Founder Mode

Privacy

Privacy policy

Effective date: 2 September 2026
Applies to: the Founder Mode game (com.getfoundermode.app) and this website.
Published by: Stefan Sathianathen

This policy is written to be checked rather than believed. Where a claim corresponds to something in the source code, the file is named so you can go and look. Where something is configured but not currently switched on, it says that too, in those words, instead of pretending the code is not there.

The short version

  • The game is single-player and runs entirely on your device. There is no game server and no account.
  • Your saved games and settings never leave your device, except by two deliberate presses of your own: sharing your end-of-run result, and sharing the diagnostic log (both in §1).
  • There are no ads, no ad identifier, no tracking, and no analytics of any kind.
  • There are no in-app purchases and no subscription.
  • The app asks for no location, camera, microphone, contacts, photos, health or calendar access. The only permission it ever asks for is notifications, and only if you turn reminders on yourself.
  • Two things in the game can involve someone else, and each has its own section below: Apple Game Center (iOS, on by default) and crash reporting (on by default, and you can turn it off). The mailing list on this website is not open and collects nothing.

1. The game runs on your device

The whole simulation — the company, the market, the employees, the money — runs locally. The app makes no network request in order to play, and none of your progress is uploaded anywhere. There is no cloud save.

On iOS and Android the app writes to its own sandboxed storage (AsyncStorage), which is removed when you delete the app. On the desktop build it uses the same local browser storage mechanism (localStorage). Nothing in the table below is transmitted.

WhatWhereLeaves the device?
Your saved runs (the store keeps at most five slots) foundermode_saves_index, foundermode_save_*No
A backup copy of a save that failed to load, and the store's own version marker foundermode_saves_corrupt_*, foundermode_save_store_versionNo
App settings and preferences — the crash-reporting choice, the reminders choice, and the interface's own state: cards you deferred, a log of decisions you took, bets you are following, which screens and coach marks you have seen, and the dates you last read the log foundermode_mobile_uiNo
Sound on/off and volume foundermode_audio_settingsNo
Which badges you have ever earned, so they survive starting a new company foundermode_lifetime_badgesNo — but see §3b
Which one-time celebrations you have already been shown, so that starting another company does not congratulate you on your first hire a second time foundermode_lifetime_milestonesNo
A short diagnostic log of the last few occasions when the game clock got stuck (a game-day number, decision types, counts and a build id — no game state and no text you typed) foundermode_stuck_clock_log Only if you choose to share it — see below

Everything you type into the game — your company name, your founder's name, product names, save-slot names — is part of that local state, and nothing in the app uploads any of it on its own.

The two things you can choose to send

Both are buttons you press, both open your device's ordinary share sheet, and both then go wherever you send them. The app has no destination of its own for either.

  • Your end-of-run result. When a run ends, the ending screen offers a share button. The text it hands to the share sheet names your company, along with your peak valuation, team size, how long you lasted and how it ended. It contains no other typed text and no save data.
  • The diagnostic log, described next — identifiers and numbers only, and no typed text at all.

The diagnostic log you can choose to send

The game keeps a short record on the device of times the simulation clock stopped when it should not have. It is stored as identifiers and numbers only: anything that is not a plain identifier is dropped before it is written, so text you typed cannot end up in it. Nothing sends the log itself automatically. Settings has a button that opens your device's normal share sheet with the text in it, so you can send it to us if you want to report a bug — at which point it goes wherever you send it.

One honest qualification: the same stall event — the same identifiers and numbers, not the log file — is also handed to the crash reporter as it happens. Crash reporting is on unless you turn it off (§3a), so that event is sent with the crash reports — and if you have turned crash reporting off it goes no further than the device.

Reminders

The game can remind you that a run is waiting. This is off by default. If you turn it on in Settings, the device asks you for notification permission at that moment, and nowhere else. The reminders are local — scheduled on the device by the app itself. There is no push server and the app never obtains a push token, so no notification identifier for your device exists anywhere. The reminder text can mention your company's name; it is composed on the device and never leaves it.

Over-the-air updates

The app can download a new JavaScript bundle from Expo's update service (expo-updates), and checks for one each time it starts up and each time you bring it back to the foreground (Settings has a manual check too). That is a download: the app asks for the current bundle for its build and receives it. Nothing about your game is sent with the request. Ordinary server-side request metadata — such as the IP address any download involves — is handled by Expo as part of delivering the file.

2. What is not collected

Stated explicitly, because "we take your privacy seriously" is not information:

  • No name, email address, phone number, postal address or date of birth is collected by the app. (The mailing list on this website is a separate thing and is covered in §4.)
  • No contacts, photos, camera, microphone, location, health data or calendar. The app declares no usage-description strings for any of them, because it uses none of them. The one permission it can ask for is notifications, and only at your request.
  • No advertising identifier (IDFA), no device fingerprint, no persistent user id. The app's iOS privacy manifest declares NSPrivacyTracking: false with an empty tracking-domain list, and a test in the repository enforces that.
  • No purchase history. There is no in-app purchase or subscription code in the app.
  • No analytics events, no funnels, no session recording, no screen recording, no heatmaps. There is no analytics package in the app's dependencies.
  • No third-party advertising, attribution or marketing SDK of any kind.

3a. Crash reporting — on by default, and you can turn it off

Crash reports are sent. The reporting library is compiled into the app, and it starts only if two things are both true: the build carries a reporting endpoint (EXPO_PUBLIC_SENTRY_DSN) and you have left crash reporting switched on. The build configuration now sets that endpoint, so the first condition holds. If you switch crash reporting off, the reporter is never initialised at all and no network call is made — it is not "started and then filtered" (mobile/src/lib/telemetry.ts). The app's Settings screen says which state you are in on the switch itself.

Switching this on was a material change: the effective date at the top of this page is the date it took effect, and the change is noted in the release notes for the version that introduces it.

The service is Sentry, a diagnostics provider. Apart from Apple Game Center and the update check, crash reports are the only thing the app sends anywhere on its own.

Whether it is on

  • It is opt-out and on by default.
  • You can turn it off at any time: Settings → Anonymous crash reports. Turning it off shuts the reporter down immediately for the current session as well as future ones.

What a report contains

Reports are not built by taking everything and removing the sensitive parts. They are rebuilt from an allowlist — a fixed list of fields is copied into a new report and everything else is discarded, so a field nobody anticipated is never sent (mobile/src/lib/telemetryScrub.ts). A report may contain:

  • the error type, message and stack trace (file names, function names, line and column numbers);
  • the app version, build number, and which JavaScript bundle was running;
  • the device model and family, its maker and brand, the OS name, version and kernel version, the CPU architecture, and whether it is a simulator;
  • which over-the-air update the app was running: the update's identifier, its release channel, the runtime version, how long it took to launch, and whether it fell back to the built-in bundle;
  • a short trail of the last few actions before the failure, limited to five categories: which screen you were on, that a decision of a given type was made, that a save or load happened, engine events, and app foreground/background;
  • a small block of anonymous counters and enumerations — how many employees exist, what stage the run is at, how many decisions are pending. Numbers and fixed keywords only.

What a report does not contain

  • Not your saved game, in whole or in part.
  • Not your device name. On iOS this is typically a person's real name ("Alex's iPhone"); it is explicitly excluded, along with battery level, free storage, timezone and language.
  • Not text you typed. In addition to the allowlist, your company name, company tagline, founder name and product names are replaced with [redacted] anywhere they appear in the free-text fields that do survive.
  • No screenshots and no view hierarchy — both explicitly disabled.
  • No session replay, no performance tracing, no profiling.
  • No console log capture, no local variables, no source lines from the crash site.
  • No identity. The app never sets a user, and sendDefaultPii is false.

One honest limit: a hard native crash is captured by the operating-system-level part of the reporting library and written to disk before the app's own filter can run. Those reports are constrained by the settings above (no user, no screenshot, no view hierarchy, and breadcrumbs that were already filtered before being recorded) rather than by the rebuild step.

How long they are kept. Sentry retains crash reports for 30 days, after which they are deleted. That is the error-event retention period of the plan this project is on; it is fixed by the plan rather than chosen by us, and Sentry applies it at the moment a report is received, so a later plan change would only affect reports received after it. Sentry processes the reports on our behalf as a service provider. Nobody else receives them. They are not sold, not shared for advertising, and not used to build a profile of you — they are read to fix bugs.

Sentry's Prevent Storing of IP Addresses setting was switched on for this project on 2026-08-31, before any build carrying a reporting endpoint was made. [PLACEHOLDER: one thing remains — verify on the first real event that no IP address and no IP-derived location is attached; the setting being on is not by itself proof of that. Then replace this note.]

3b. Apple Game Center — iOS, on by default

The game keeps a record of the badges you have earned on your device, and it also reports them to Apple Game Center so they live on your Apple ID rather than dying with a save file. There are 21 achievements and 3 leaderboards: your best run's score, your highest company valuation, and your fastest IPO.

  • It is on by default and there is no setting in the game to turn it off. On iOS the app asks Game Center to sign you in when it starts. It is Apple's own sign-in prompt, and declining it is what turns this off — as is turning Game Center off for your Apple ID in iOS Settings. On Android there is no Game Center and nothing happens.
  • What is sent to Apple: the identifier of an achievement at the moment you first earn it, and — once, when a run ends — a score for each of the three leaderboards. That is identifiers and numbers, nothing else. No save data, no company or founder names, no text you typed.
  • Apple receives and holds it, not us, under Apple's privacy policy. Whether your Game Center nickname and achievements are visible to friends or to everyone is controlled in iOS Settings, not here.
  • Because an achievement cannot be withdrawn once reported, only badges you have genuinely earned are ever sent, and nothing is ever un-sent.
  • Your on-device badge record is the source of truth either way. Game Center is an additional destination, never the record.

Current status: none of this is switched on, and nothing is sent to Apple. As of 31 August 2026 the Game Center component is not built into the app — the native part is parked outside the build and the entitlement is not requested. So the sign-in prompt above does not appear, no achievement or leaderboard identifier leaves the device, and nothing has been created in App Store Connect for it to report into. Your badges are kept on your own device and nowhere else, and they still survive starting a new company.

This section is kept, in full, describing the behaviour as built — both because the code is still in the app and would begin working the moment the component is switched back on, and because it should be documented before that happens rather than after. Turning it on is a material change and is handled as one (§8).

4. The mailing list on this website

The game does not have a mailing list and cannot reach one. This website has a signup form in the source, but the list is not open. The page's signup endpoint is empty, so visitors see a notice that the list is not open rather than a form. Nothing is collected, because there is nowhere for it to go.

If a provider is ever configured, this section will name who receives the address, and the home page will show a form. Until then there is no third-party mailing-list processor in play.

The rest of this website

This site sets no cookies and runs no analytics, no tag manager and no tracking pixels. It loads its fonts from Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com; Google receives the ordinary request metadata that involves, including your IP address. Nothing else on the page talks to anyone. The site is hosted on Cloudflare Pages, whose servers keep ordinary web-server request logs.

5. Apple's privacy label

Crash reporting is declared as Diagnostics → Crash Data and Diagnostics → Other Diagnostic Data, both used only for App Functionality, both not linked to you, and not used for tracking. The app transmits both, unless you turn crash reporting off — see §3a.

Game Center is Apple's own service and the data it handles is covered by Apple's privacy policy rather than collected by us, but the App Store questionnaire is answered on the basis that the app does report achievement and leaderboard identifiers to it. See §3b.

6. Children

Founder Mode is a business simulation intended for a general audience of teenagers and adults. It is not directed at children under 13 (or the equivalent age in your country, such as 16 in parts of the EEA), and we do not knowingly collect personal information from children. The game collects no personal information from anyone, and this website does not collect email addresses.

7. Your choices and your rights

  • Delete everything the game holds by deleting the app. Every save and every preference goes with it. There is no server-side copy to request or erase.
  • Turn off crash reporting in Settings → Anonymous crash reports.
  • Access, correction, erasure, portability. If you are somewhere that grants these rights — for example the UK or EU under the GDPR, or California under the CCPA/CPRA — you can exercise them by contacting us. There is no mailing-list subscription to leave. In practice the only off-device record we could hold about you is a crash report (Sentry, 30 days), and only if you leave reporting on: there is no account, no identifier and no profile.
  • We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not engage in cross-context behavioural advertising.

Where the GDPR applies, the legal basis for crash reporting is our legitimate interest in keeping the app working, subject to the opt-out above.

8. Changes to this policy

If this policy changes, the new version replaces the one at this address and the effective date at the top is updated. Material changes — anything that adds a category of data collection, a new recipient, or a new purpose — will also be noted in the release notes of the app version that introduces the change, so it is visible before you take the update. Enabling crash reporting (§3a) was a material change, and going live with Game Center (§3b) will be another, and both are handled that way.

9. Contact

Questions about this policy, or about privacy in Founder Mode:
ssathianathen@gmail.com

Before this page is published

Remaining: [PLACEHOLDER: verify on the first real event that no IP address and no IP-derived location is attached] — the Sentry note in §3a. The setting is on as of 2026-08-31; what remains is checking a real event, because the setting being on is not by itself proof that IP-derived geolocation is dropped. Host this page at a public HTTPS URL, then check it still agrees with mobile/PRIVACY.md and with the code — see site/README.md §4.