Privacy policy
This policy covers the Foundry Android app (package com.simkinselgazar.foundry), the Foundry Cloud service it signs in to, and this website. It is published by Simkins & Elgazar LLC, a Virginia limited liability company (“we”, “us”). Questions go to hello@simkinselgazar.com.
The short version
- On first launch Foundry creates an account for your phone by itself, with no email or name, so the free tokens are ready. The two included apps and everything you make stay on your phone.
- Signing in is optional and ties that account to you: with Google we receive the email address and name Google shares; with an email code, just the email address.
- We read one identifier from your phone, Android's per-app device ID (ANDROID_ID), so that the free tokens are granted once per phone and not once per reinstall.
- When Foundry makes or changes an app, the words you typed, the app's code, and screenshots of the app running are sent to an AI model through our servers. We do not store that content; we count it.
- We do not show ads, we do not sell data, and the app contains no advertising or analytics software.
- You can delete your account from inside the app, and everything it holds goes with it.
What we collect, and why
Your Foundry Cloud account
| Data | Why | Where |
|---|---|---|
| Account id | Created automatically on first launch so the app can hold your tokens before you sign in. It carries no email or name until you sign in. | Our authentication service (Supabase). |
| Device identifier | Android's per-app device ID (ANDROID_ID), sent once when the account is created, so the free tokens are granted once per phone. Used only to prevent abuse; never for advertising or tracking across apps. | Our database, kept after the account is deleted so a deleted account cannot claim the free tokens again. |
| Email address and name | Only if you sign in: with Google, the email address and display name Google shares with us; with an email code, the address you type. Used to recognise you on a new phone and to reach you about your account. | Our authentication service (Supabase). |
| Handle and display name | So friends can find you and so shared apps say who they came from. You choose both. | Our database. |
| Session tokens | To keep you signed in without a password. | Encrypted on your phone, never in plain text. |
| Token balance and ledger | To know what you can make and to show you every grant, charge and refund. | Our database. |
| Build records | For each app you make or change: the kind of build, the id the app uses for the project, when it started and ended, how many AI calls it made and how many AI tokens they used, and whether it finished, failed or was refunded. | Our database. |
| Friends | Who you asked to be friends with, who asked you, and whose request was accepted. | Our database. |
| Shared apps | When you share an app: its name, description, icon, the words it was made from, and its code, held until your friend picks it up or 24 hours pass. | Private storage on our servers; deleted on claim or expiry, and in any case within seven days. |
| Daily question count | A per-day counter of the free questions apps you made asked the AI, so the free allowance can be enforced. | Our database. |
We do not collect your name, phone number, contacts, photos, precise location, or anything from your phone's sensors. Apps you make may ask you for the camera, microphone or location (see below), but what they capture stays in that app on your phone unless the app sends it to the AI as part of a question you asked it to answer.
What the AI receives
Foundry Cloud does not run AI models itself. It relays each request, with our own API key, to OpenRouter, Inc., which routes it to the model provider that serves the model we have chosen (currently a DeepSeek model). The content of a request is:
- When you make or change an app: the description you typed, the app's current code, Foundry's instructions to the model, and the results of trying the app: screenshots of it running in a hidden window on your phone, its layout measurements, and any errors it printed. These screenshots are of the app being built, not of your screen.
- When an app you made asks the AI a question (after you allowed it to): the question the app composed, which may include text you typed into that app and, if the app was built to do so, an image from that app, for example a photo you took inside it.
Our servers pass this content through without storing it. We record only the number of calls and the number of AI tokens each call used, against the build it belonged to. OpenRouter and the model provider process the content under their own policies: OpenRouter states that it does not use inputs or outputs for training, and that some model providers may retain inputs and outputs or use them for training under their own terms. Please do not put passwords, financial details or other secrets into an app description or into an app that asks the AI questions. See OpenRouter's privacy policy.
On your phone only
- The apps you make, every version of them, and the data each one saves.
- Each app's permission answers, and the apps that came with Foundry.
- Your sign-in session, encrypted with the phone's hardware-backed key store.
- A technical log of what Foundry did, kept on the phone for troubleshooting and never sent anywhere.
- Android's own backup may copy the apps you made to your Google account along with the rest of your phone, under Android's backup encryption; your sign-in secrets and the log are excluded. You control that in Android's backup settings.
Foundry asks for Android's notification permission only to tell you when an app is ready. Camera, microphone and location permissions are declared so that apps you make can use them, and each app asks you before its first use. Saying no never stops Foundry itself from working.
Server logs
Each request to Foundry Cloud leaves a log line: the route called, your user id, the result code, timing, the model used, and the counts above. Logs are kept briefly for troubleshooting by our hosting provider and deleted automatically; they do not contain the content of your requests. Like any internet service, our providers see your IP address when your phone connects.
This website
This site is static. It sets no cookies, runs no analytics, and makes no requests to third parties. Our hosting provider (Amazon Web Services) keeps standard access logs, including IP addresses, for a limited time.
How we use it
- To sign you in and keep you signed in.
- To make and change your apps when you ask, and to charge or refund the tokens for it (100 for a new app, 25 for a change, refunded in full if the build fails).
- To deliver apps you share to the friend you chose, and nobody else.
- To enforce fair-use limits, prevent abuse, and keep the service running.
- To answer you when you write to us.
We do not use your data for advertising, we do not build profiles, and we do not sell or rent it to anyone.
Who else sees it
| Provider | What they handle |
|---|---|
| Supabase, Inc. | Hosts our authentication, database and file storage, and sends the sign-in code emails. Processes data on our behalf. |
| Google (Sign in with Google) | If you choose it, Google confirms who you are and tells us your email address and name, under Google's privacy policy. |
| OpenRouter, Inc. and the model provider it routes to | Receive the content of AI requests described above, in the United States or wherever the provider runs. |
| Google (Google Play) | Distributes the app. If and when token packs are sold, Google processes the payment; we receive a purchase record, never your card details. |
| Amazon Web Services | Hosts this website. |
Beyond these, we disclose data only if the law requires it, to protect our rights or someone's safety, or to a successor if the business changes hands, in which case this policy continues to apply.
How long we keep it
- Account data, balance, ledger, build records and friends: until you delete your account.
- Shared apps: until claimed or 24 hours after sharing, with a final sweep within seven days.
- Purchase records, once tokens are sold: for as long as tax and accounting rules require, without your email or handle once the account is deleted.
- Server logs: a short, fixed period set by our providers, then deleted automatically.
Security
Every connection uses TLS. Our AI key never leaves our servers; the app does not hold it. Your session is encrypted at rest on your phone. The database is locked down so that the app can only read its own rows, and all changes go through our server code. No system is perfectly secure, so if we ever learn of a breach that affects you we will tell you.
Your choices and rights
- Sign out at any time in Settings. This removes your session from the phone.
- Delete your account in Settings, or by email; see Delete account. Everything in the first table above is deleted except the device identifier, and every app on your phone is deleted with it.
- Delete an app by holding it on the home screen. The app and its saved data are removed from the phone.
- Permissions for each app you made can be changed in that app's settings, and for Foundry itself in Android's settings.
- Access, correction, portability, objection. Email us and we will send you what we hold, correct it, or delete it, within 30 days. We may ask you to confirm from the email address on the account.
If you live in the European Economic Area or the United Kingdom, the GDPR gives you these rights and the right to complain to your data protection authority; our legal basis is performing our contract with you and, for security and abuse prevention, our legitimate interests. If you live in California, the CCPA/CPRA gives you similar rights; we do not sell or share personal information as those terms are defined there, and we do not discriminate against you for exercising your rights.
Children
Foundry is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, email us and we will delete it.
Where data is processed
We are in the United States, and so are our providers. If you use Foundry from elsewhere, your data is transferred to and processed in the United States.
Changes
When this policy changes we update the date at the top. For changes that matter to you, such as a new category of data or a new provider, we also tell you in the app or by email before they take effect.
Contact
Simkins & Elgazar LLC, Virginia, USA. hello@simkinselgazar.com.