Privacy

FounderTally ("we") decides how the data below is used and is responsible for it. Questions go to support@foundertally.com.

• Your account and its members: the account's name, each member's email address and role. To sign you in and let you share the account.
• Sessions: a hash of each session's secret, with when it started and was last used. To keep you signed in.
• Sign-in links and invites: only their hashes, until they are used or expire (15 minutes for a link, 7 days for an invite).
• Rate limits on sign-in links: the address that asked, counted for up to an hour. Requests are also rate limited per IP address by Cloudflare at the edge, and we do not store the IP address.
• Settings: the pages and sections you show, your reports, alerts and goals. To show you the dashboard you set up.
• Connection credentials: the keys and sign-in tokens of the services you connect, encrypted. To read those services for you.
• Notes you write yourself, such as your log of customer conversations. Their personal fields are encrypted.
• An audit log: who did what in the account and when (for example, who connected a service or invited a member). For your security and ours.
• Server logs: what happened (for example, "sign-in link expired"), never your keys, sign-in links or business numbers. To run and fix the service. Cloudflare keeps them for a limited time.

Your business numbers. Revenue, customers, sign-ups, traffic and the other figures FounderTally shows are read live from your connected services each time you look, held in memory only to draw that page or send that report, and then dropped. They are not saved to a database, a file or a cache.

• Cloudflare: hosts FounderTally, stores the data above, sends sign-in emails, rate limits sign-in requests and, when switched on, Cloudflare Turnstile checks the sign-in form is used by a person.
• Google or GitHub, where they are offered as a way to sign in and only if you use them: they tell us your verified email address.
• The services you connect (for example Stripe, GitHub, PostHog, Slack, Discord or your own email provider): we read from them, or send your reports to them, because you asked us to. Their own terms and privacy policies apply.

Every cookie FounderTally sets is needed to sign you in or remembers a choice you made. None is for advertising, analytics or tracking, and our pages set no third-party cookies.

• __Host-bs_sessionKeeps you signed in. We keep only a hash of its secret.Lasts: Until you sign out; 7 days unused, 30 days at most.
• __Host-bs_signinTies a Google or GitHub sign-in to the browser that started it.Lasts: 10 minutes.
• __Host-bs_linkLets an emailed sign-in link work only in the browser that asked for it.Lasts: 15 minutes.
• bs_engine_oauthTies connecting a service (such as Stripe or GitHub) to the browser that started it.Lasts: 10 minutes.
• bs_integration_stateTies signing in to a service from Settings (such as GitHub) to the browser that started it.Lasts: 15 minutes.
• ft_periodRemembers the period you picked on the dashboard (day, week, month…).Lasts: 1 year.
• ft_adviceRemembers the advice cards you hid on the dashboard.Lasts: 1 year.

Your browser also keeps a few things on your device only: your theme, the email address you typed while you wait for a sign-in link (in that tab only), an invite you are accepting, and a few display choices. When the bot check on the sign-in form is switched on, it runs in a frame from Cloudflare (challenges.cloudflare.com) under Cloudflare's own privacy terms.

We do not sell or share your personal data, we show no ads, and we do not use your data, or your business numbers, to train any model.

• We keep your account's data while the account exists.
• Disconnecting a service deletes its stored credentials at once.
• Removing a member ends their access and their sessions at once.
• To delete your account and everything it holds, write to support@foundertally.com from an owner's address. We delete it within 30 days and confirm by email. To get a copy of your data first, ask in the same email.
• Server logs expire on Cloudflare's schedule.

You can ask to see, correct, delete or take a copy of your personal data, or object to or limit how we use it. Write to support@foundertally.com; we answer within 30 days. We use your data to provide the service you signed up for, to keep it secure (the audit log and server logs), and with your consent where we ask for it.

If you are in the EU or the UK, you may also complain to your data protection authority. If you are in California, you have the right to know, delete and correct your personal information and not to be treated differently for using these rights; we do not sell or share personal information as the CCPA defines it.

The business data in your connected services stays with those services: use your rights there for it.

Credentials are encrypted, sign-in secrets are kept only as hashes, every request is checked against your account's own members, and everything travels over HTTPS. The details are on the security page.

If a breach affects your personal data, we will tell you, and the authorities where the law requires it, without undue delay.

FounderTally runs on Cloudflare's global network, so your data may be processed outside your country. Where the law requires it, such transfers rely on recognised safeguards such as the EU Standard Contractual Clauses.

FounderTally is for businesses and is not meant for anyone under 16. We do not knowingly keep data about children.

When we change this notice in a way that matters, we will tell you by email or in the app before the change takes effect.

Write to support@foundertally.com about anything in this notice.