Privacy

Founder Memory runs this website, the web chat and the connector at mcp.foundermemory.com. For anything about your data, write to info@foundermemory.com.

Legal entity: to be defined

• Your account: your email, your name if GitHub or Google gives us one, and the account id GitHub or Google gives us (or your email, if you sign in with an emailed code).
• Usage of your account or private link: calls, consultations and tokens per day, and a log of each call (time, tool, the notes it used, its size, whether it worked, and the app that made it). Never the text of your questions. We use it for monthly usage limits and daily safeguards, to prevent abuse and to control costs.
• In the web chat without an account: a random visitor id in a cookie and a keyed hash of your IP address, to count your free consultations. We store only hashes of both, with the counts.
• Where your first visit came from: the campaign tags and ad click IDs in the link you arrived by (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, gbraid, wbraid, fbclid), the name of the site that sent you, and the first page you opened and when, in the fm_src cookie. If you later click one of our ads, its click ID and campaign tags, the page it opened and when, in the fm_click cookie. Never anything you type. If you create an account, we copy both to your account; if you pay, we add them to your Stripe checkout, with your country (from your connection) and whether your browser sent Global Privacy Control.
• Steps toward an account and a plan, to see which ads and pages work: a chat started, a consultation finished with a verdict, the create-an-account prompt shown, an account created, a checkout started and a payment completed. Each step keeps its time, your account or a keyed hash of your visitor id, where your first visit came from (without the ad click ID itself) and a few details such as the plan and price. Never the text of your questions.
• If you answer one of our short surveys (suggesting an author, product feedback, “Was this useful?” after a consultation, or why you’re not signing up yet), with or without an account: your choices and anything you type. We keep them with the date, where you answered, your page’s language, your plan, how many consultations you had, and the campaign that first brought you to the site (from our own first-visit cookie). They never include your conversation. With an account they are linked to it; without one, only to a keyed hash of your visitor cookie and of your IP address. The Founder Memory team reads them in the admin panel and marks them reviewed. We keep the date of survey invitations to avoid asking too often.
• If you give your email in a survey (for example, to hear when an author is added), we keep it with that answer and use it only for that.

Our database never stores IP addresses, only keyed hashes of them, which also rate-limit sign-in and sign-up. Sign-in codes, sessions and app tokens are stored only as hashes.

• Without an account, your conversation stays in your browser, on that device only.
• With an account, your web chats are saved to your account so you can reopen them. You can delete any chat, or your whole account, at any time.
• The “Your business” note you write is saved to your account and can be included as context in web-chat consultations.
• Consultations through the connector, in Claude, ChatGPT, Cursor and other apps, aren’t saved as full chats by Founder Memory. We keep the usage log above and any individual memories you choose to save or enable. Your AI app keeps its own history, under its own policy.
• A shared card link carries the card inside the link itself: we don’t store it.

Memories are optional account notes containing facts, learnings or preferences. You can add them yourself or enable remembering your statements for a named business or project. Each memory stores its text, scope, date and origin, including an original excerpt or reference when available.

Saved general memories and memories for the selected business or project can be used in future consultations in the web chat and your connected AI apps. Connected apps with access to your account can use the memory tools to read or manage them for you.

You can review, edit or delete individual memories. A memory is stored separately from its original chat: deleting that chat does not delete the memory. Deleting your account deletes both.

A few providers run parts of Founder Memory for us. Each gets only what its job needs:

• Vercel hosts the website and the connector. Like any host, it sees requests, including IP addresses.
• Neon hosts our Postgres database.
• OpenAI’s API writes the answers. It receives your question, the context the chat or your AI app sends, any included business note and memories, and the matching source notes. Under OpenAI’s API policy, API data isn’t used to train its models by default, and we ask it not to store the responses.
• Resend sends our emails (sign-in codes, the welcome email, renewal notices) and receives what you write to info@foundermemory.com, which it passes on to our own inbox.
• GitHub and Google sign you in, only if you choose them.
• Google Fonts serves the typeface of the consult cards shown inside AI apps.
• Google measures our Google ads, through the Google tag on our pages (see “Ads and measurement”).
• Meta will measure our Facebook and Instagram ads through its pixel, only once we turn it on (see “Ads and measurement”).

We don’t sell your data. What reaches Google, and Meta once its pixel is on, is only what “Ads and measurement” describes, to measure our own ads.

Stripe processes payments and card details. We store Stripe customer and subscription IDs, plan status, billing interval, renewal date, top-up and refund records, but no card details. Resend may send billing notices.

We advertise Founder Memory on Google Search, and may later on Facebook and Instagram. To know which ads bring people who find it useful, our pages load the Google tag (Google Ads), and Meta’s pixel once we turn it on. Neither runs on the admin, shared-card or app-authorization pages.

• What they receive: the pages you view, with the address cut to the page itself plus campaign tags and ad click IDs (anything else in it, like a question sent from our home page, is removed, and the tags don’t load until it is gone), the referring page cut the same way, and three conversions: a consultation finished, an account created, and a purchase with its value, currency and a transaction id.
• When a purchase follows a click on one of our Google ads, our server also reports it to Google (the ad click ID, value, currency, time and transaction id), so it counts even if you close the page after paying. It never includes your email or name, and isn’t sent if your browser sent Global Privacy Control when you paid or you are in the EEA, the UK or Switzerland.
• What they never receive: your questions, your chats, your business note, your memories, your email or your name.
• Google and Meta also read and set their own cookies and receive your IP address and browser details, under their own privacy policies (policies.google.com/privacy and facebook.com/privacy/policy). They may use these to measure our ads and, where the law allows, to show our ads to people who visited our site.

If you visit from the European Economic Area, the United Kingdom or Switzerland, the Google tag starts with advertising and analytics storage denied: it sets no advertising cookies and removes ad click identifiers, and Meta’s pixel doesn’t load. If your browser sends a Global Privacy Control signal, we ask Google to restrict how it processes this data and don’t load Meta’s pixel.

To opt out: turn off personalized ads in Google’s My Ad Center (myadcenter.google.com) and in your Facebook or Instagram ad preferences; use the industry opt-out at optout.aboutads.info; or block or delete cookies and third-party content in your browser, or turn on Global Privacy Control. The chat works the same either way.

Our own cookies:

• fm_session keeps you signed in. It holds a random token that scripts can’t read, for 30 days.
• fm_in tells our pages you’re signed in, so they show “Account”. It holds only the value 1 and lasts as long as your session.
• fm_login holds a GitHub or Google sign-in in progress, for 10 minutes.
• fm_guest is your random visitor id in the web chat without an account, for one year.
• fm_src remembers where your first visit came from (see “What we collect”), for 90 days. Our server sets it on your first visit only; scripts can’t read it.
• fm_click remembers your latest click on one of our ads (see “What we collect”), for 90 days. A newer ad click replaces it; scripts can’t read it.
• fm_internal marks the browsers of the Founder Memory team, so our own visits aren’t counted and the ad tags stay off there. Visitors never get it.
• fm_conv tells the next page that you just created an account, so it can report that sign-up to the ad tags. It is set only while an ad tag is on, lasts at most 10 minutes and is removed once read.

The web chat also keeps your conversation in your browser’s local storage, and the site notes there which purchases it has already reported, so each counts once.

Outside the European Economic Area, the United Kingdom and Switzerland, the Google tag sets Google’s advertising cookies, such as _gcl_au and _gcl_aw, for up to 90 days. Once Meta’s pixel is on, it sets Meta’s, such as _fbp and _fbc, for up to 90 days. “Ads and measurement” explains how to opt out.

We keep your account data until you delete your account. Deleting it removes your user, sessions, sign-in methods, chats, business note, memories, the survey answers and survey invitations linked to it, the tokens of the apps you connected and where your first visit came from, and revokes your key. Usage records stay with the revoked key, for the limits and abuse prevention, and funnel steps stay without the link to your account.

For anything else, like a copy of your data or a correction, write to info@foundermemory.com.

Founder Memory is for people 18 and older.

Founder Memory is in beta, and this policy will change with it. When it does, we’ll update it here and change the date at the top.