Your thoughts.
Handled thoughtfully.

A small project with a straightforward data footprint.

What you send

When you run a live simulation or ask a follow-up question, your question, audience, context, generated discussion, and relevant conversation history are sent from this server to RouterHub and its model provider. The default model is Google Gemini 4 Argon. Provider retention, logging, and training practices depend on their policies and account settings; Foundate cannot promise zero retention or no training.

Read RouterHub’s privacy policy and Google’s privacy policy. Do not enter sensitive personal information, passwords, confidential business material, or data you do not have permission to share.

Your account

Accounts are optional. Email accounts store your name, email address, a one-way password hash, a hashed recovery code, and creation time in a private SQLite database outside the website’s public directory. Emails are not verified. We do not send reset emails: keep your one-time recovery code private. Using it resets your password, replaces the code, and invalidates older account sessions. Wallet accounts store a public Solana address, an automatically assigned display name, and creation time. Account identity is not sent to the AI provider as part of your briefs.

Wallet sign-in

The browser detects compatible Solana providers, including Wallet Standard wallets and native Phantom or Solflare providers. Connecting shares your public address with this site. You then approve a domain-bound, one-time sign-in message, valid for five minutes. PHP sodium verifies its Ed25519 signature. We never request a transaction, spending permission, private key, or seed phrase. We do not query balances or wallet history. Ethereum-only providers are excluded. Wallet extensions handle your connection and signature approval under their own policies. Disconnecting a wallet does not end a Foundate session; use Sign out too.

Temporary server sessions

A necessary, HTTP-only SameSite session cookie protects requests against cross-site submission, remembers your sign-in, and links the steps of a live run. Sign-in expires after two hours of inactivity, or sooner if the host removes the session. Recent intermediate prompts and generated outputs are held in PHP session storage, with an application expiry of two hours. Expired run data is cleared on the next studio or API request; underlying session-file deletion follows the host’s session garbage-collection settings. Hosting providers may retain request logs, including IP addresses, according to their policies.

Abuse prevention

The AI backend stores short-lived counters keyed by a hash of the connecting IP address, plus a site-wide daily counter, in the server’s temporary storage. Account endpoints also store hashed IP/email rate-limit buckets in the private database, expiring after 15 minutes to one hour. Expired counters are removed on subsequent requests. They contain no prompt text or plaintext passwords.

Account deletion

Use Account → Delete this account to permanently remove the active account record, including its email or wallet address and credential hashes. Email accounts require their current password; wallet accounts require a sign-in within five minutes. This does not delete browser-saved briefs, already-exported files, provider logs, hosting logs, or existing backups. Backup retention is controlled by the hosting owner. Signing out alone does not delete your account.

Saved on your device

Completed briefs and follow-up conversations are saved in browser local storage only when “Save on this device” is enabled. They are not protected by a password. Anyone using this browser profile can read them. Use “Saved briefs” → “Delete all” to remove them, or clear this site’s browser storage. Unchecking the option stops future saves; it does not remove existing briefs.

No tracking extras

Foundate has no analytics, advertising scripts, third-party embeds, or marketing forms. Fonts and images are served locally. The example simulation runs entirely in your browser. External links, including X, have their own privacy policies.

Use with care

All simulated participants are fictional. Foundate is an exploratory tool, not professional advice or a validated predictor of human behaviour. You are responsible for checking outputs before acting on them.

Get in touch

For privacy questions, contact James He via @james_k_he on X or the contact details on his personal website. Do not send sensitive information in a public post.