Privacy policy

What we collect

Your account

• Email and password sign-in: your email address and a password. We store only a salted scrypt hash of the password, never the password itself.
• Google or GitHub sign-in: the provider's account ID, your verified email address, your display name and, for GitHub, your public profile URL. We use the provider's access token once to read these details and do not store it. We never see your Google or GitHub password.

What you publish

• Your profile: name, username, headline, bio, location, availability, what you are looking for, skills, experience, projects and links such as GitHub, LinkedIn or a portfolio.
• Contact details you add: phone, WhatsApp and email.
• An optional profile photo. Your browser crops and resizes it before upload, and we remove embedded metadata such as GPS location. The photo is shown wherever your profile is visible, and you can change or remove it at any time.
• Organization pages and opportunity listings you create.
• If you import your LinkedIn data export, your browser reads the file and sends us only the profile details you choose to add: headline, summary, location, website, positions, skills, projects and languages. The rest of the export, such as your connections and messages, never leaves your device.

Work proof

• If you connected GitHub, we read your public GitHub facts, like repos and stars, and show them on your profile. We read them again about every five days to keep them current.
• If your profile has a website, we open its front page when you ask us to verify it, and again about every five days to check the link is still there. We keep only whether the link was found and when we looked.

Licence checks

• If you give a licence or registration number, we keep the register, the number, our decision, who made it and when. We look the number up on the public register by hand; nothing is uploaded.
• Until it is checked, only you see it. Once checked, the register and number show on your profile, in search and to AI assistants, with the date. If it did not match, only you see that, with our note.
• Remove the number from your profile at any time and all of this is deleted.

Profiles started by an AI assistant

If you ask an AI assistant, like ChatGPT or Claude, to put you on Foundaree, it sends us the details you gave it. We keep them as a private draft for up to 7 days. Only someone with the draft's link can see it. Nothing is public until you sign in and publish it. The draft is deleted once it is used or after 7 days.

WhatsApp

• If you message our WhatsApp number, your messages go through Meta's WhatsApp service to our server.
• We keep your number only in coded form, to limit how many messages each number sends.
• We keep where you are in a chat, like your join answers or your last search, until 24 hours after your last message.
• We don't keep a copy of what you wrote.
• If you join, the number you write from goes on your draft as your phone and WhatsApp. You choose if people can see it when you publish.
• Send STOP any time and we stop replying. We keep the coded number so we stay quiet. Send START to talk again.
• We only write to you first if you asked for the daily check-in (one “are you free for work?” message a day, in Settings or by sending MORNING or EVENING). We keep when we last sent it. NO CHECK or STOP ends it.

Your location

• The "Use my current location" button sends your position to our server. Our server asks OpenStreetMap for the place name. We don't store your position.
• We use your approximate city, from your internet connection, to show people near you. We don't store it.

Technical data

• Cookies: a sign-in cookie (foundaree-session, valid for 24 hours) and, while you sign in with Google or GitHub, a short-lived security cookie (10 minutes). Both are strictly necessary and cannot be read by page scripts. We use no analytics or advertising cookies.
• Server logs: the address requested (which can include search terms), the response status and timing. Our hosting providers also process IP addresses to deliver and protect the service, and we use IP addresses briefly in memory to limit abusive request rates.

Booking requests

When you ask to book someone, from their profile or through an AI assistant, we keep your name, phone number, what you need, when and your area, and show them only to the person you asked. We email that person that you asked, without your number. Requests are deleted after 90 days. The person can block a number, and can turn booking requests off.

Searches that find nobody

When an AI assistant or another app searches Foundaree and finds nobody, or only a poor match, we keep what it asked for: the kind of work, the city and area, and the words used, with anything like a phone number taken out. Nothing about who asked is kept. We use it to know which people to invite, and delete it after 90 days. Searches on this website are not kept.

Emails when someone connects or messages you

We email you when somebody asks to connect with you, when somebody accepts your request, and when a new message is waiting for you (one email per conversation until you read it). The email names the person, but never repeats the note or the message they wrote — that stays on the site, behind your sign-in. You can turn these emails off in Settings; emails about your account itself, such as confirming your address or resetting your password, are always sent.

Assistants you connect

If you connect an AI assistant to your account, we keep which assistant it is, what you allowed it to do, and when it was last used, so you can see and undo it. We store only a scrambled copy of its key, never a password, and the assistant never sees yours. Disconnecting it in Settings stops it immediately and deletes its keys.

Tracking links

If you join through a promotion link (for example foundaree.com/signup?ref=name), we keep that link's name with your account, so we can count how many people each promotion brought. It is never shown on your profile.

Connections and messages

Connection requests, messages and notifications are stored on our servers so they reach the other person. Only the people in a conversation can read its messages.

How we use it

• To run your account and keep you signed in.
• To show your public profile, organizations and listings, and to make them searchable.
• To protect the service from abuse, fraud and security threats.
• To answer your requests and meet legal obligations.

We process account data to provide the service you asked for, and publish profile data because you chose to publish it. You can withdraw that choice by changing visibility or deleting the content.

Who can see your information

• Public profiles and listings are visible to everyone. They appear in our search, our sitemap and structured data, and our API and AI-assistant interfaces, so search engines and AI tools can index and quote them. Copies may remain in third-party caches for a while after you change them.
• Unlisted and private items are visible only to you when signed in, and to Foundaree admins (below). They never appear in search, sitemaps or AI-assistant results.
• Your sign-in email and account details are never shown on your profile.
• Your contact email is shown only if you choose to show your contact details.
• Foundaree admins, a small number of people who run Foundaree, can see account details (sign-in email, how you sign in, whether your email is confirmed, account status) and all profiles, including private and unlisted ones. They use this only to run the service, answer your requests, and handle reports, spam and abuse, for example by hiding a profile or suspending an account. Every change they make is logged. They can't read your messages in the admin panel.

Service providers

We share data only with providers that help us run Foundaree:

• Vercel, which hosts the website and tells it the approximate city of your connection.
• Railway, which hosts our API and database.
• OpenStreetMap, which turns a position into a place name when you use the location button.
• Meta, which runs WhatsApp, only if you message our WhatsApp number.
• Google and GitHub, only if you choose to sign in with them.

These providers may process data in countries other than yours. We don't sell personal data or share it for advertising. We may disclose data if the law requires it.

How long we keep it

We keep your account and content while your account exists. Sign-in sessions expire after 24 hours. Drafts started by an AI assistant or on WhatsApp are deleted once used or after 7 days. WhatsApp chat steps are deleted 24 hours after your last message. When you ask us to delete your account, we delete your account, profile and sessions from our database, except where we must keep something to meet a legal obligation.

Your rights and choices

• Change your profile's visibility or edit its content at any time.
• Ask for a copy of your data, a correction, or deletion of your account.
• Withdraw consent by deleting content or making it private.
• Depending on where you live (for example under India's Digital Personal Data Protection Act, 2023, or the EU/UK GDPR), you may have further rights, including the right to complain to a data protection authority.

To make a request, email hello@foundaree.com. We may need to confirm that the account is yours before acting.

Security

We use HTTPS, hashed passwords and session tokens, HttpOnly cookies and rate limiting. No system is perfectly secure; see our security page for how to report a problem.

Children

Foundaree is for people aged 18 and over. We don't knowingly collect data from children.

Changes to this policy

If we make significant changes, we'll update the date above and, where appropriate, let you know before the changes take effect.

Contact

For any privacy question, email hello@foundaree.com.