Privacy notice
Last updated: 16 October 2026
Foundry is a component showcase. There are no accounts and nothing to sign up for, but visiting it still leaves a few traces, and this page lists all of them.
Who's responsible
I'm Michael Shreeves, and I run Foundry as an individual, not a company. That makes me the controller for everything below. Email hello@mashreeves.com with any question or request about your data.
What's collected, and why
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Server logs: IP address, browser, page requested and time for every visit, plus the page and technical detail of any request that went wrong | Keeping the server running, fixing faults and spotting attacks | Legitimate interests (security and running the service) | Visit logs: 14 days. Error details: the 14 most recent days on which something went wrong |
| Analytics: pages viewed, the page you came from, browser and device type, rough location, IP address, shortened before it's stored (the last two parts are removed) | Seeing which components people actually look at | Legitimate interests (improving the catalogue) | Individual visit records 13 months, then deleted; only totals that identify nobody are kept longer |
| Session: anything you change in the demos, including any email address you type into the invite form on the settings page, and the organisation name, email address and postcode you enter in the demo checkout | So the demos remember your edits as you click around | Legitimate interests (making the demos work) | Until you close your browser; the server's copy goes after 30 minutes without use |
| Your theme choice (Light, Dark or High contrast) | So the page doesn't flash the wrong colours next time | Legitimate interests (remembering a setting you chose) | One year, or until you choose System |
| IP address, held by rate limiters on the support form and the push demo | Stopping those forms being used to flood anyone | Legitimate interests (preventing abuse) | 15 minutes to 1 hour |
| A push subscription: an address and two keys your browser issues, only if you turn notifications on in the push demo | Sending the test notification you asked for | Consent, given through your browser's own prompt | Up to 30 days. Deleted straight away if you turn notifications off on that page |
The support form and the feedback form on the forms page look like they send something. They don't. What you type is checked and then thrown away; nothing is stored, logged or emailed. The analytics set no cookie.
Cookies
| Name | Purpose | Category | Expiry |
|---|---|---|---|
PHPSESSID |
Holds your demo edits and the security tokens forms need. Only set on pages with a demo or a form | Strictly necessary | When you close your browser |
__Host-csrf-token_… |
A one-off security token proving a form was sent from this site. Set when you submit a form, deleted straight after | Strictly necessary | Seconds |
fo_theme |
Remembers the theme you picked. Only set if you pick one | Strictly necessary | One year |
fo_shell |
Remembers how you set the page up in Customise: colour, font, skin, menu layout, width and spacing. Only set if you change one, and cleared if you reset to the defaults | Strictly necessary | One year |
Stored in your browser
Two small settings are kept in your browser's own storage rather than a cookie. They never leave your device, and clearing your browser's site data removes them.
foundry-notifications-read: which sample notifications you've marked as readfo-status-strip-dismissed-…: that you closed a status notice, so it stays closed (only when the site isn't marked live)
Who else sees it
- Vultr hosts the server, in its Manchester data centre in the UK. The analytics run on that same server, so they don't go to anyone else.
- Cloudflare sits in front of the site and handles every request, so it sees your IP address and what you ask for. It's a US company and may process that outside the UK under its standard data processing terms.
- Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser) delivers a test notification if you ask for one. The message is encrypted, so they can't read it.
- OpenStreetMap supplies the map tiles on the map demo page. Your browser fetches them directly, so the OpenStreetMap Foundation sees your IP address. That happens on that one page only.
Nothing is sold, and nothing is shared for advertising.
Your rights
You can ask for a copy of anything I hold about you, or ask me to correct it, delete it, or stop using it. Email hello@mashreeves.com. I'll reply within a month. Most of what's listed here expires on its own within days, and a lot of it can't be tied back to you, so I may need you to tell me roughly when you visited.
If you're unhappy with how I've handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
When what the site does changes, this page changes with it and the date at the top moves. Earlier versions are in the site's changelog.