Privacy policy.
What we keep, and why.

Found by Valley (found.joinvalley.co, "Found") is a free directory run by Valley ("Valley", "we", "us"). This policy explains what we collect when you use Found, why, and what you can do about it. Questions: hey@joinvalley.co.

You can browse Found without an account. We don't use advertising or analytics cookies, and we don't build profiles of visitors.

• We count page views of listings, clicks on links to listed sites, and views and clicks of links to Valley, as daily totals per listing or per link. These totals aren't linked to you.
• Our host, Cloudflare, processes your IP address and browser details to deliver the site and protect it from abuse.
• To limit abuse (for example, too many sign-up attempts), we store a salted, one-way hash of your IP address for up to about 25 hours. We can't turn it back into your IP address.

• Your email address and name, and a username we create from your name.
• If you sign in with Google or GitHub: the name, email and profile photo they share with us.
• If you use a password: only a salted hash of it. We never store or see your password itself.
• Sign-in sessions. We deliberately don't store your IP address or browser in them.
• Whether your email is confirmed, and whether you want the weekly stats email.

Listings are public. Everything you submit for a listing (name, tagline, description, website, logo, screenshots, tags, social links, pricing note, team size, starting price, launch date) is published once we approve it. Your name, username and photo appear as "Built by" on your listings.

Some answers, like who you sell to, aren't shown publicly. We use them to decide what to show you.

If you report a listing, we keep the reason, your note and your account so we can follow up.

Our crawler (FoundBot) visits the website you list to read public details such as its title, description and logo, to check that it's still reachable (weekly), and to check for the Found badge (daily) if you add it. It only reads public pages.

• Cloudflare: hosting, database, file storage, email delivery and bot protection (Turnstile checks that you're human on sign-up and submit forms).
• Google and GitHub: only if you choose to sign in with them.
• DeepSeek: only if you click "Write it for me" on the submit form, we send your website's public text to draft your listing. Nothing is sent unless you click it.
• YouTube (Google): only if you press play on a listing's demo video. The player loads from youtube-nocookie.com at that moment, not before.

We don't sell your personal data. We share it only with the providers above, or when the law requires it.

Found is a Valley project, so you'll see messages about Valley on Found and a short note about Valley in some emails. Links from Found to joinvalley.co carry tags so Valley knows the visit came from Found; they don't identify you.

We don't add you to Valley's marketing lists or share your Found account with Valley's product.

We send emails you need: sign-in links, email confirmations, password resets, the outcome of your listing's review and badge status. If your listing gets visitors, we also send a weekly stats email; every one has a one-click opt-out, and you can turn it off in your dashboard.

• A sign-in cookie that keeps you logged in (up to 30 days) and a short-lived cookie (5 minutes) that speeds up session checks. Only set when you sign in.
• On your device only (local storage): your theme, a saved draft of the submit form, your motion preference, whether you've copied your buyer brief, the listings you save to your shortlist, and when you last visited (to mark what's new).

No advertising or third-party tracking cookies.

• Your account, until you ask us to delete it.
• Listings, until you or we remove them. Sites that stay unreachable for 60 days are archived.
• Sessions: up to 30 days. Sign-in, reset and confirmation links expire within 15 minutes to 24 hours.
• Hashed IP addresses for abuse limits: about 25 hours.
• Daily view and click totals, which contain no personal data, for as long as they're useful for stats.

You can edit your listings from your dashboard at any time. To see, correct, export or delete your data, or to object to how we use it, email hey@joinvalley.co. We'll reply within 30 days.

If you're in the EEA or the UK, you have rights under the GDPR, including access, correction, deletion, portability and objection, and you can complain to your data protection authority. If you're in California, we don't sell or share your personal information for targeted advertising.

Found runs over HTTPS. Passwords are hashed, IP addresses used for abuse limits are hashed, and only Found's administrators can see account data.

Found is for founders, makers and agencies. It isn't meant for anyone under 16, and they shouldn't create an account.

Cloudflare runs a global network, so your data may be processed outside your country.

If we change this policy, we'll update the date above. For important changes, we'll email account holders first.