Cookie & Tracking Notice

What this page covers

This Notice explains the cookies, local storage, session storage, and similar technologies (collectively, "cookies") used on foundable.com and within the Foundable product, and how you can control them. It supplements our Privacy Policy.

Strictly necessary (always on)

These keep the product working. You can't turn them off without breaking login and security.

• Server routing (AWSALB and AWSALBCORS cookies, set by our load balancer at Amazon Web Services). Keeps your browser on one of our servers, so a page and the files it loads come from the same version while we release a new one. They name only the server, nothing about you, and last seven days from your latest visit.
• Sign-in session (cookie on login.foundable.com). Keeps you signed in. WorkOS, our authentication provider, sets it on our sign-in domain when you sign in and renews it as your session refreshes. It is HttpOnly, so scripts on the page cannot read it, and it lasts as long as your session. The product itself never sends it to our API, which accepts only short-lived access tokens.
• Email-code step (foundable:email-code-step, session storage). Remembers the address you asked a sign-in code for, so a reload keeps you on the code step for ten minutes.
• Checkout return (foundable:billing-checkout, session storage). Marks a checkout you started, so the product can confirm its outcome when Stripe sends you back.
• Creation request (foundable.company.create:…, session storage). One request key per foundable you start creating, so a lost reply retried in this tab cannot create two.
• Waitlist state (foundable.waitlist.arrival.v1 in local storage; foundable.waitlist.introDraft:… and foundable.waitlist.deletion:… in session storage). The referral code and campaign tags you arrived with, kept until a claim uses them; an unsent questionnaire answer; and the receipt of an account deletion until the server confirms it.
• Account deletion (foundable.account.deletion:…, session storage). The receipt of a deletion asked in Settings, kept in the tab until the page you return to after logging out confirms it.

Functional (always on)

These remember your preferences and, when enabled, keep the signed-in human-support Messenger working. They don't track you across the web.

• Appearance (foundable.theme, local storage): light, dark or system.
• Performance tier (foundable-performance-tier-v1, local storage): whether this device runs the animated sky or the reduced one, decided by measuring it.
• Layout and place (foundable.chat-width-share, foundable.home-row-heights, foundable.home-card-order, ted-chat:…, grow-chat:…, local storage): the width you gave the chat, the heights and order you gave Home's cards, and the chat you last had open in each foundable.
• Waitlist hints (local storage): whether you have seen the line's introduction and finished its onboarding, so they are not shown again.
• Intercom Messenger identifier (intercom-id-[app_id], first-party cookie, when signed-in support is enabled): a unique Messenger identifier. Intercom's Product Privacy Notice lists a nine-month default duration. Foundable clears Intercom browser state when you sign out.
• Intercom Messenger session (intercom-session-[app_id], first-party cookie, when signed-in support is enabled): connects the current browser session to your prior support conversations. Foundable clears it when you sign out.
• Intercom Messenger device identifier (intercom-device-id-[app_id], first-party cookie, when signed-in support is enabled): identifies a device that interacts with Messenger to help prevent abuse. Its default duration is 270 days. Foundable clears it when you sign out.

Foundable boots Messenger only after authenticating a signed-in operator. It is not booted for signed-out visitors or the public pages, and Foundable does not use it for advertising, marketing, tours, standalone or proactive surveys, or proactive messages.

Websites you choose to connect

An owner or admin can choose to sign in to a website in a live remote browser run by Cloudflare. We save encrypted sign-in cookies for that foundable and the person who connected it so Ted can continue the work. We do not copy other browser storage, such as local storage or IndexedDB, into the saved connection. Temporary page state can remain in the remote browser until it closes or expires. The saved cookies are held by Foundable, separately from the cookies in your own browser. Clear them by disconnecting the website in Settings > Integrations; clearing your own browser does not disconnect it. Disconnecting revokes the saved cookies and queues live browsers for closure, as does the connecting person leaving the foundable or losing their owner or admin role.

Analytics & error tracking

We use product and server-side telemetry to understand how the Service is used and to fix bugs. Global Privacy Control and Do Not Track do not change this first-party collection, which sets no cookies inside the product.

• PostHog, inside the product: explicit product events (which screen and action, and how long it took), sent under an anonymous identifier with no cookie, no local storage, no person profile and no IP address. There is no autocapture, no heatmap and no session recording; the events carry route families, never page contents, and URL query strings never leave your browser.
• PostHog, on the public landing pages, when analytics is enabled for the deployment: page views, with a first-party device identifier (cookie and local storage) and the campaign tags of the link you arrived on. No autocapture, no session recording, no surveys.
• Sentry: error tracking. Captures error messages, stack traces, the release and a request identifier; it sets no cookie, records no session replay and collects no personal fields. Headers, request bodies, credentials and personal fields are removed before an event leaves the browser or the server.
• Visit session (session-id cookie, on sites published with Foundable while Visitor analytics is on). A random identifier that groups one visitor's page views into a visit; it lasts 30 minutes from the latest page viewed.

No advertising trackers

We do not place advertising pixels or provider cookies for our own advertising, and we do not send conversion measurement to advertising platforms. There is no advertising path to opt out of.

This does not change first-party analytics inside the product, which set no cookies, or the landing pages' analytics described above.

Your choices

• Browser settings: you can block or delete cookies and site data in your browser. Deleting the sign-in session signs you out, and clearing site data forgets your preferences.
• Texting: text STOP to Ted to stop texts; text START to resume.
• Account deletion: at Settings > Account, erases the account and its content at once, while limited billing, security, fraud-prevention, and legally required records may be retained as described in our Privacy Policy, which has the full retention schedule.

Updates

We'll update this Notice when we change the cookies we use. The date at the top reflects the most recent revision. For material additions, we'll provide any notice or choice required by applicable law.