Privacy
Your raise is your business.
Raisebook holds some of the most sensitive data a founder has: who you are talking to, what they said and how much they might invest. This page says plainly what happens to it. The code is public, so you can check every line of it.
The promise#
- 01
Your data is yours. A workspace is visible only to its members and to the API keys its owners create.
- 02
We never pool, sell, rent or mine it. Raisebook never builds an investor database from your data and never shows one workspace's data to another.
- 03
No ads, no trackers. No analytics scripts, pixels or third-party cookies. Fonts are served by Raisebook.
- 04
No AI on your data unless you bring it. Raisebook does not send your data to any AI model. Agents you connect use your key, and every action they take is on the timeline.
- 05
Leave any time. Export everything as CSV and JSON. Delete your workspace or account permanently, effective immediately.
- 06
Check our work. Raisebook is open source under AGPL-3.0, including the code that handles your data.
What Raisebook stores#
| What | Why |
|---|---|
| Your email address and, if you add it, your name | To sign you in and show who did what to your co-founders. |
| Sign-in sessions: when they started and were last used, the browser's user agent and IP address | To keep you signed in, and so you can see and end them under Account → Signed-in browsers. A session ends after 30 days without use, or 90 days after sign-in at the latest. |
| Sign-in requests: the email address and IP that asked for a link | To send the link and limit abuse. Deleted about a day after the link expires, whether or not it was used. |
| Pending invites: the invited email address and role | To let them join. Deleted once revoked, or a week after they expire; accepted invites become a membership. |
| Your workspaces: rounds, stages, investors, notes, follow-ups, amounts and the timeline | This is the product. It is shown only to the workspace's members and keys. |
| API keys, stored as a one-way hash, plus their name, scopes and last use | To let your agents in without storing a usable secret. |
| Short-lived counters per key, per IP and per hashed email | Rate limits. They are deleted after a day. |
What Raisebook never collects#
- No analytics, tracking pixels, session replay, heatmaps or advertising IDs.
- No third-party scripts or cookies. Fonts are served from raisebook.org itself.
- No data from other sites: Raisebook does not scrape LinkedIn or enrich contacts.
- No sharing between workspaces: no “investors you might know”, no benchmarks, no shared contact graph. No query in the code reads more than one workspace's rows, except counts of rows per table for capacity planning.
Cookies and browser storage#
| Name | Kind | Purpose |
|---|---|---|
| rb_session | cookie, HttpOnly | Keeps you signed in. 30 days, renewed while you use the app, 90 days at most. |
| rb_csrf | cookie | Protects your account from forged requests. |
| rb-theme | localStorage | Light, dark or system. |
| rb-last-ws | localStorage | Opens the workspace you used last. |
That is the whole list. None of them is used for tracking, and there is no cookie banner because there is nothing to consent to.
Logs#
Each request is logged with its request id, method, route template, status, duration, workspace id, actor type and API key prefix. Logs never contain request bodies, query strings, investor fields, email addresses or tokens. When a log line has to refer to an email, it uses a hash. Logs are kept for [N days].
Email#
Raisebook sends two kinds of email: sign-in links and workspace invites. They go through [email provider]. Only the recipient's address and the message leave Raisebook. Raisebook never emails your investors.
Hosting and backups#
Raisebook runs on [hosting provider] in [region]. The database is backed up nightly, and backups are kept for at most 14 days. When you delete something, it is removed from the live database at once and leaves the backups as they expire, within 14 days.
Agents and AI#
Raisebook does not run AI models and does not send your data to any AI provider. When you connect an agent such as Claude Code, Codex or Cursor, it reads and writes through your API key, and what it reads goes to the AI provider you chose, under that provider's terms. Every change an agent makes is on the timeline under its name. Revoke the key and the access ends.
Your rights#
- See and take your data. Export any round as CSV or JSON, all investors as CSV and the whole workspace as JSON, at any time. Export and delete.
- Correct it. Everything you entered can be edited in the app.
- Delete it. Delete an investor, a round, a workspace or your account. Deletes are permanent and immediate.
- Ask. For anything you cannot do in the app, write to [privacy contact email]. We answer within [30] days.
Investor data you enter#
The people in your pipeline are real, and their details are personal data. You decide what to record about them and why, and Raisebook stores it for you and does nothing else with it. In data-protection terms, you are the controller of that data and [legal entity] acts as your processor. If an investor asks you to delete what you hold about them, delete the investor in Raisebook and it is gone.
Changes#
If this page changes in a way that matters, the change is listed in the changelog and announced to account holders by email before it takes effect. The full history is in the repository .
Contact#
[Legal entity name], [postal address]. Privacy questions: [privacy contact email]. Security reports: see SECURITY.md in the repository.
This page covers the hosted service at raisebook.org. A self-hosted copy is run by whoever hosts it, under their own policy.