Cookies & Tracking

• The cookies we set are strictly necessary (to keep you signed in and secure) or a single preference cookie that remembers your light/dark appearance.
• Our anonymous site analytics use no cookies — a small first-party beacon, and it is currently off platform-wide.
• We set no advertising cookies and no third-party tracking cookies.
• You can opt out of anonymous analytics for your browser at any time, right on this page.

Foundry uses a small set of first-party cookies, and only for the reasons below:

• foundry_session (strictly necessary) — keeps you signed in after you log in. It is httpOnly and Secure, so browser scripts can’t read it, and it lasts up to seven days.
• foundry_2fa (strictly necessary) — a short-lived cookie used only during two-step sign-in, between the password step and the code step. It is httpOnly and Secure and expires in about five minutes.
• foundry_theme (preference) — remembers whether you chose light, dark, or system appearance so the page renders correctly. It holds no personal data and lasts about a year.
• foundry-demo-session (only if you use our sales demo) — a demo-only gate. It carries no identity, touches no database, and reaches only the self-contained demo.

We do not set advertising cookies, and we do not set third-party tracking cookies. The cookies above are first-party and either strictly necessary or a single appearance preference.

To understand how the marketing site is used, we use a small first-party analytics beacon rather than cookies. It is designed to be anonymous by construction:

• What it can send: the page path (with any query string and fragment stripped off), the referring page, a scroll-depth bucket, time on page, a signup-funnel step, a widget or chat interaction (counts and technical details only — never message content), and a random anonymous identifier so we can tell that a set of page views belonged to one visit without knowing who the visitor is.
• What it never stores: no name, email, or other personal data; no IP address; no browser user-agent. Those are read server-side only to filter obvious bots and rate-limit abuse, and are never saved. Every other field is checked against a fixed allowlist and dropped if it does not match.
• It sets no cookie, is first-party (it posts only to Foundry), and shares no data with third parties.
• It is currently off platform-wide, so today it records nothing at all; it will only begin recording once we explicitly enable it.

Because this beacon is cookieless, anonymous, and off by default, we disclose it here and give you a self-serve opt-out (below) rather than showing a cookie-consent banner.

Your browser can send us anonymous security reports when a page tries to load something our Content Security Policy doesn’t allow. These reports help us tighten the site’s security. They are generated by your browser, set no cookie, carry no account or personal data, and we record only the technical details of the blocked resource.

Anonymous analytics are optional. Use the control below to turn them off for this browser; when it’s off, the beacon will not fire from your browser even after we enable analytics platform-wide.

Whether Foundry will additionally honor a browser-level Global Privacy Control (GPC) or Do Not Track signal is TBD (Ross) — that decision is still being made. In the meantime, the analytics beacon is off platform-wide, and the opt-out above lets you disable it for your browser today.

We may update this page; we’ll change the date above when we do. Questions? Email contact@oba.solutions.