Your data, in plain language.

• Your email address.
• What you are looking for (a wife or a husband).
• Optional: your region in the US, and your age band.

We set a cookie named found_waitlist_id in your browser so you can return to your status page without re-entering your email. It is HTTP-only, same-site lax, and expires after ninety days.

• Your email address (used as your login).
• Your first and last name.
• Your date of birth.
• Your region in the US.
• Your role (whether you are looking for a wife or a husband).

Account creation is invite-only during the founding cohort. We authenticate you with one-time email links (“magic links”). We do not store a password, because there is no password.

• A short written bio.
• Whether you have been married before.
• Whether you have children, and whether you want children.
• Your stated marriage intent.
• Up to six photos.

Photos are stored in a private bucket. They are served to your match through signed, time-limited URLs, and they are never made available to anyone outside your active match or our review team.

Identity verification happens through a third-party identity provider (currently Stripe Identity). You upload a government-issued ID and a selfie to that provider, not to us. We receive only a verification status (pending, verified, or failed) and a reference identifier. The ID document itself stays with the identity provider under their own privacy policy.

• Your queue status (idle, queued, matched, or paused).
• Your active match, if any, including the timestamps for your “continue” and “ready to meet” signals.
• A history of your past matches, for safety and audit purposes.

• The full content of your messages with your match.
• Timestamps and read receipts.

Messages are immutable once sent. Neither you nor we can edit the body or change the sender after the fact. This is a safety property, not a feature. We retain message history for the life of the account so our trust-and-safety team can triage reports honestly.

• The reason and notes you provide.
• The match the report relates to.
• The identifier of the person you reported or blocked.

• The last time you were active in the application.
• The last time we sent you certain emails (to throttle frequency).
• Standard server logs (IP address, user agent, timestamp) retained briefly for security and abuse prevention.

• We do not run third-party advertising trackers.
• We do not run product analytics tools (such as PostHog, Segment, or Mixpanel) at this time.
• We do not run third-party error reporting (such as Sentry) at this time. If we add it for stability reasons, we will update this policy.
• We do not collect your contacts, calendar, precise location, or any data from outside the Found application.
• We do not use your profile, your messages, or any other content you create on Found to train artificial intelligence or machine-learning models.

• Supabase. Our database, authentication, file storage, and realtime provider. Hosts your account data, your profile, your photos, and your messages.
• Resend. Sends our transactional email. Receives the recipient email address, the subject line, and the body of the message being sent.
• Stripe Identity. Verifies your government-issued ID and selfie. Holds the documents you upload, and returns a verification status to us.

Each vendor has its own privacy policy and processes your data under a contract with us. If we add a subprocessor, we will update this list and (for material additions) notify active members by email.

During the founding cohort, the founder personally reviews every application, every report, and every block. As the service grows, additional reviewers will join under written confidentiality obligations. Reviewers see your profile, your photos, your match history, and the messages directly relevant to a report.

We will disclose information when required by valid legal process, when we believe it is necessary to protect someone from imminent harm, or when we believe it is necessary to defend our rights. We will tell you about a request unless legally prohibited from doing so.

If Found is sold, merged, or otherwise reorganized, your information may transfer to the successor entity. We will notify you in advance, and you will retain the rights described in the next section.

The Texas Data Privacy and Security Act gives Texas residents the rights listed above plus the right to appeal a denial. We do not sell personal information, we do not engage in targeted advertising, and we do not engage in profiling that produces legal or similarly significant effects, so the related opt-out rights do not apply to our use.

California residents have the rights listed above. We do not sell or share your personal information for cross-context behavioral advertising. We do not use sensitive personal information for any purpose beyond what is necessary to provide the service you signed up for.

To protect your account, we may ask you to confirm your identity before fulfilling a request. If we cannot verify the request, we will tell you why.