forethought-studio
← Back to Home

Privacy Policy (Website)

This privacy policy applies to the Forethought Studio website at forethought-studio.com/. Our mobile apps have their own, app-specific privacy policies.

Surfaced: forethought-studio.com/surfaced/privacy.html
SteadyMount: forethought-studio.com/steadymount/privacy.html

1. Who we are

Forethought Studio is a software development business. For privacy questions about this website, contact us at .

2. What data we process when you visit this website

  • Server logs: Like most websites, our servers process technical data such as your IP address, user agent, requested URL, and timestamps. We use this for security, abuse prevention, and troubleshooting.
  • Email communications: If you contact us by email, we will process the information you provide (such as your email address and message contents) to respond and provide support.
  • Website analytics: We use Umami, a cookie-free analytics tool that we self-host on our own infrastructure, to measure website traffic and basic usage patterns. It does not track you across websites. And because it uses no cookies, we don't have to interrupt you with one of those annoying cookie-consent pop-ups, which is exactly why we chose it.

3. Cookies and similar technologies

  • ✓ Security cookies: strictly necessary cookies that our security providers (such as Cloudflare) may set for security and abuse prevention.
  • ✗ Analytics cookies: our website analytics (Umami) is cookie-free.
  • ✗ Advertising and tracking cookies: we do not serve ads or track you for targeting.

4. Sharing and service providers

We use service providers to run and secure this website. These providers may process technical data (such as IP addresses) to deliver the service:

  • Cloudflare: CDN, DDoS protection, and security.
  • Umami (self-hosted): Cookie-free website analytics on our own infrastructure.
  • Hetzner: Hosting infrastructure for the website.

5. Retention

  • Server logs: Access logs are rotated and retained for a limited period for security and troubleshooting.
  • Email: We retain email communications for as long as needed to respond and for reasonable recordkeeping.

6. Your rights (GDPR and similar laws)

Depending on your location, you may have rights such as access, deletion, and objection. Because we do not run user accounts on this website, we may need additional information (such as approximate time of access and the pages visited) to locate relevant records. Contact us at .

7. Children’s privacy

This website is not directed to children. We do not knowingly collect personal information from children through this website.

8. Updates to this policy

We may update this policy from time to time. The latest version will be posted on this page.

9. Businesses we write to about their website

Sometimes we write to a business about a problem we noticed on its public website, for example a WordPress plugin that WordPress.org has closed for a security issue. The message gives free advice on fixing it and offers an optional paid fix. This section explains how we handle the contact details we use for that.

  • Who is responsible: Forethought Studio SASU, 200 rue de la Croix Nivert, 75015 Paris, France. Contact: .
  • What we use: the business name, its website address and what its public pages showed when we checked them, the contact email address or contact form the business publishes on its own website, a person's name and role if the website shows them with that contact, and the messages we exchange.
  • Where it comes from: the business's own public website. We find websites to check in public web crawl data from the HTTP Archive. We do not buy or rent contact lists.
  • Why, and the legal basis: to tell the business about the problem and offer our web development services. The legal basis is our legitimate interest in warning businesses about a security issue on their website and offering to fix it (Article 6(1)(f) of the GDPR and of the UK GDPR). We write once, and again only if you reply.
  • Who else handles it: we keep these details in files on our own computers. Our email provider, Google (Gmail), stores the messages, and we process the public crawl data in Google BigQuery. Google LLC is certified under the EU-U.S. Data Privacy Framework and its UK Extension, which is the basis for transfers to the United States. We share the details with no one else.
  • How long we keep it: while we are in contact and for 12 months after the last message, then we delete it. Details of websites we checked but did not write to are deleted within 12 months of the check. If you ask us not to write again, we keep only your email address or website on a do-not-contact list, so that we never write to you again.
  • Decisions: a person approves every message before it is sent. We make no decisions about you by automated means that have legal or similarly significant effects.
  • Your rights: access, correction, deletion, restriction and portability, as in section 6. You can complain to the CNIL (cnil.fr), the French data protection authority, or to the authority where you live or work, for example the ICO (ico.org.uk) in the UK.

Your right to object: you can object at any time to our use of your details for these messages. Reply "stop" to our message or write to , and we will not write to you again.