FOLKLORE

Legal information

Security policy

Folklore is made by Gymber s.r.o. (Czech Republic). This page is the public coordinated vulnerability disclosure policy for the Folklore app and its remote data processing.

Reporting a vulnerability

Email the security contact with the affected version and platform, steps to reproduce, and impact: security@thefolklore.app

  • We acknowledge reports within 2 business days and give a triage result within 7 days.
  • Please do not publish the report until a fix is available or 90 days have passed, whichever is first.
  • Good-faith research within this policy will not be pursued legally.
  • You may also report to the Czech CVD coordinator (NÚKIB / GovCERT.CZ): cvd@nukib.gov.cz

Support and updates

Folklore is available as a mobile app and on the thefolklore.app website. Folklore, including any purchases made through it, is supported with security and maintenance updates for a minimum of five years. App updates are distributed through the App Store and Google Play and may also be delivered directly to the app as over-the-air updates, which install automatically; the website is always kept up to date. To benefit from the latest fixes, please keep the app up to date.

Scope

This policy covers the Folklore mobile app and its backend. Do not test against other people's accounts or production data you do not own.

EU declaration of conformity

Regulation (EU) 2024/2847 — Annex V

  1. Product: Folklore, version as shown in the Folklore app About screen (iOS/Android version and store build number).
  2. Manufacturer: Gymber s.r.o., Pod Terasami 779/5, 664 48 Moravany, Czech Republic, IČO 17600090
  3. This declaration of conformity is issued under the sole responsibility of the manufacturer.
  4. Object of the declaration: Folklore mobile application (iOS/Android) and its remote data processing solution.
  5. The object of the declaration described above is in conformity with Regulation (EU) 2024/2847.
  6. Harmonised standards / common specifications / certifications used: none.
  7. Notified body: not applicable — internal control procedure (module A, Annex VIII Part I).
  8. Additional information: support period of at least 5 years from the release date of each version; documentation at https://www.thefolklore.app/security#declaration.

Signed for and on behalf of: Gymber s.r.o.

Michal Ševčík, jednatel (managing director)

Moravany, 19 October 2026