Privacy policy
Last updated 12 August 2026
Cofound is a multiplayer workspace where a team runs an AI coding agent together. That means it holds your code, your prompts and a record of what the agent did. This page says exactly what is stored, who else can see it, and when it is deleted.
Who runs this
Cofound is operated by Shravan Anand. For data protection purposes that is the data controller. Contact: shravan.anand.2026@gmail.com.
What is stored, and why
| What | Why | Kept for |
|---|---|---|
| GitHub name, username and avatar | To sign you in and to show who is in a project | Until you ask for deletion |
| A signed session cookie | To keep you signed in. It carries an identity, not a credential | Until it expires or you sign out |
| Project files | They are the project. The agent reads and edits them | 30 days after a project is last used |
| Prompts, agent transcripts and run feeds | So the agent remembers the conversation and teammates can see the work | 30 days after last use, and trimmed as they grow |
| A GitHub access token, if you connect one | To import repositories and open pull requests | 90 days, or until you disconnect |
| Token counts per model, per month | To know what the service costs to run | 400 days. It is a count, with no prompt content |
| Commands run on a connected machine, and their output | So the agent can read the result and teammates can see it | With the run feed, 30 days |
What is deliberately not stored
- Your GitHub password, and any other password. Sign-in goes through GitHub and Cofound never sees credentials.
- Private repository contents. The GitHub permission requested is
public_repo, which cannot read private code. That is a deliberate ceiling: a breach of this service cannot expose private source because the token was never able to read it. - The contents of a connected machine. If you run the local runner, its working directory stays on your machine. Only the command, its exit code and its output are sent.
- Environment variables from a connected machine. The runner masks the values of variables whose names look like secrets before any output leaves your computer.
Who else sees your data
Cofound cannot do its job without sending your prompts and the relevant parts of your project to a model provider. That is the core of the service rather than an optional extra, and it is worth being plain about.
- Microsoft Azure OpenAI receives prompts, project file contents and agent transcripts in order to generate responses.
- Anthropic receives the same, if you supply your own API key for that path.
- Vercel hosts the service and processes requests.
- A managed Redis provider stores everything described above.
- Liveblocks carries live presence and cursor positions. It does not carry file contents.
- GitHub handles sign-in, and repository reads and writes you ask for.
Your data is not sold, and it is not used for advertising. Cofound does not train models on your code. Whether a provider does so is governed by that provider's terms, and their policies are the ones that apply to data once it reaches them.
Teammates see your work, by design
Sharing a project with someone lets them read and edit its files, run the agent, and read the full history of prompts and agent activity, including anything printed by commands run on a connected machine. This is the point of a multiplayer workspace, and it is worth saying explicitly because it surprises people: a prompt you type is visible to everyone in the project.
Legal basis
Where UK or EU data protection law applies, the basis for processing is performance of a contract, in that the service cannot be provided without it, and legitimate interests for keeping usage counts and diagnostic logs to operate the service safely.
International transfers
The service and its providers process data in the United States. If you are in the UK or the EEA, that involves a transfer outside your jurisdiction, made in reliance on the relevant providers' safeguards.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, or object to processing. Email shravan.anand.2026@gmail.com and it will be dealt with within 30 days. Two things you can do immediately without asking:
- Disconnect GitHub from the Import dialog, which deletes the stored access token.
- Stop using a project. Its files and history are deleted 30 days later automatically.
Security, stated honestly
Access to a project is checked on every request rather than assumed from a link. Tokens are stored server-side and never sent to the browser. Beyond what the hosting and database providers offer, there is no additional encryption at rest, and this is stated plainly rather than implied otherwise. The protection that matters most here is the narrow GitHub permission described above.
Children
Cofound is not intended for use by anyone under 16.
Changes
If this policy changes in a way that affects what is collected or who receives it, the date at the top changes and the change will be described here.