How we handle your data.

Where your data lives

Your profile, documents, matches, drafts, and calendar are stored in a Postgres database hosted by Supabase in a United States region. Each organization has its own workspace, and database rules keep one workspace from reading or changing another. We test those rules on every change.

Files you upload go straight from your browser to private storage under your workspace's own folder. Nobody outside the workspace can read them.

Who can see it

The people you invite, in the role you give them. Owners manage the team; editors work on drafts and records; reviewers read, comment, and approve but cannot change records.

A small number of FundFellows staff can reach production systems to fix problems. That access is limited to what the task needs. We will tell you if we need to open your workspace to resolve a support request.

AI and training

FundFellows uses Google's Gemini API, on its paid tier, to read your documents, score matches, and write drafts. Google's terms for the paid tier say it does not use prompts or outputs to train its models.

We do not train models of our own on your data, and we never share one customer's data with another.

Connected accounts

If you connect Gmail, Outlook, or Google Calendar, we store the access token encrypted with a key the database never sees, and no one can read it through the app's API. We use it only to send an email when you press Send or to add your deadlines to your calendar. We do not read your mail.

You approve everything

Nothing is sent, posted, or submitted on your behalf. Drafts stay drafts until a person approves them, and you submit through the funder's or agency's own portal.

Every step the assistant takes, and every source it used, is written to a log you can open from your workspace.

A source on every fact

Every opportunity, funder, deadline, and amount comes from a named public source with a link and the date we last checked it. The assistant never names a funder from memory.

Claims in a draft link to the sentence in your document they came from. When a fact is missing, the draft asks you. It does not fill in a plausible number.

Signing in and deleting

You sign in with a one-time link sent to your email, or with Google. There is no password to steal.

You can delete your workspace from settings. That removes your profile, documents, drafts, matches, and logs. Backups expire within [7] days. Deleting does not take back anything you already exported or sent.

Reporting a problem

If you find a security issue, or a fact in a draft that does not match its source, write to security@fundfellows.com. We read every report and will reply within [two business days].

Please do not test against other customers' workspaces. If you need a safe place to look, ask and we will set one up.