Privacy Policy
Effective October 4, 2026
This policy explains what information we hold when you use FOIL, where it is kept, and who else touches it. It covers this website and the client portals and sign-in pages FOIL serves.
Who we are
Dark Water Media LLC
9320 N Van Houten Ave
Portland, OR 97203
United States
Dark Water Media LLC is an Oregon limited liability company and is the operator of FOIL and the controller of the information described here. It trades under the names Rockford House Creative, SAINT, Ghost Post and Cascadian Print Co. Whichever of those names you were working with, the company behind the portal is Dark Water Media LLC.
Contact for anything in this policy: support@foilapp.co.
What FOIL is
FOIL is the internal platform Dark Water Media LLC runs its client work on, including the client portals it serves. It is not a product sold to the public and it is not an advertising business. We hold client information in order to do the work a client hired us for.
Information we hold
Account information
Your name and email address, the company you belong to, and anything else you choose to put on your own profile, such as a phone number or how you prefer to be contacted. If you sign in with Google, we receive your name, email address and profile picture from your Google account and nothing else.
What is in your portal
- The projects we are doing for you, their stages, dates and status updates.
- Invoices, payment status and billing contact details.
- Documents we have sent you, and documents sent for signature.
- Notes from meetings we had with you.
- Brand files, photos and other files you upload.
- Your answers to forms and questions we put in the portal, and comments you leave on work under review.
Technical information
Our hosting and database providers record ordinary server and request logs, including IP address, browser user agent, timestamps and the pages requested. We use these to keep the service running and to investigate faults and abuse.
Sign-in, sessions and cookies
Authentication is handled by Supabase Auth. Depending on how your access was set up, you may sign in with an emailed link, with a password you set, or with Continue with Google.
Your session is kept in cookies set on our own domains. Those cookies are strictly necessary: without them you cannot stay signed in. We do not set advertising cookies, and we do not run third-party analytics or ad trackers on this website or in the portal.
Files you upload
Files you upload go into a private storage bucket. They are not publicly readable. When a file needs to be shown back to you or opened by the team working on your account, FOIL generates a short-lived signed URL for that single file. There is no permanent public link to anything you upload.
Where your information is stored
Portal data is stored in Supabase, in the United States. Internally, Notion is our upstream system of record for projects, clients and invoices, and FOIL mirrors from it into Supabase. The website and application are hosted on Vercel.
If you are outside the United States, using FOIL means your information is transferred to and stored in the United States.
Service providers
We use the following third parties to run the service. Each one receives only what it needs for its part of the job.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, authentication, file storage | Account and portal data, uploaded files |
| Vercel | Hosting | Request and server logs |
| Notion | Upstream system of record | Project, client and invoice records |
| Google Workspace | Email we send and receive, calendar and scheduling | Correspondence with you, meeting invitations |
| Stripe | Invoicing and card payments | Billing name, email, invoice amounts and payment details |
| DocuSeal | Electronic signature | Documents sent for signature, signer name and email, signing audit trail |
| Frame.io (Adobe) | Video and media review | Media put up for review and review comments |
| Granola | Meeting notes | Meeting notes and summaries from calls we are in |
| Anthropic | Drafting and assistance inside FOIL | The text and records a given request is about |
Card details. We do not see or store full card numbers. Payments are entered on Stripe's own payment pages and handled by Stripe.
Automated assistance
FOIL uses Anthropic's Claude models to draft correspondence, summarize records and answer questions asked inside the application. When that happens, the relevant records are sent to Anthropic's API to produce the result. Under Anthropic's commercial terms, information submitted through its API is not used to train its models. No decision that affects you is made automatically without a person at Dark Water Media LLC reviewing it.
How we use your information
- To deliver the work you engaged us for, and to show you its status.
- To invoice you and record payment.
- To send you documents and collect signatures.
- To contact you about your projects, and to answer you.
- To keep business, accounting and tax records.
- To keep the service secure and working.
What we do not do
- We do not sell your information.
- We do not share it with anyone for their own advertising or marketing.
- We do not show one client another client's information. Portal access is scoped to the company you belong to.
We will disclose information where we are legally required to, or where it is necessary to establish or defend a legal claim.
Google user data
If you sign in with Google, we use your Google account only to identify you and to sign you in. We do not read your Gmail, your Drive or your calendar.
Separately, FOIL connects to the Google Workspace account belonging to Dark Water Media LLC in order to send and read our own mail and manage our own calendar. That access is to our account, not yours. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
How long we keep it
We keep your account and portal information for as long as your engagement with us is active, and afterwards for as long as we need it for our business, accounting, tax and legal records — contracts, invoices and signed documents in particular. We do not operate a fixed deletion schedule. If you want something removed, write to us and we will tell you what we can delete and what we are required to keep.
Your requests
Write to support@foilapp.co and we will act on a request to see the information we hold about you, correct it, or delete it, subject to the records we must keep. Most of what we hold about you is already visible in your portal, where you can change your own profile and contact preferences yourself. Depending on where you live, you may have additional rights under local law; tell us what you are asking for and we will deal with it.
Security
Traffic is encrypted in transit. Portal access requires authentication, data access is restricted per client at the database level, and uploaded files sit in a private bucket reachable only through short-lived signed URLs. No system is perfectly secure, and we make no claim beyond the measures described here.
Children
FOIL is a business tool for our clients and their staff. It is not intended for, and not directed to, children.
Changes
If we change this policy we will change the effective date at the top. If a change is significant and affects how we handle information we already hold, we will tell affected account holders by email.