Privacy Policy
Last updated: September 2026
1. Scope
This policy describes how FoundeReview handles personal data on foundereview.com.
2. Data we process
- Account data: name, email, and the profile basics we receive when you sign in with X or GitHub (handle, display name, avatar).
- Content data: the reviews, briefs, postmortems, asks, and correspondence you publish. Published content is public by design and carries your byline and your product.
- Claim data: the products you claim and the verification records behind those claims.
- Subscription data: your email and the unsubscribe tokens for occasional review emails, if you subscribe.
- Technical data: logs, device and usage information, and technical error diagnostics.
- Analytics data: aggregate, cookie-free page measurements (Cloudflare Web Analytics). No cookies, no cross-site tracking, no individual visitor profiles.
3. Why we process it
To provide and improve the Service, to secure it, to process payments, and to meet legal obligations. We do not sell personal data.
4. Sign-in providers
You sign in with X or GitHub, and we receive the basic profile data you authorize. We do not read your X audience data — no followers, no reach, no analytics. If you disconnect X, the data we sourced from X is removed within 24 hours.
5. Processors
We rely on a small set of processors under data-processing terms:
- Dodo Payments — merchant of record for payments.
- Alibaba Cloud RDS — PostgreSQL database hosting.
- Cloudflare — edge hosting, caching, object storage, and cookie-free web analytics.
- Resend — transactional email and occasional review emails.
- Alibaba Cloud — servers that render product screenshots and fetch public product metadata.
Our Data Processing Agreement describes these sub-processors and the safeguards that apply.
6. Retention and deletion
The journal is an archive: published contributions stay published. Deleting your account pseudonymizes your byline — your name, handle, and credentials are removed, and your published contributions remain under a pseudonymous marker. Data held for legal or accounting obligations is retained as required, then deleted.
7. Your rights
You can access and correct your profile, and request export or deletion of your personal data, by contacting [email protected]. Deletion is pseudonymization, as described above.