FoundStep
FoundStep is an opinionated web project manager for solo developers and indie hackers. It forces AI idea validation before any code, applies scope locking with a seven-feature cap, and permanently logs every unlock so side projects actually ship.
What is FoundStep?
FoundStep is an opinionated project manager for solo developers and indie hackers. Instead of another flexible task tracker, it imposes a strict lifecycle, and states its position bluntly: It is not a better task tracker. It is a different category of tool.
The home page describes five stages, capture, validate, lock scope, build and ship, which the features page expands into 13 statuses across three phases: an MVP phase (Idea, Validating, Decided, Building, Ready to Ship, Shipped), a post-MVP phase (v1.1 and beyond) and a terminal phase (Archive or Sunset). Only one version can be active at a time.
The central mechanism is a gate. AI validation is mandatory before a single line of code: the tool researches the idea across six dimensions, Market Demand, Competition, Pricing, Reach, Founder Fit and Buildability, then the user writes a verdict of Build, Wait or Kill. That written verdict, not the AI, opens the build phase. A negative answer is framed as a result rather than a failure: The best code you will ever write is the code you never wrote.
Scope locking follows. Features and todos lock independently. Removing items stays free, adding one requires an explicit unlock with a written reason. Every unlock lands in the Shame History, a permanent, non-deletable log with reason and timestamp that lives in the Activity tab, and whose counter is displayed publicly on the Ship Card. A warning fires beyond seven features, the hard cap the home page advertises.
Three AI features carry the daily work: the Next tab, which watches todos, lock state, deadline proximity, unlock count and phase to propose one categorized action, polling every two seconds; the AI MVP Planner, capped at five generations per workspace; and the validation research itself. When every todo of a version is checked, the workspace advances to Ready to Ship on its own, while marking it Shipped stays a manual click.
Shipped work then feeds Harbor, a personal showcase, and the Public Wall, a public developer portfolio with project pages, milestones, follows and stars. FoundStep is a strictly single-user web app, built as a solo, bootstrapped project by Dinuka Nilupul. The constraints are the product.
What it does
- Run a six-dimension AI validation on an idea, then record a written Build, Wait or Kill verdict that unlocks the build phase
- Generate an MVP plan with the AI Planner, up to five generations per workspace
- Lock features and todos independently, with a written reason required for every unlock
- Follow the single next action proposed by the Next tab, categorized Critical, Warning, Celebrate or Action
- Move a workspace through a 13-status lifecycle, with automatic advance to Ready to Ship once every todo is checked
- Mark a project as shipped and generate a downloadable Ship Card
- Publish shipped work to Harbor and to the Public Wall portfolio, then iterate in v1.1 or v2.0
When to use FoundStep / When not to
A quick filter to help you decide if FoundStep is the right fit.
When to use FoundStep
- Solo developers who start far more side projects than they ever finish
- Indie hackers who need an enforced framework to reach a first shipped version
- Solo founders who want an idea validated across market, pricing and competition before writing code
- Freelance developers who want a public portfolio generated automatically from shipped work
- Builders who prefer hard constraints to the open flexibility of a generic task board
When not to use FoundStep
- Teams of any size: there is no collaboration, no sharing and no multi-user feature
- Large companies and enterprises, which the FAQ excludes by name
- Non-technical project managers, since the mental model is deliberately developer-first
- Anyone attached to kanban boards or Gantt charts, both absent by design
- Anyone who needs third-party integrations or an API, neither of which exists
How to use FoundStep
A typical end-to-end flow, from setup to results.
- Create an account and start the free trial; no credit card is required
- Capture the idea in a new workspace
- Launch the AI validation, which researches the idea for you rather than handing you a questionnaire
- Write your own verdict, Build, Wait or Kill; until it is recorded, the build phase stays closed
- Optionally describe the idea to the AI MVP Planner, review the proposed plan and import only what you keep
- Plan features and todos, then lock each of the two lists separately
- Set a soft deadline for a reminder or a hard deadline for stronger urgency; both feed the AI Next Action
- Build by following the Next tab, unlocking with a written reason whenever you step outside the locked scope
- Check off todos until the workspace auto-advances to Ready to Ship, then click Mark as Shipped
- Generate and download the Ship Card, publish the project on the Public Wall, then open a v1.1 or v2.0
Pros & Cons
Pros
- The constraint sits in the tool rather than in your willpower: locks and the unlock log do the work
- No feature is gated behind the higher plan; the FAQ states that the only difference between Starter and Builder is workspace capacity
- Free trial with no credit card required, and cancellation at any time with no commitment
- Going over quota is non-destructive: extra workspaces become read-only until you upgrade, nothing is deleted
- One suggested action at a time instead of a backlog to arbitrate, and a written verdict that makes killing an idea a recorded decision
- A public portfolio and downloadable Ship Cards generated automatically from shipped projects, plus free public calculators available outside the app
- Ownership of user content asserted plainly, with no extended license, at an entry price below most project management suites
Cons
- Strictly single-user: no sharing, no collaboration and no multi-user account
- No third-party integrations and no API, by design: no GitHub, Slack or Zapier, and no API documentation
- No enforceable refund policy: the terms state that, the project not being fully launched, no detailed refund or subscription terms currently apply, while subscriptions are already sold
- The publisher is not legally identified: no company name beyond the brand, no postal address, no country of establishment, and a single support address that is itself obfuscated on the legal pages
- No mention of the GDPR, no DPA, no EU representative and no hosting country or region published
- Nothing is stated about the use of customer data for AI model training, although the product runs on AI
- No dedicated mobile app, only the responsive web app; the AI MVP Planner is capped at five generations per workspace; and no security certification such as SOC 2 or ISO 27001 is claimed
Pricing & Plans
FoundStep is sold on a subscription basis, with two paid tiers. The lowest published price point is USD 12.99 per month for the Starter plan, or USD 131.88 per year, which the site presents as USD 10.99 per month. The Builder plan is USD 29.99 per month, or USD 323.88 per year, equivalent to USD 26.99 per month. A free trial is available and requires no credit card: the home page announces seven days, while the FAQ states only that a free trial is available if you are eligible. Whether a permanent free tier exists cannot be settled from the site itself. The pricing page and the body of the home page both charge USD 12.99 per month for Starter, but the structured data embedded in the home page declares a Starter offer priced at 0 and described as a free Starter plan with up to 10 workspaces. The two statements are left unreconciled. Payments are processed by Stripe, subscriptions can be canceled at any time, and no refund policy is published.
- USD 12.99 per month
- or USD 131.88 per year (USD 10.99 per month). Up to 10 active workspaces
- all features included. Pitched on the pricing page as "For focused builders who want to finish what they start."
- USD 29.99 per month
- or USD 323.88 per year (USD 26.99 per month). Unlimited active workspaces
- all features
- plus additional AI credits. Pitched as "For serious indie devs shipping continuously."
- The only difference between the two tiers is workspace capacity
- the FAQ states "There is no feature gating." Past the quota
- extra workspaces turn read-only until you upgrade
- and nothing is deleted.
- A free trial is available with no credit card. The home page structured data additionally declares a Starter offer priced at 0 with up to 10 workspaces
- which the pricing page contradicts
- so the existence of a permanent free tier is not established.
Data, GDPR & hosting
A consolidated view of how FoundStep handles your data.
GDPR overview
FoundStep never mentions the GDPR. A search across the twenty-four archived files, text and HTML alike, returns zero occurrences: the site neither claims compliance nor denies it. There is no Article 27 representative, no data protection officer, no data processing agreement, no statement of legal bases and no wording on international transfers. Rights are nevertheless offered without being labeled as GDPR rights: the privacy policy, effective 23 August 2026, lets users delete their account from the profile section, request a copy of their personal data and opt out of certain trackers. Security is described only as "reasonable technical and organizational measures", with no certification and no detail. The terms say they are governed by "international laws applicable to the operation of our app", naming no jurisdiction, and the privacy policy states that the app has no age restrictions.
Who owns the data?
The terms are explicit: "You retain all rights to the content you create and post." The permission granted to FoundStep is limited to displaying that content inside the app, and the terms add that no ownership and no wider license is claimed beyond it. The about page repeats the commitment in plainer words: ideas and data belong entirely to the user, and are never mined, shared or monetized. The privacy policy confirms that personal information is not sold, rented or shared with third parties for marketing purposes, and that the two named third parties, Stripe and Google Analytics, have no access to account data.
Reuse rights
Because the terms leave every right in the user's hands, content created in FoundStep can be reused, republished or reworked elsewhere without asking permission; the publisher claims no license beyond displaying it in the app. On the collection side, the privacy policy lists name, email, country and profile picture if supplied, usage data such as workspaces, tasks and progress, browser and operating system, plus authentication cookies and local storage for the theme. That material serves account creation and management, service delivery and improvement, personalization, payment processing and support messages. Only two third parties are named: Stripe for payments, and Google Analytics restricted to the landing page, where "no personal data from your dashboard is collected". Cookies can be disabled from the browser, at the cost of some functionality. Nothing on the site states whether customer data feeds AI model training, even though several features are AI-driven.
Data retention & training
Hosting summary
FoundStep publishes no hosting information. Targeted searches for AWS, Supabase, Vercel, Neon, Firebase, "hosted in", "data center" and "region" return nothing: no hosting country, no region and no infrastructure provider is named anywhere on the site. The only observable technical element, which the publisher does not declare, is that the domain resolves to 104.21.61.87, a Cloudflare anycast address. That points to a CDN in front of the site, not to a storage location, and no jurisdiction can be inferred from it. The privacy policy names only two third parties that receive data: Stripe for payment processing, and Google Analytics, restricted to the landing page. Security is described in generic terms as "reasonable technical and organizational measures", with no further detail. No certification is claimed, neither SOC 2 nor ISO 27001 nor HIPAA. For a reader who needs to know where their data physically sits, or under which law it is processed, the site gives no answer at all.
Things to keep in mind
Risks and trade-offs to weigh before adopting FoundStep.
- The home page structured data still declares a free Starter plan at 0 USD, while the pricing page and the body of the home page both charge USD 12.99 per month for Starter. The stale markup is invisible on screen but readable by search engines.
- That same structured data lists Kanban Board, End-to-End Encryption and Data Export as features, while the features page explicitly files kanban boards and Gantt charts under what FoundStep does not do, and neither encryption nor export is documented anywhere else on the site.
- The six validation dimensions are not named the same way in two places: Market Demand, Competition, Pricing, Reach, Founder Fit and Buildability on the home and features pages, against Problem Viability, Problem Reality, Market Demand, Competitive Opening, Distribution and Unit Economics in the FAQ.
- The terms state that, the project not being fully launched, no detailed refund or subscription terms currently apply, yet subscriptions are sold. No publisher entity, no postal address and no country of establishment appears anywhere on the site.
- No mention of the GDPR, no DPA, no EU representative, no hosting country or region, and nothing about whether your project data may be used to train the AI models the product relies on.
- The Shame History is permanent, non-deletable and its counter is published on your Ship Card. A mechanism built to create accountability can also become a source of self-blame; the naming is deliberate, so decide in advance how you intend to read it.
- Practical frictions: the pricing page renders its amounts in JavaScript, so no price is readable without JavaScript; the only email address on the site is obfuscated by a Cloudflare token on both legal pages; and the FAQ announces 26 questions across 3 categories but returns 25.
Setup & Integrations
Technical difficulty
Technically, setup is close to zero. FoundStep is a web app: nothing to install, nothing to configure, no integration to connect and no API to wire up. An account is required, and the free trial asks for no credit card. It runs in any modern browser, mobile included, and requires JavaScript. The real friction is methodological rather than technical: the six-dimension validation is mandatory before the build phase opens, and you must write your own Build, Wait or Kill verdict. As the features page puts it, no setup, no team required, just your first idea and a verdict.
Deployment
Supported languages
Behind FoundStep
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement FoundStep.
Frequently asked questions
Who is FoundStep for?
Can I use FoundStep with a team?
What is Scope Locking?
What is the Shame History?
How does the AI validation work?
Is there a free trial?
What is the difference between Starter and Builder?
What happens if I cancel my subscription?
Is there a mobile app, an API or integrations?
How long is my data kept after I ask for deletion?
Should you pick FoundStep?
FoundStep is a deliberately narrow product, and it says so. Where generic tools compete on flexibility, this one competes on refusal: a mandatory validation gate before any code, independent locks on features and todos, a written reason for every unlock, and a permanent log nobody can erase. The constraints are the product. That sentence is both the strongest argument for the tool and the reason it rules itself out for anyone working with other people. No sharing, no kanban, no integration, no API, and none of it is an oversight.
The product is also very young. The domain was registered on 16 October 2025, the legal pages carry an effective date of 23 August 2026, and the terms themselves say the project is not fully launched, while subscriptions are already being sold and no refund policy is published. Governance is thin: no legal entity, no postal address, no country of establishment, no mention of the GDPR, no hosting location, and nothing on whether customer data feeds AI training. A solo, bootstrapped project carries its own continuity risk.
For a solo developer sitting on a folder of unfinished repositories, the trade is clear enough. USD 12.99 a month buys a discipline, not a feature count, and the entry price sits below most project management suites. Judge it on whether you actually need to be stopped from adding an eighth feature, not on what the interface can do. Use the free trial, keep your own copy of anything that matters, and treat the missing legal and hosting information as a genuine unknown rather than a detail to wave away.
- Choosing a selection results in a full page refresh.
- Opens in a new window.