Privacy Policy

FounderFloor is operated by its founder (the “operator”, identified in the Legal Notice), who acts as the data controller for the personal data described below. Contact for anything in this policy, including deletion requests: ak@founderfloor.net.

Account data (only if you create an account): your email address, display name, and a salted scrypt hash of your password — never the password itself. Used to operate your account, send the transactional emails listed in section 4, and let you recover access. Legal basis: performance of a contract (providing the account you asked for).

Profile and progress data: your booth design, badges, quests, streaks, connection list, and membership tier, stored on the floor server so your progress follows you across devices. Legal basis: performance of a contract.

Content you publish: your stand (name, pitch, category, design), guestbook entries, and direct messages with your mutual connections (latest 100 per thread). Legal basis: performance of a contract. Live floor chat is relayed to people in the hall and not stored.

The keep-in-touch list (only if you type your email into one of the “keep me posted” or “remind me before Open Doors” boxes): your email address, which of the two you asked for, and the date. Used for nothing except the occasional note it promises — no newsletter, no sharing, no profiling. Legal basis: your consent, which you can withdraw at any time by replying “unsubscribe” to any of them or emailing the address below; the entry is then deleted.

Feedback, abuse reports, and moderation records: reports are stored on the server and forwarded to the operator’s inbox so they can be acted on. Messages are filtered automatically for slurs and profanity before delivery. When an account or identity is suspended, the identifier, the reason, and the date are kept for as long as the suspension stands so it can be enforced (and reviewed on appeal). Legal basis: legitimate interest in running and moderating the service.

Technical data: IP addresses are used transiently for rate limiting and abuse prevention (for example, limiting sign-in attempts). They are not written into your profile and are not used for tracking or profiling. Like almost every website, the hosting providers in section 5 keep short-lived server and access logs (IP address, requested page, timestamp) for security and operations, and the floor server writes operational logs to its system journal. Legal basis: legitimate interest in keeping the service secure.

Invites. Every account gets a random invite code. If you make an account through someone’s invite link, we store which account invited you, so that both of you can be credited with the free days. That link between two accounts is the whole of it. You are shown the display name of whoever invited you; they are shown only a count of how many people joined on their link, never your name or your email address. Nothing about an invite is shared outside the service. Legal basis: performance of the service you asked for. Ask and the link will be removed, which costs you only the days it earned.

What we do not collect: no analytics scripts, no tracking pixels, no advertising identifiers, no selling or renting of data — to anyone, ever. Invite codes are random and are not derived from your name or address; no IP address is stored for referrals or trials.

The site keeps your display name, avatar, booth design, quests, badges, notes, (if signed in) a session token, and the last email you signed in with — so the sign-in form can be prefilled next time — in your browser’s localStorage. This storage is strictly necessary for the site to function — it is not used for tracking, which is why there is no cookie banner. Clearing site data in your browser removes it from that device.

If you create an account, your email is used for exactly three things: a welcome note, password-reset links you request, and a security alert when your account signs in from a browser it hasn’t used before. No newsletters, no marketing. Your email address is never shown to other visitors.

A small number of infrastructure providers process data on our behalf, only as needed to run the service:

Hetzner Online GmbH (Germany) hosts the floor server, where account data, stands, messages, and synced progress live. Vercel Inc. (USA) hosts and serves the web pages. Resend (USA) delivers the transactional emails above and is the only third party that ever sees your email address. Cloudflare Inc. (USA) provides DNS for the domain. UptimeRobot (Malta) pings a public health endpoint to alert the operator when the server is down; it sees no personal data. Payments are handled by Stripe, which processes card details itself — card numbers never touch our servers. Stripe tells the floor server the email address used at checkout and what was bought, so the purchase can be credited to your account.

Where a provider is outside the EU/EEA, transfers rely on that provider’s standard safeguards (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as applicable).

Sessions expire after 30 days of disuse. Synced progress is deleted after 180 days of inactivity. A stand is kept for at least 7 days (longer around show weeks) after you were last seen, then the spot frees up and its guestbook is deleted with it. Direct-message threads keep only the latest 100 messages. Feedback, content reports, and cancellation requests are kept as a rolling log (oldest entries drop off) for as long as they may be needed to handle the matter. Suspension records are kept while the suspension stands. Keep-in-touch entries are kept until you ask to come off the list, and deleted when you do. Records of purchases are kept as long as tax and commercial law require. The server keeps 3 daily rotating backups of its data file, so deleted data leaves the backups within 3 days. Account data is kept for as long as the account exists and deleted with it.

You can ask for access to the data we hold about you, correction of anything wrong, deletion of everything, a portable copy, or restriction of processing — by emailing ak@founderfloor.net or using the in-app feedback box. Deletion requests are honored in full. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data-protection authority.

FounderFloor is not directed at children. You must be at least 16 years old (or the age of digital consent in your country, if higher) to create an account.

If this policy changes in a way that matters, the effective date at the top changes with it, and significant changes will be flagged on the site. Continued use after a change means the new version applies.