Privacy Policy

1. Who we are

OpenCo (“OpenCo,” “we,” “our,” or “us”) operates the platform at openco.live. OpenCo is a network for founders, early employees, and investors to connect around pre-formation projects and early-stage companies. If you have questions about this policy, contact us at [email protected].

2. Information we collect

Information you provide directly

• Account registration: name, email address, password (stored as a one-way hash)
• Profile information: headline, bio, location, profile photo URL, website, LinkedIn URL
• Venture information: company name, description, tagline, category, location, website, formation details
• Applications and investment interest you submit through the platform
• Articles and content you publish

Information from third-party sign-in

When you sign in with LinkedIn or GitHub we receive the information those services share with us under their OAuth flows, which may include your name, email address, profile photo, and a unique identifier. LinkedIn additionally provides an email-verified status. We do not receive your LinkedIn password or full work history.

Information collected automatically

• Log data: timestamps, request paths, HTTP status codes, response times
• Security events: sign-in attempts, session creation, account changes — stored in an audit log. IP addresses in audit records are stored as a one-way hash and cannot be reversed.
• Session tokens stored in secure, HTTP-only cookies

3. How we use your information

• To operate and provide the OpenCo platform (matching founders, talent, and investors)
• To send transactional emails (email verification, password reset, notifications you opt into)
• To display your public profile and venture listings to other members
• To investigate security incidents and enforce our terms
• To monitor platform health and performance

We do not sell your personal information. We do not use your information for advertising.

4. How we share your information

We share your information only with the service providers necessary to operate OpenCo:

• Amazon Web Services (AWS) — compute (Lambda), content delivery (CloudFront), and file storage (S3) in the United States
• Neon — PostgreSQL database hosting
• Resend — transactional email delivery
• LinkedIn and GitHub — only when you initiate a sign-in or profile import through their OAuth flows

We do not share your information with third parties for their own marketing or analytics purposes.

We may disclose information if required by law or to protect the rights, property, or safety of OpenCo, our users, or others.

5. Public and private information

Your profile is public by default and visible to anyone visiting OpenCo, including search engines. You can set your profile to private in Account → Public profile settings. Venture listings you publish are always public. Applications and investment interest you submit are visible only to the relevant venture managers.

6. Data retention

We retain your account information for as long as your account is active. Security audit events are retained for a minimum of 30 days and up to 365 days by default. When you delete your account, we remove your personal profile data within 30 days, except where retention is required for legal, security, or operational reasons (such as fraud prevention records).

7. Your rights and choices

• Access and correction: You can view and update your profile information at any time in your account settings.
• Account deletion: Contact us at [email protected] to request deletion of your account and personal data.
• Email preferences: Transactional emails (verification, security alerts) are required for account operation and cannot be opted out of while your account is active. We do not send marketing emails.
• Connected accounts: You can disconnect LinkedIn or GitHub from your account settings at any time. Disconnecting does not delete previously imported profile data.

If you are in the European Economic Area, UK, or California, you may have additional rights including data portability and the right to object to processing. Contact us to exercise these rights.

8. Cookies and session storage

We use one session cookie to keep you signed in. We also use localStorage to remember your light/dark theme preference. We do not use advertising cookies or third-party tracking cookies.

9. Security

OpenCo uses industry-standard security practices: HTTPS everywhere, bcrypt password hashing, rate-limited authentication, HTTP-only session cookies, and regular security event auditing. No system is perfectly secure; if you discover a vulnerability please report it to [email protected].

10. Children

OpenCo is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with their information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the effective date at the top and, where appropriate, notify you by email. Continued use of OpenCo after changes take effect constitutes acceptance of the revised policy.

12. Contact

Questions, requests, or concerns about this privacy policy: [email protected]