Privacy
Last updated 2026-10-15.
Proven Founder ("Proven Founder", "we") builds a public page that shows what a solo founder has shipped, by reading the tools they connect. This page explains what we collect, why, and what we never collect.
The short version
- We store your own account data — how you signed in, your handle, and what you choose to write on your page.
- We read your connected tools (GitHub, Stripe, Vercel, and the others you add) only to compute counts: commits, deploys, payments, meetings. We never write to them.
- We never store the names or emails of your customers, the people who pay you. Revenue is kept as a single total, never a transaction with an identity attached.
- Nothing about your account is public until you publish it.
- When someone views your public page we add one to an anonymous daily counter (by country, referring site and device class only), so you can see how it is being seen. No IP address, cookie or visitor identity is stored.
- We never post on your behalf, anywhere, including X.
Who this covers
This policy covers Proven Founder, at provenfounder.com and fndr.page, for founders and for investors.
The data controller under the GDPR is Zack Guerrand, an individual, reachable at guerrandzack@gmail.com.
What we collect about you
Account. When you sign in with GitHub, we receive your GitHub account id, username, and, with your permission (the read:user and user:email scopes), the primary verified email address GitHub holds for you, once, at sign-in. When you sign in with Google, we receive the email and name Google shares for sign-in. Setup asks for a contact email and does not finish without one: it is filled in from GitHub or Google when they gave us one, and you can type another (we then mark it unverified). It is private to you: never on your page, never in a public query, never shared or sold. We use it to identify your account and to contact you about it, in the ways listed under “Emails we send” below. A GitHub private (noreply) address is not accepted, because it reaches no one. If you choose to sign in with an email address instead, we send a six-digit code to it (through the provider named below), keep only a salted hash of the code for ten minutes, and delete the address from that table within a day; the address you proved becomes your verified contact email. Deleting your account deletes it. We never see or store your password for either sign-in.
Profile. Whatever you choose to type: your display name, headline, location, bio, avatar, optional links (LinkedIn, X, a website, up to five of your own and, only if you add them, an email address and a phone number), and, if you fill them in, a company name, a stage ("idea", "building", "launched", "making money"), and a founded year. All optional, all typed by you, all editable and removable by you at any time.
How you arrived. The first time you claim a handle, we record a device class (mobile, tablet, or desktop — never the exact model or browser) and the host name of the site that sent you here, if any (for example "x.com" — never the full link, page or query string). This is captured once and is never updated by later visits. It exists so we can tell which channels bring founders here, nothing more.
Onboarding activity. Which setup steps you have reached and which optional ones you skipped (so you can pick up where you left off), when you first and last reached each one, and how many times, plus a few named moments such as your first reveal, a second tool, your first share and when you come back. Names only: never what is in your record or anything you typed. Before you have an account, pressing Claim on a free handle adds one to an anonymous daily counter, and the handle checker keeps a one-way hash of the caller's address in memory for about a minute to limit repeated checks; it is never written down.
How you use the app. While you are signed in, we record a short list of named events against your account: that you opened your dashboard on a day (once a day), that you asked your agent something (never what), that you opened Share and which share or copy button you pressed (its name only), which tool you connected, that you edited your page or opened investor setup, and, if you press "Tell me when", which paid plan and which locked thing you pressed (once per account; nothing is emailed). An event has a name from a fixed list and nothing else: no text you typed, nothing from your record and nothing about your customers. Only you can read them; our admin page shows totals of how many founders come back, share and set a weekly focus. Cards you dismiss on Home are saved on your account, not in your browser, so they stay dismissed on every device. All of it is deleted with your account.
Emails we send. To the contact email you gave us, and only these. Three are about your account and are always sent, once each: a welcome, a note when your page goes live (with a few ways to share it), and a confirmation after you delete your account. Three you can switch on or off, in Settings or with a one-click link in the email itself, which also works from your mail app: a Monday recap with last week's counts (days shipped, contributions, streak and page views), off until you turn it on; reminders if you go quiet, off until you turn them on, one after 7 days away and one after 14, never more than two; and an alert, on by default, at most once a week, when a tool has not been read for six hours or more. An investor account can also ask for a monthly summary, off until they do: one line per founder they follow, with counts only and no amounts. The recap, the reminders and the monthly summary together are at most one email a week. No tracking pixels, no link wrapping, no marketing. We record only which kind of email went out, for which week, whether it was sent, and your choices, never its content.
Cookies and local storage. Only what the service needs: the sign-in session Supabase, our infrastructure provider, keeps in your browser so you stay signed in, a few small settings kept in your browser (for example a handle you typed before signing in, or a card you dismissed), and, only while access is restricted by a shared password, a short-lived cookie that remembers it was entered. We do not use advertising, analytics or cross-site tracking cookies, so there is no cookie banner to accept.
Page visits. When someone opens your public page, we add one to a counter for that day. The counter is kept per day, per hour of that day, per two-letter country code (taken from the request by our hosting provider, never refined further), per referring site's host name (for example "x.com", never the full link or page), and per device class (mobile, tablet, or desktop). We do not store an IP address, a cookie or visitor id, a browser string, or anything that could tell two visits by the same person apart, so we cannot show you "unique visitors", only views. To stop a refresh or a script from inflating your numbers, a view counts once per visitor per page per day: we compute a one-way code from a secret, the date, the page, and the request's network address and browser string, keep only that code, and delete it within about a day. The address and browser string themselves are never stored, and because the date is part of the code, nothing links one day's visits to another's. Link-preview bots and crawlers are not counted. Your own visits are not counted, and nothing is counted for a page that is not public. We also count how often you yourself copy your link or badge or open the LinkedIn or X share buttons. You see these counts on your dashboard's Share page; nobody else does.
Our landing page. The page you read before you sign up counts a few steps, as anonymous daily totals: that it was opened, that someone reached “how it works” or the prices, started the film, opened the demo, or pressed sign in. Each step is one number per day, counted once per browser tab, with no address, no cookie and no way to tell who did it. Automated visitors are not counted.
Slowing down guessing. Where a password can be guessed (an investor password on a founder's page, the shared access password, a sign-in code), we count attempts and refuse a caller who tries too many. For that we keep, for at most a day, a short one-way hash of the caller's address next to a count. It cannot be turned back into an address, is never joined to an account, and is deleted automatically.
Your agent. When you ask your agent something, or open your dashboard (for the one daily brief), the counts already on your dashboard are sent to an open-source AI model (gpt-oss, run by Groq or, as a fallback, Cerebras) to write the answer: activity per day and per tool, project names and status, connection health, and your page's anonymous visit counts. Never a payment amount, a repository's contents, or anyone's identity. Your conversation and the weekly focus you set are stored with your account, visible only to you, and deleted with it.
Your investor update. When you ask for an investor update (Founder and Pro Founder), the counts for the period you chose are sent to the same open-source AI model to write the sentences: days active, deploys, code contributions, payment and meeting counts, page views, project names and status, and the change in revenue as a percentage. Never a payment amount, a repository's contents, or anyone's identity: the exact figures in the update's table are added by our own code afterwards and are never sent to the model. The finished update is stored with your account, visible only to you, included in your data export and deleted with your account. It is never added to your public page.
Billing. If you subscribe, we keep your plan, its status, its renewal date, and the identifiers Stripe gives your subscription and your Stripe customer record. Card details stay with Stripe. These are deleted with your account, except what tax law requires Stripe to keep.
Investors you invite. On Pro Founder you can create invite links for named investors. An investor who accepts sees your progress in their dashboard: daily activity per tool, streak, projects, and the totals of tools you set to public or investors only, including revenue if you chose that. They never see tools you set to private, repository contents, or anything about your customers. We keep the invite's label, its status and when it was accepted. You can revoke an investor at any time; they lose access on their next page load.
Investor accounts. If you sign in as an investor we keep how you signed in, the name and firm you type, the founders who invited you and when you accepted, your plan, and your preferences (such as the monthly summary). A free investor account follows one founder. Nothing about you is shown to a founder except the name and firm you chose, next to the access they gave you.
What we read from your connected tools, and what we keep
Every connection is read-only. We never gain the ability to write, delete, post, or change anything in a tool you connect, and we ask each tool for the narrowest access it offers for reading. What we compute and store from each one is a count, by day, plus (for payment tools) a total amount in one currency:
- GitHub — commit and pull-request counts, including from private repositories if you install our read-only GitHub App. A private repository's real name is never made public unless you choose to show it under a title you write yourself.
- Stripe, Lemon Squeezy, Gumroad, Mollie, Square, Paddle — how many payments succeeded each day, and their total amount. We never store who paid, an email, a name, or a description of what was bought.
- Vercel, Netlify, Heroku, Render, Sentry — how many deploys (or releases) reached production each day.
- Google Calendar, Google Meet, Calendly, Zoom, Cal.com, Webex, HubSpot — how many meetings with at least one other person happened each day. We never store who attended, the meeting title, or its content.
Credentials you paste (an API key or access token), and the read-only access a tool gives us when you approve "Connect with ..." on its own page, are stored in an encrypted secrets store and are never returned to your browser or to us in plain text after you save them. Disconnecting a tool deletes its stored credential and everything read from it. For Mollie and Square, and for the tools connected through Composio (Google Calendar, Zoom, Cal.com, Webex, HubSpot, Sentry), the permission you give on their own approval page is held by our connection service (named below) instead of our secrets store, and is deleted when you disconnect the tool or delete your account.
What we do not collect, ever
We do not store the name, email, or any other identifying detail of a person who pays you, books a call with you, or otherwise interacts with you through a tool you connect. Revenue and meeting counts are aggregate numbers with no identity attached to them. If a service we read from ever hands back a customer's name or email inside a response, our code is written to discard it before it is stored; if you believe that has failed, tell us at hello@provenfounder.com and we will investigate and fix it.
Who can see it
Nothing about your account is public until you publish your page. Once published, your handle, display name, headline, bio, avatar, the links you add (an email address or phone number only if you add one), company/stage/founded year (if set), your GitHub activity (streak, heatmap, contributions), and project list are visible to anyone with the link. Your connected credentials, the raw list of tools you use, and any private repository you have not chosen to show are never public.
Founder pages show milestone badges (a first payment, 100 production deploys, a 30, 100 or 365 day shipping streak). They are worked out on the fly from the counts the page already shows, only from tools you made public, and nothing is stored for them. A founder sees one more badge for themselves only (the first investor following). Every page carries a small “Made with Proven Founder” link; a Pro Founder can hide it. The link sets nothing and sends nothing until it is pressed.
Each connected tool that feeds revenue, deploys or meetings is yours to set separately, on the Privacy step: public to anyone with the link, visible only to someone who has your separate investor password, or private to everyone. Investor access is off by default and requires a password you set yourself; it can only ever reveal aggregate totals for the kinds you specifically allowed, never anything else about your account, and never a customer's identity.
A more detailed history — which connector, which kind, and how many, for each day: code contributions, deploys, payments (a count, never an amount) and meetings — is off by default and only appears on your page once you turn it on, from the Privacy step. It never includes a time of day, an amount of money, or anything about a customer, and it never appears just because your page is public.
Documents you share with investors (Pro Founder)
Private links. A founder can make a link for one investor that works for 7, 30 or 90 days and that they can withdraw at any moment. We keep only a fingerprint (a hash) of the link, never the link itself, its end date, an optional set of tools, and a count of how many times it was opened. Nobody who opens it is identified: no account, no address, no cookie. It shows only the tools the founder shares at Public or Investors level, and only the ones in that link's set. Opening links is limited per visitor and per link to slow down guessing.
Verified snapshots. A founder can freeze their record as of a day into a page and a PDF with an id. We store that copy (counts and totals of the tools the founder shares with investors, the visible project names, the day and the id) until the founder withdraws it or deletes the account. Anyone who has the id can open it. A private tool or a private repository's name is never in it.
Updates sent to your investors. A founder can email an investor update to the investors who accepted their invite. We read each investor's sign-in address at the moment of sending and do not copy it. The email goes through our mail provider (named below). We record when a preview, an approval and a send happened and how many went out, never the message and never an address. An investor stops the emails from one founder with the link in each message, and we then keep only that founder's id next to that investor's id.
Embeds and the public JSON. A founder with a paid plan can show a card of their record on their own site, and a Pro Founder can offer it as JSON. Both show only what the public page shows and set no cookie. We keep no record of who loads them.
Sharing and posting
We never post on your behalf, on any platform, including X and LinkedIn. Share buttons open your own composer with text filled in; you choose whether to post it. We do not sell or rent your data, and we do not share it with third parties except the infrastructure providers named below, who process it only to run the service.
Who processes it on our behalf
- Supabase — database, authentication, and encrypted secrets storage.
- Vercel — hosting and edge functions.
- Resend — sends the six-digit sign-in code when you choose to sign in with your email address, and the account emails listed above under “Emails we send”. It receives that address and the message, and nothing else: no marketing, no tracking pixels. It also receives mail sent to our contact addresses (hello@, support@) and hands it to us to forward to our own inbox. For a Pro Founder who chooses to send an investor update, it also receives that update and the address of each investor it is sent to.
- Groq, and Cerebras when Groq is unavailable — run the open-source AI model behind your agent and your investor updates (OpenAI's open-weights gpt-oss), only when you use them. They receive the counts described below, nothing that identifies you.
- Nango — the connection service behind "Connect with Mollie" and "Connect with Square": it shows you the approval page, holds the read-only permission you grant, and refreshes it. It receives your account id on our side (no name, no email) and the permission for that tool, nothing from your record. It deletes the connection when you disconnect the tool or delete your account.
- Composio — the connection service behind "Connect with" for Google Calendar, Google Meet, Zoom, Cal.com, Webex, HubSpot and Sentry, and (when we have not switched on our own approval page for them) Stripe, Square, Gumroad and Calendly. The permission it holds can be wider than what we use, because its approval apps ask for the tool's usual permissions; our code only ever sends read requests, and enforces that. It shows you the approval page (which names Composio as the app asking), holds the read-only permission you grant, and sends our read requests to the tool on our behalf. It receives your account id on our side (no name, no email) and the requests for the counts above, and nothing from your record. It deletes the connection when you disconnect the tool or delete your account.
- Stripe — payments for subscriptions. Stripe holds your card details; we never see or store them.
- The tools you connect (GitHub, Stripe, and the others above) — only to answer the read-only requests we make.
Why we may use your data, and where it goes
We process your data to provide the service you asked for (your account, your page, your connected tools, your plan), which is the performance of our contract with you, and for our legitimate interests in keeping the service secure, preventing abuse and understanding in aggregate how it is used. Where we rely on your consent (for example the emails you switch on), you can withdraw it at any time. Our database runs in the EU (Frankfurt). Some processors named above are based in the United States; where personal data is transferred outside the European Economic Area, it relies on the safeguards those providers offer, such as the EU-US Data Privacy Framework or standard contractual clauses.
How long we keep it
We keep your account and record for as long as it exists. Deleting your account deletes your profile, every stored credential, and everything read with those credentials. Onboarding-activity rows are kept for up to roughly a year for the funnel view above, then age out. Page-visit counters are deleted together with your account. If you have a paid plan, deleting your account first cancels the subscription (Stripe keeps its own billing records, as the law requires). A copy of the database is made every night and deleted after 14 days, so a deleted account can remain in a backup for up to 14 days.
Your choices
You can edit or remove anything you typed, disconnect any tool, unpublish your page, export all your data (every plan), export your own daily record and projects as CSV (Founder and above, counts only), or delete your account, from inside the product. If you would rather we do it for you, write to hello@provenfounder.com.
Your rights
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time. Write to hello@provenfounder.com to use any of them; we answer within one month. You also have the right to complain to your data protection authority; in France that is the CNIL (cnil.fr).
Children
Proven Founder is not directed at, and is not knowingly used by, anyone under 16.
Changes to this policy
If this changes in a way that matters, we will update the date at the top of this page.
Contact
Questions or requests: hello@provenfounder.com.
Legal notice
Proven Founder is published by Zack Guerrand, an individual (not a company).
Publication director: Zack Guerrand. Contact: guerrandzack@gmail.com, or hello@provenfounder.com for anything about the product.
Hosting: Vercel Inc. (front end and edge functions) and Supabase (database and authentication; the database runs in the EU, in Frankfurt, Germany). See the list of processors in the Privacy page.