public-record requests described above. FoldEngine does not upload a locally held sequence to UniProt; sequence bytes in this flow are received from UniProt as part of fetching its public record.
• Periodic refresh of previously imported UniProt accessions is a separate opt-in, disabled by default because a target list can reveal research interests. Its consent is bound to the selected project's owner-only random identity and to the SHA-256 digest of the exact bundled notice. A replacement project at the same path, changed disclosure, historic global preference or administratively forced record cannot authorize refresh. Runtime revocation cancels the active refresh before persisting a durable revoked tombstone. At each chosen 12-hour, daily or weekly cadence, FoldEngine processes at most the 100 least-recently refreshed accessions; larger projects rotate across later cycles instead of creating an unbounded request burst.
• The structure provider is selectable, and the two options disclose different things to different recipients. ESMFold sends the full selected FASTA sequence to the ESM Metagenomic Atlas, which returns a predicted structure. AlphaFold DB sends only the UniProt accession to EMBL-EBI and retrieves a published, precomputed entry; no sequence leaves the app on that path. Both are covered by the same project-scoped cloud-processing authorization described below, because both exist to produce the structure for a selected job. The current selection is shown in Settings alongside its sequence limit and whether its confidence semantics are attested.

• ESM Metagenomic Atlas receives the full selected FASTA sequence only after the user enables “Cloud sequence inference” and an inference actually begins; it returns a predicted PDB structure. The same project-scoped authorization also gates Autopilot discovery, but no sequence is sent to ESMFold merely to search UniProt. Consent is bound to a persistent random identity stored inside the selected project and to the SHA-256 digest of the exact bundled privacy notice: a replacement project at the same path and any changed disclosure both require a new authorization, and neither the historic global preference nor an administratively forced preference is accepted as consent. Runtime revocation closes authorization and cancels discovery, import and an active transfer before recording a durable revoked tombstone; a storage error cannot keep the current session authorized. Revocation is serialized with durable result acceptance. Data already received by a provider before cancellation cannot be recalled by the app.
• Europe PMC receives a fixed, non-user-specific literature query used to refresh the scientific digest.
• Zenodo receives the fixed research search URL only when its in-app research view is opened. That WebView uses a non-persistent data store, blocks popup windows, and permits top-level navigation only to HTTPS Zenodo domains.
• In the Mac App Store edition, Apple's public store catalog receives FoldEngine's fixed bundle identifier to compare the installed version with the published Mac App Store version. No account, receipt or user content is included, and installation remains under macOS/App Store control.
• With a separate, project-scoped permission, FoldEngine looks up public reference information about a selected protein. The RCSB Protein Data Bank receives its UniProt accession to list deposited experimental structures, and the four-character PDB identifier of any structure you open. EMBL-EBI InterPro receives the same accession to list the protein's annotated domains and families. Only those identifiers are sent: no sequence and no other research content. This is a distinct permission from cloud processing — different recipients, a different payload and a different purpose — and a grant for one never authorizes the other. It is revocable at any time, revocation is fail-closed for requests already in flight, and retrieved references are never committed to the local registry as a folding result.

• Deposition to Zenodo, which is operated by CERN, happens only if you store a personal access token and confirm each deposition. FoldEngine then sends that token, the verified structure file and the descriptive metadata shown in the confirmation to the server you selected — the rehearsal sandbox by default. FoldEngine never publishes. It creates an unpublished draft and returns its page; publishing mints a permanent DOI, is irreversible, and is your decision made on Zenodo. The token is held only in the Apple data-protection Keychain, is never written to preferences, never logged, and never included in an error message. Removing it in Settings deletes it.

• In the direct Developer ID edition, the publisher's fixed HTTPS update endpoint receives a metadata-only manifest request. The request contains no account, project path, protein accession, sequence or research content. The signed response is verified against a P-256 public key pinned in the signed app; FoldEngine exposes only a verified compatible release page and does not fetch or install its software payload. As with any web endpoint, the operator may receive ordinary connection metadata such as IP address and request time; its retention and legal basis must be described in the publisher's final public notice.
• Contribute (the volunteer network, Mac only) is off by default. While it is switched on and the Mac meets the conditions set on that screen (power, idle time, temperature, chosen hours), FoldEngine exchanges requests signed with a machine key with the FoldEngine coordinator at gmowwwvcqeiptmatabsb.supabase.co, hosted by Supabase. The coordinator receives: an Ed25519 public key generated on this Mac, whose private half is kept in the Keychain (or, if the Keychain refuses it, in an owner-only file in the app's Application Support folder), which identifies the machine persistently; the Mac model identifier (hw.model, for example Mac16,11); the macOS version string; the time and a random nonce of each request; the machine identifier the coordinator assigned; and, for each task, its exit status, the digests of its results, the run time in seconds and, when macOS lets the app read it, the GPU energy in joules. No name, e-mail address, project, sequence or file of the user is sent. Tasks received from the coordinator are signed task descriptions, not programs; they run in the app's service with the simulation installation already present on the Mac. Switching Contribute off stops new tasks; a task already running finishes and is delivered, and it can be paused while you use the Mac. Unlike the other flows, the publisher operates the coordinator and receives these data, together with ordinary connection metadata such as IP address; the coordinator's hosting provider (Supabase, Frankfurt) also derives an approximate location (country, city, coordinates) from the IP address and keeps it in its platform logs for one day. Requests ask Supabase to run the coordinator in its Frankfurt region (eu-central-1). If you turn on «Open FoldEngine at login» on the Contribute screen, macOS registers the app as a login item (SMAppService.mainApp); opened at login the app shows only its menu-bar icon. Nothing about this setting is sent anywhere.
• The npm public registry receives a fixed request for the latest 3Dmol.js version. FoldEngine never downloads or executes that version; executable app updates arrive only through the Mac App Store or as a separately signed, notarized Developer ID release.
• Your private iCloud (Mac, iPhone, iPad; CloudKit private database of your own Apple Account, which the publisher cannot read). Live view, only after you switch it on on the Mac: the Mac's name and chip, its activity and thermal state, the studies running (folder name, title and description), their progress, temperature, energy, outcome and times, and the public records of Hive tasks the Mac has read; your iPhone and iPad read it. Contribution progress: chosen cause, talents, achievements and the credits your Macs last read, synced while iCloud is on for FoldEngine. Pairing for signing acts: each iPhone, iPad and Mac writes a DispositivoAtti record with its public signing key (P-256, private half in the Secure Enclave), an installation identifier, the device name and model, the creation time and the pairing state, authenticated with an HMAC whose secret the Mac keeps in your iCloud Keychain; the Mac reads the records to delegate devices. Each act is approved on the device with Face ID, Touch ID, Optic ID or the device passcode (the Mac password on a Mac). Deleting FoldEngine's iCloud data in Settings removes these records, the live view and progress, and the pairing secret.
• In-app purchases (tips and the optional «Supporter» subscription) go through Apple's App Store with StoreKit. They unlock no feature. The publisher receives no payment details and no identity; the app reads Apple-signed transactions on the device only to show a thank-you and sends them to no one. FoldEngine collects no data through StoreKit; Apple provides aggregated sales reports.
• TestFlight (pre-release builds): Apple gives the publisher your name and e-mail as a tester, the feedback you send and the crash reports you choose to share.

All app-created requests use HTTPS with Apple App Transport Security. Requests to public services use ephemeral URL sessions without persistent cookies, credential storage, or response caches; requests to the Contribute coordinator currently use the system's shared URL session. FoldEngine does not log FASTA contents or secrets.

Automatic maintenance uses macOS NSBackgroundActivityScheduler with an average one-hour interval and a 15-minute tolerance. macOS may coalesce, delay or defer a run according to energy, thermal and CPU conditions; the cadence is not an exact timer. FoldEngine also performs a due-only catch-up at launch, wake and activation. This works while the FoldEngine process remains resident, including when it is inactive or has no open window. FoldEngine installs no daemon, privileged helper or LaunchAgent; the only login item is the app itself, and only if you switch on «Open FoldEngine at login» in Contribute (macOS lists it in System Settings › General › Login Items). FoldEngine cannot promise to run or relaunch after the user quits the app or the process is terminated. Persisted attempt timestamps prevent restart storms and let the next launch resume only work that is genuinely due.

Retention and security

The user controls retention of local project data. Timestamped scientific, dependency and app-update reports are content-addressed and limited to the eight most recent descriptor-verified reports in each category. A verified Developer ID report may contain only publisher-signed release metadata such as version, minimum system version, release URL and SHA-256; it contains no project content. To prevent metadata rollback across project changes, the highest accepted manifest sequence and its payload digest are stored in the Apple data-protection Keychain under an opaque scope derived from the app bundle identifier and pinned public key. Small secrets are also stored in that Keychain. The app bundle is sandboxed; embedded resources are code-signed with the app, and the 3D renderer is integrity-checked before use.

When the user selects a project or database file outside FoldEngine's container, macOS supplies an app-scoped security bookmark. FoldEngine stores that opaque bookmark locally in app preferences only to restore the user-granted file access after relaunch; it is never transmitted.

FoldEngine uses UserDefaults only for app-scoped preferences. Both periodic-UniProt and cloud-inference consent records contain an explicit grant/revocation state, notice revision and SHA-256 digest of the exact bundled notice under separate project-scoped local keys. Their common truncated SHA-256 scope derives from the canonical path plus an owner-only, single-link random project marker. The readable path and marker value are not stored in preferences, and neither they nor the local scope tokens are transmitted. It reads system uptime for monotonic animation/telemetry timing and reads disk capacity solely to display it in the local resource panel. Its descriptor-relative file-safety checks inspect size, type and identity metadata for files inside the app container or a project folder explicitly selected by the user. None of these values is used for fingerprinting or sent off-device. These uses are declared in PrivacyInfo.xcprivacy with Apple reasons CA92.1, 35F9.1, 85F4.1, C617.1 and 3B52.1.

Intended use

FoldEngine is for scientific research and education. Predictions require independent scientific validation and are not intended for diagnosis, treatment, patient-specific decisions, or other regulated medical use.

Rights and controller information

Controller: Alessandro Pedretti, individual developer, Via Giuseppe Verdi 67, 25034 Orzinuovi (BS), Italy; telephone +39 328 572 6032. Privacy: privacy@foldengine.science; terms and App Store: support@foldengine.science; licences: licenses@foldengine.science. No data protection officer is designated and no EU representative is needed (the controller is in the EU). Legal bases, retention, transfers and your rights (including deletion from Settings › Privacy & licences) are in the privacy notice bundled with the app. Before public distribution the publisher must publish that notice at a stable HTTPS URL and reconcile it with the current terms of every external service and the App Store privacy answers.

This draft is a technical transparency artifact, not legal advice and not a substitute for jurisdiction-specific review.