Effective June 30, 2026
This page describes, at the level of detail we can substantiate, how Cards is built and how we handle data and security. It is published by Goodfoot Media LLC and will be updated when our security posture meaningfully changes. It does not promise controls we have not yet implemented, and it does not promise an uptime SLA, a bug bounty, or a specific remediation timeline.
Cards is a local-first orchestration tool. The extension runs inside Visual Studio Code and compatible forks on your own machine. Your cards — descriptions, prompts, plans, comments, attachments, and generated outputs — are stored locally as git repositories on your disk, not on Goodfoot's servers. Cards launches the coding agent you have installed; it does not itself execute shell commands, modify your workspace files, or call AI model providers. Inference runs through the agent and model provider you choose, directly from your machine.
Our website and APIs run on Cloudflare. We rely on a small set of providers, each with a specific role: WorkOS for authentication, Polar as Merchant of Record for payments, Cloudflare for infrastructure, and Microsoft / Azure Application Insights for sanitized extension telemetry. We do not receive or store full payment card numbers; Polar handles the hosted payment form.
Authentication and session security rely on three essential cookies set for the
Cards site host — workos_session, oauth_state, and auth_claim — each marked
HttpOnly, Secure, and SameSite=Lax. Their purposes, lifetimes, scope, and
attributes are described in the Privacy Policy.
We maintain reasonable administrative, technical, and organizational safeguards designed to protect customer information and the security of the service, and we keep security and audit logs of significant account events. Data retention follows the schedule in the Privacy Policy.
If you believe you have found a security vulnerability in Cards, please report it to security@cards.management. The address is monitored by the operator, and we aim to acknowledge reports within 72 hours.
Please give us a reasonable opportunity to investigate and address a report before disclosing it publicly. We do not operate a paid bug-bounty program and do not commit to a specific remediation timeline, but we take reports seriously and will keep you informed of our progress where practical.