Privacy Policy

Scope

This policy describes what Spread Foundry collects, why, and how it handles that data. It applies to the public website and any authenticated account surfaces.

Information We Collect

• Account data: email address and a hashed password for authentication. We never store plaintext passwords.
• Session data: an opaque session identifier cookie for keeping you signed in. The cookie is marked HttpOnly and (in production) Secure.
• Audit logs: timestamps and outcome of login, logout, and account-lifecycle events, retained for security investigation.
• Operational telemetry: request rates, latencies, error counts. Privacy-preserving by design — see the Analytics section.

What We Do Not Collect

• We do not sell personal data.
• We do not use third-party advertising or cross-site tracking cookies.
• We do not collect brokerage credentials. Spread Foundry is not a broker and does not execute trades.

Analytics

Product analytics are limited to a small, enumerated set of activation + workflow events (login outcome, page views with coarse route identifiers, empty-state and error surface views, support-link clicks). Events never carry passwords, tokens, email addresses, free-form input, IP addresses, or other personal data — the server-side endpoint strips any payload field not on a published allowlist, and any event name not on a published enum is rejected outright.

No third-party advertising SDKs, no cross-site tracking, no session replay. Analytics events live in the same container logs as the rest of the system's observability output and are retained only as long as those logs are. See the Methodologypage for what's measured and why, and the Spread Foundry MVP analytics plan referenced from the operator runbook for the exact event taxonomy and field allowlist.

Data Retention

Account data persists until you close the account. Sessions expire on logout or after inactivity. Audit logs are retained for a reasonable period for security investigation, subject to any legal hold.

Your Rights

Contact us via Support to request account deletion, export of your account data, or corrections. Applicable local privacy law (e.g. GDPR, CCPA) may grant additional rights; those requests follow the same contact path.

Security

Passwords are hashed with a modern KDF. All public HTTP traffic is redirected to HTTPS, and certificates are renewed automatically. We maintain an incident-response process for potential security events.

Changes

We may update this policy. Material changes will be reflected in the Last updated date above and, where appropriate, communicated to account holders.

Contact

Privacy questions or requests: see the Support page for the current contact path.