- Your learning notes and business plans are private to your account in the workspace.
- Community contributions are visible to the audience of the feature you use.
- You can request access, a copy or deletion of your personal information.
- Analytics remains opt-in. Meta and X advertising controls depend on visitor location, and you can opt out. Private learning, account and payment pages are excluded from Meta and X tracking.
The full details below explain how these policies apply.
About this policy
Overdue Founder is operated by Samuel Matson, a sole proprietor in Florida, United States. We provide Overdue Founder courses and related learning and community features. This policy explains how we handle personal information when you visit the website, use an account, purchase a membership, contact us or participate in the community.
For questions or requests about your information, contact support@overduefounder.com or use the available controls in Account and privacy.
Information we collect
Account information. We receive an account identifier, email address and, when provided, a name from the sign-in service you choose. When email and password sign-in is offered, our authentication service processes password-verification information, sessions, email verification and account-recovery activity. When Google sign-in is offered, we receive the basic account information authorized during sign-in, such as your Google identifier, verified email address and name; we do not receive your Google password. We use these details to connect your membership, saved work and community profile to your account. We also keep records of policy versions and consent choices associated with account creation and purchases. You may choose a community display name and add a short biography or business focus.
Learning information. We store information you choose to save, such as your selected courses, lesson progress, playback and reading positions, bookmarks, notes, exercise answers, practice writing, saved resources and business plans. Free-text fields may contain information that you provide about yourself or other people. Please avoid adding passwords, payment-card details, government identification numbers or confidential information you do not have permission to share.
Community information. We collect profile information, posts, comments, chatroom messages, direct messages, likes, friend requests, accepted connections, blocks and reports you create, along with the identifiers and times needed to operate those features.
Billing information. Stripe processes membership payments. If you purchase before signing in, we use the checkout email to create or link your course account after payment, send a secure access link, and require email verification before connecting paid access. We send Stripe your account identifier and available email address to connect payment records to your membership. Our application stores Stripe customer, subscription, price and checkout-session identifiers, subscription status, renewal-period information, cancellation status and payment-event processing records. Payment details entered in Stripe's checkout are handled by Stripe; our application does not store full payment-card numbers or card security codes.
Learning routines. We store your optional welcome answers, chosen business path, weekly goal, learning activity dates, lesson-completion history, timezone and reminder preferences. If you opt in, we send lesson reminders and Sunday progress recaps through Resend. You can change these preferences in My progress or unsubscribe through either email. We keep limited delivery records to avoid duplicate messages. These preferences and activity are private to your account.
Support information. If you contact us, we receive the information you include in your message and related correspondence. Do not send passwords or complete payment-card numbers to support.
Technical information. Our hosting, authentication, security and payment providers process technical information needed to deliver and protect their services, which can include IP addresses, browser and device information, request times, requested resources, session information and error or security events. Our application records limited error information to diagnose service failures.
How we use information
We use information to provide access to courses, save your work, keep accounts and payments connected, manage subscriptions, provide community features, respond to requests, troubleshoot problems, prevent abuse and fraud, enforce our terms, and meet legal or accounting obligations. We may use information to investigate reported content, resolve payment disputes and protect the service, our members and others. Where applicable law requires a legal basis, we rely on performing our agreement with you, meeting legal obligations, our legitimate interests in operating and securing the service where those interests do not override your rights, and consent where required.
We do not use your private notes or business plans as community posts. We disclose information when you choose to share it through a feature or when necessary for the purposes described in this policy.
What other members can see
Your community display name, biography, focus, posts, comments and chatroom messages are visible to members who can access the relevant community features. Direct messages are available to the participants in that conversation through the service. Authorized service personnel and providers may access stored information when needed to provide support, investigate abuse, secure the service or comply with law. Direct messages are not end-to-end encrypted.
Other people may copy information you share. Removing content from our interface does not remove copies independently kept by recipients. Private learning notes, exercises and plans are not displayed to other members by the learning-workspace features.
Automated community helpers
Labeled automated helpers can respond to shared community discussions and chatroom messages. To generate a relevant reply, we send OpenAI the course topic and up to 12 relevant shared messages. We remove common contact details, links and credential patterns before transmission, but this filtering cannot identify every personal detail in ordinary writing. Do not post confidential or sensitive information in shared discussions. We do not send the helpers your direct messages, private lesson notes, business plans, payment records or account credentials.
Helper requests are sent with response storage disabled; provider security and abuse-prevention logs may still be retained under OpenAI's applicable terms and settings. Job records retain status and timing rather than another copy of message text and are cleaned up after seven days when the queue runs. You can stop helper replies and future use of your messages by posting ‘stop helpers’ or ‘no AI’; post ‘enable helpers’ to resume. Blocking a helper also prevents its reply. Helpers are automated software, do not count as human members, and do not provide professional advice or guaranteed results.
Service providers and other disclosures
With advertising permission, or under the United States notice-and-opt-out approach described below, Meta processes activity from selected public sales pages to measure advertising and support personalized advertising. Meta may associate this activity with its own account or device information and process it under its Privacy Policy and our applicable arrangements. Meta and X are separate from Microsoft Clarity and PostHog; agreeing to analytics does not agree to advertising. With advertising permission, or the United States notice-and-opt-out approach below, the X website pixel also measures public landing visits and supports advertising under X’s Privacy Policy.
When optional analytics is enabled, Microsoft Clarity and PostHog process the limited interaction and technical information described under Cookies and browser storage to help us improve the website. We use OpenAI’s Sites platform and Cloudflare infrastructure to host and operate the website, database and course-file delivery; Stripe to process payments and manage billing; and Google Workspace for business support email. Authentication is handled by the sign-in providers offered on the sign-in screen: OpenAI for ChatGPT sign-in and, where offered, Supabase for email/password and Google sign-in. Encrypted application recovery copies and independent operational checks are also held in a private Supabase area. Operational alert emails and, when email sign-in is enabled, verification and recovery messages are delivered through Resend, which processes recipient addresses, message contents and delivery information. These providers may process information for their own legal, security and service-operation purposes under their policies and our applicable arrangements with them.
Fonts are served by our website's hosting infrastructure. Loading those fonts does not require your browser to contact Google Fonts.
We may disclose information when required by law or valid legal process, to protect legal rights or safety, to investigate fraud or abuse, with your direction, or in connection with a proposed or completed business transfer subject to applicable law. External websites, including productivity apps and linked learning resources, operate under their own policies. Visiting them does not make them part of Overdue Founder.
Cookies and browser storage
Sign-in and service providers may use cookies or similar technology to maintain sessions and protect their services. The website uses browser storage to remember appearance settings and preserve unfinished writing. Browser-local demo data is separate from your saved learning account. Some unfinished drafts remain on the device until you save or discard them or clear the site's browser data. Clearing browser storage may remove drafts that have not been saved to your account. Using a shared device can expose information stored on that device to other people with access to it.
With your optional analytics permission, we use Microsoft Clarity for click and scroll heatmaps and reconstructed session replays on selected public sales pages, and PostHog for selected page views, course activity, video milestones and playback errors, download clicks, checkout handoffs and billing-access confirmations. Clarity is excluded from account, checkout/billing, private learning, notes, business-plan and messaging pages. Text is masked before replay collection. Query-bearing pages are excluded from replay. PostHog session recording and automatic form/text capture are not enabled. Our custom PostHog events do not include your name, email, account identifier, passwords, payment details, search text, private writing, or raw URL query strings. We use random browser/session identifiers, general device categories and broad traffic-source categories to understand navigation and repeat visits; these are not linked to your account profile. Providers still process network and technical information needed to receive the requests and may use information for their own purposes as described in their linked privacy terms, including service development. A broad traffic-source category may be retained in session storage for up to 30 minutes when analytics is allowed.
When enabled under the advertising controls below, the Meta pixel sends selected public sales-page PageView events, including the cleaned public page address and technical information such as IP address, browser information and permitted referrer information. Meta may use first-party advertising identifiers such as _fbp and _fbc and its own cookies where your browser permits. Our validated Meta ad-click cookie is configured for up to 90 days and can refresh on a later permitted ad visit; cookies controlled by Meta are described in its Cookie Policy. Campaign text and unrelated URL-query values are excluded by our integration. Account, payment-entry, private lessons, notes, plans and messages are excluded; the separate generic purchase-confirmation page is used only for the conversion event described below. Automatic advanced matching, automatic detailed-page collection, automatic event detection and server-side Conversions API sharing are not enabled. On the separate purchase-confirmation page, and only under the same advertising controls, we send a Purchase event after our server verifies the payment with Stripe. It contains the purchase total, currency and a pseudonymous conversion identifier to prevent duplicates. It does not contain your name, email, account identifier, Stripe identifiers, card details or private learning content. The X browser pixel sends the initial public landing visit through its base tag, with technical network/browser information and advertising identifiers where the browser permits. See X’s Cookie Policy. On the same controlled purchase-confirmation page, X receives the verified purchase total, currency and pseudonymous conversion identifier. Under these same advertising controls, we retain a validated X ad-click identifier in the first-party of_x_click cookie for up to 30 days and include it with the verified purchase event to attribute the purchase to an ad click. Withdrawing advertising permission removes this cookie. We do not pass emails, phone numbers, Stripe identifiers, card details, private learning content or server-side conversion events to X. X’s Conversion API and customer-list uploads are not enabled.
Analytics is off until you allow it. For visitors identified as being in the United States, Meta and X advertising may operate on selected public sales pages without an initial consent popup, subject to existing refusals and supported Global Privacy Control and Do Not Track signals. Use Manage cookie preferences in this Privacy Policy’s Cookies and browser storage section to opt out or change analytics and advertising preferences. For visitors identified outside the United States, we request consent on public sales pages before optional tracking. If location cannot be determined, optional tracking stays off unless you have already made a valid choice; we do not display an automatic popup. We use our hosting provider’s connection-derived country information and, where needed, its same-site edge diagnostic to determine the country. We inspect only the country indicator and do not save or forward the diagnostic’s IP address, request GPS permission, or add location fields to learning records. Choose Essential only to decline both, or use the separate Analytics and Advertising choices and Save choices. Allow all optional enables both. Declining does not affect membership or necessary account/security functions. Analytics permission alone never enables advertising. Previous Meta-only grants do not authorize X. Previous advertising permissions are renewed before sharing verified purchase events; refusals remain honored. Outside the United States, a current advertising choice is required.
Analytics preferences and affirmative advertising permission are stored for up to 180 days. Advertising rejection is remembered for at least 12 months; renewal of an analytics preference does not automatically ask you to opt back into advertising during that period. You can reopen Privacy choices yourself at any time. Withdrawing stops future optional collection and clears the first-party optional identifiers we control, but does not automatically delete provider records already collected or cookies on other companies’ domains. Contact support@overduefounder.com about previously collected information; applicable rights and retention exceptions are described below.
We do not sell personal information for money or share private learning notes or business plans with advertisers. Disclosing public-site activity to Meta or X for personalized advertising may constitute “sharing” or processing for targeted advertising under applicable privacy laws. You can opt out through Essential only, the Advertising preference or a supported browser opt-out signal. We will obtain any required permission before materially changing tracking purposes.
Retention
We retain account and learning information for as long as needed to provide the service and handle your requests. Canceling a membership does not automatically erase saved work or payment records. We retain billing, security, dispute and legal records where needed for accounting, fraud prevention, legal obligations or the establishment, exercise or defense of claims. We assess retention based on the type and sensitivity of the information, the purpose of keeping it, applicable requirements and whether that purpose can be met with less information.
Removing a community post from view may not immediately erase the underlying record. If you want account information or content deleted, contact us as described below. Copies may remain temporarily in provider backups or logs under their retention processes and may be retained longer where required for a specific legal or security reason. We do not promise immediate deletion from all systems.
Your choices and requests
You can change available profile details, manage saved work and use the billing controls provided with your account. Open Account and privacy for available export and privacy-request controls, or email support@overduefounder.com from the email associated with your account to request access, correction, a copy or deletion of personal information. We may ask for information reasonably necessary to verify your identity and locate your records. Do not send identity documents unless we request them through an appropriate secure method.
Your legal rights depend on your location and may include additional rights to object to or restrict processing, withdraw consent, appeal a decision or complain to a data-protection authority. We respond as required by applicable law and explain applicable limitations. We may retain information that we are legally permitted or required to keep. A privacy request is recorded for review; submitting one does not immediately erase information or cancel a subscription. Cancel future renewals through Manage billing, or contact support if you cannot access it. We will confirm the effect on your account and billing when handling an account-closure request. A request does not change amounts already lawfully due.
Security, location and updates
We use access controls and other measures designed to protect information. No online service can guarantee absolute security. Our providers may process information in the United States and other countries where they operate, subject to applicable legal requirements. Overdue Founder is intended for adults, and we do not knowingly offer accounts to children under 18. Contact us if you believe a child has provided personal information.
We may update this policy as the service changes. The effective date identifies the current version. We will provide additional notice of material changes when required by law.