The fine print, unhidden.

These Terms of Service govern your use of The Founders App (the "Service"), operated by Skylab Studio LLC ("we", "us"). By creating an account or using the Service you agree to them. If you do not agree, do not use the Service.

Eligibility and accounts. You must be at least 16 years old and able to form a binding contract. You need an email and password account, protected by a four-digit PIN that you set. You are responsible for everything that happens under your account, for keeping your password and PIN private, and for the accuracy of the information you record. Tell us at support@thefoundersapp.com if you believe your account has been accessed without your permission.

Your content. Everything you write — business names, daily moves, bold moves, journal entries, ideas, appointments, contacts and interaction logs — remains yours. You grant us only the limited permission needed to store, back up, transmit and display that content back to you so the Service can function. We do not publish it, license it to anyone, or use it to train machine-learning models.

Acceptable use. Do not resell or sublicense access, attempt to reach another account's data, probe or disrupt the Service, upload malware, scrape it with automated tools, or use it for unlawful activity or to store data you have no right to hold. If you record other people's contact details, you are responsible for having a lawful basis to do so.

Billing. Paid plans are billed in advance at the price shown at checkout and renew automatically for the same period until you cancel. Payments are handled by a third-party payment processor; we never receive or store your full card number. You can cancel at any time and keep access through the end of the period you already paid for. Fees already paid are non-refundable except where required by law or where we choose to make an exception. We may change prices with at least 30 days' notice, which takes effect at your next renewal.

Availability and changes. We may update, add or remove features. If we make a material change that reduces what you paid for, or discontinue the Service entirely, we will give reasonable notice and let you export your data first.

Suspension and termination. You may stop using the Service and delete your account at any time. We may suspend or terminate an account that breaches these terms, creates a security or legal risk, or has unpaid fees, with notice where practical.

Disclaimers and liability. The Service is provided "as is" and "as available" without warranties of any kind to the fullest extent permitted by law. It is a personal productivity tool, not legal, financial, tax or business advice. We do not warrant uninterrupted or error-free operation. To the maximum extent permitted by law, our total liability for any claim relating to the Service is limited to the amount you paid us in the twelve months before the claim, and we are not liable for indirect, incidental or consequential damages, including lost profits or lost data. Nothing here limits liability that cannot be limited by law.

Changes to these terms. We may update these terms; the effective date below will change and material updates will be announced by email or in the app. Continuing to use the Service after an update means you accept it.

This policy explains what we collect, why, and what you can do about it. Skylab Studio LLC is the controller of your personal data.

What we collect. (1) Account data: your email address, a hashed password, a hashed PIN, and account timestamps. (2) Content you create: businesses, daily moves and outcomes, monthly bold moves, journal entries, ideas, appointments, contacts (name, phone, email, notes) and interaction logs. (3) Technical data needed to operate and secure the Service: request logs, error reports, and short-lived rate-limiting records that store a one-way hash of your IP address or email rather than the value itself. (4) Anything you voluntarily send us, such as feedback or a support email.

What we do not do. We do not sell or rent your data. We do not share it with advertisers or data brokers. We do not run third-party advertising or cross-site tracking scripts. We do not use your entries to train AI models. We do not read your entries except in the rare case where you explicitly ask us to look at something to resolve a support issue.

Why we process it. To provide the Service and sync your data across your devices (performance of our contract with you); to keep accounts secure and prevent abuse, including PIN and login rate limiting (our legitimate interest and legal obligation); to bill paid plans (contract); and to respond to your messages (legitimate interest).

Cookies and local storage. We use strictly necessary cookies and browser storage for your session, your PIN lock state, your preferences, and offline copies of your own data so the app works without a connection. We ask for consent before any non-essential storage, and you can withdraw it from the cookie banner or settings.

Who processes data on our behalf. Our hosting and database provider (Lovable Cloud, running on Supabase infrastructure) stores your account and content; our payment processor handles paid-plan transactions; our email provider delivers transactional messages such as password resets. Each acts only on our instructions under a data-processing agreement. We will list any additions here before they take effect. Data is stored in the United States; if you use the Service from elsewhere, your data is transferred there under appropriate safeguards.

How long we keep it. Content you delete is moved to Trash and recoverable for 90 days, after which it is permanently removed. Rate-limiting records are purged daily; idempotency records after 30 days. When you delete your account, your businesses and all associated entries are deleted from the live database within 30 days, and from encrypted backups within 90 days. We keep minimal billing records for as long as tax and accounting law requires.

Your rights. You can access and export your entire record as JSON or CSV from Settings at any time, correct anything directly in the app, and delete individual records or your whole account. Depending on where you live, you may also have the right to object to or restrict processing, to data portability, and to complain to your local data-protection authority. California residents have the right to know, delete, correct, and to not be discriminated against for exercising those rights — and since we do not sell or share personal information, there is nothing to opt out of. Email support@thefoundersapp.com and we will respond within 30 days.

Children. The Service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

Breach notification. If a breach affects your personal data, we will notify you and any required regulator without undue delay, describing what happened and what to do about it.

Access control. Every request is authenticated and scoped to your account with database row-level security rules, so one account can never read or write another's data, and server-side ownership checks re-verify that on every write, delete and export.

Credentials. Your password is hashed by our authentication provider and never stored in plain text. Your four-digit PIN is hashed with PBKDF2-SHA256 using 100,000 iterations and a unique random salt. After five failed PIN attempts the app pauses for five minutes, and each wrong guess is slowed server-side to resist automated guessing. Sign-up, password reset and feedback endpoints are rate limited per IP address and per account.

Data protection. Data is encrypted in transit with TLS and encrypted at rest by our hosting provider. Deletions are soft by default and recoverable from Trash for 90 days, so an accidental tap is never permanent. Backups are taken by our hosting provider and are encrypted.

Secrets and code. API keys, service credentials and signing secrets exist only in the server environment and are never included in the browser bundle. Database access uses parameterized queries throughout, so text you type can never be interpreted as a command.

Reporting a vulnerability. Email support@thefoundersapp.com with details and steps to reproduce. Please give us a reasonable opportunity to fix the issue before disclosing it publicly. We will acknowledge within 72 hours, will not pursue legal action against good-faith research, and ask that you avoid accessing other people's data or degrading the Service while testing.

The Founders App is owned and operated by Skylab Studio LLC, a limited liability company based in the San Francisco Bay Area, California, United States.

These terms and this policy are governed by the laws of the State of California, without regard to its conflict-of-laws rules. Any dispute that cannot be resolved directly will be handled in the state or federal courts serving the San Francisco Bay Area, and both sides consent to that jurisdiction. If any provision is found unenforceable, the rest remains in effect. These terms are the entire agreement between us about the Service.

Notices, privacy requests, data-deletion requests, billing questions and security disclosures all go to support@thefoundersapp.com. We aim to reply within two business days, and within 30 days for formal privacy requests.