What happens when you install Foothold

1. The 30-second install

The workspace owner (or any admin with app-install permission) visits foothold.community, clicks “Connect your Slack,” and is redirected to Slack's standard OAuth consent screen. That page is rendered by Slack, not by us — it lists every scope we request, in Slack's own descriptions, and asks for an explicit Allow.

The admin sees three things on that screen: the workspace name, the app name (Foothold), and the full scope list. Clicking Allow redirects back to us; we store the workspace tokens in an encrypted column keyed to your workspace ID. Declining cancels the install cleanly — nothing is partially written, no orphaned row. There is no middle state.

After the redirect, Foothold shows the operator a one-screen config page: pick three to five goal-track options, write one welcome line, pick the intro channel, opt in or out of the optional admin-channel summary. Save, and the install is done. On average the whole flow takes the operator about thirty seconds plus however long they spend writing the welcome line.

2. The scopes we request, and why each one

When Foothold ships, these are the OAuth scopes that appear on the Slack consent screen. Each one is on the list because the three-touch flow cannot run without it — not because it might be useful later.

• im:write Send direct messages. Used for the day-0 welcome DM and the day-3 goal-keyed nudge. This is the core of the product; without it Foothold cannot ship any message.
• im:history Read direct-message threads the bot is part of. Used to detect whether a new member replied to the day-0 DM (reply → no day-3 nudge fires). We do not read DMs the bot is not a participant in — Slack's permission model makes that impossible with this scope.
• users:read  +  users:read.email List workspace members and read names, profiles, join dates, and email addresses. Used to detect new joins (the trigger for day-0), to personalise the DM with the member's first name, and to send the day-7 scorecard email to the workspace owner. The email address read is the workspace owner's — that's the only email we send. We do not email new members.
• channels:read  +  groups:read Read channel names and IDs. Used at install time to present you with a dropdown when picking the "introduce yourself" channel for the day-0 DM. We do not read channel contents — there is no channels:history scope on our list.
• team:read Read workspace name and domain. Used for the scorecard email subject line (“Foothold · $WORKSPACE · week ending $DATE”) and the dashboard header. That's it.
• chat:write Optional, off by default. If you opt in at install, Foothold can post a weekly summary to one channel of your choice (typically #foothold-log or #admin) so your team sees the scorecard. If you don't opt in, this scope is not used and no channel messages are sent. You can flip it off at any time in the settings page.

What is deliberately not on the list: channels:history, groups:history, mpim:history, search:read, admin.*, files:read, reactions:read. The bot cannot read messages in your community's channels, cannot search your workspace, cannot see administrator settings, cannot download files, and cannot read reactions. A Foothold install is read-only on channel contents and write-limited to direct messages plus (optionally) one admin channel.

3. The first week inside your workspace

Once the install completes, Foothold polls users.list once per hour looking for new joins. If you add the Slack Events API URL to your Slack app config (a post-install setting, not required for v1), the poll drops to an event-driven team_join webhook and the lag goes from up-to-an-hour to roughly instant.

When a new member is detected, we queue the day-0 DM to fire within six hours — the window is intentional. Firing within seconds reads as a bot pattern and depresses reply rates; firing within six hours reads as “a human saw I joined” and is where the target 50–70% reply-within-24h rate comes from. The DM goes from your own workspace handle, not a generic “foothold-bot” account — the reply rate on DMs from the workspace owner is roughly double the rate on DMs from a clearly-named bot account.

On day three, for members who have neither replied to the day-0 DM nor posted in the intro channel, Foothold fires a single goal-keyed nudge. Just one. If the member replies to the day-0, posts in channel, uses Slack's “stop messaging me” on the bot, or deactivates their account, the day-3 does not fire. There is no day-3-if-they-don't-reply-to-the-day-3 — we do not nag, ever.

On day seven, Foothold computes the scorecard for the week and emails it to the workspace owner. That email is the weekly cadence the playbook prescribes; nothing else lands in your inbox on a recurring schedule. You can see the rendered email here.

4. What Foothold reads, and what it doesn't

If any of the “does not read” items later become a feature you want, we will request the scope explicitly in a future app-update consent and you'll get to Allow or Decline. No quiet scope expansion — every change requires a fresh consent screen on your side.

5. What Foothold stores, and what passes through

Per workspace, our database holds exactly this:

Infrastructure: data lives in a single SQLite database on one VPS, encrypted at rest, daily off-site encrypted backups, 37-day backup retention. No third-party analytics pixels on operator dashboards. No Mixpanel, Segment, Amplitude, or similar. Product telemetry we do collect is aggregated server-side counts (total DMs sent this week, total workspaces active this week) — not per-workspace events.

6. What uninstall does

Two ways to uninstall: from your Slack workspace's app-management page (same pattern as any Slack app), or by emailing hello@foothold.community. Either triggers the same four-step flow:

1. Within one minute: Foothold stops firing DMs to your workspace. Any queued day-0 or day-3 messages are cancelled, not paused.
2. Within one hour: we email the workspace owner a full export — every flow that fired, every reply we logged, every weekly scorecard we sent. CSV plus JSON. The export is yours; it is not gated behind a final invoice.
3. 30 days: your data sits in a restore window. Changed your mind, or uninstalled by mistake? One click and it continues from where you left off, no data loss.
4. Day 31–37: row-level data is deleted from the live database and then propagated through the backup system. On day 37 we verify the final backup and the workspace is gone from every Foothold system.

Cross-reference: the full data-on-cancel policy, including the “is this gated behind the final invoice” question, is question 6 in the pricing FAQ.

7. Two things we haven't built and won't

Foothold does not have a “community analytics” feature. No network graph, no sentiment score, no top-contributor leaderboard, no engagement heatmap, no cohort-by-cohort dashboard. The four-number day-7 scorecard is the whole telemetry surface, deliberately. If you need those features, Common Room is a better tool — we'll say so directly rather than pretend to offer everything.

Foothold does not sell, share, aggregate, or syndicate your data. No “industry benchmarks” newsletter built from customer scorecards. No ad-targeting pixels on operator dashboards. No reselling of the member list to recruiter SaaS. Your numbers are your numbers. We earn revenue from the $49/$99/$199 plans — that is the entire business model, and it's what lets us make the two promises on this page (least privilege, data is yours) without flinching.

8. If you find a security issue

We publish a disclosure policy at /.well-known/security.txt (with a legacy copy at /security.txt) in the RFC 9116 format your security tooling already understands. Report channel: hello@foothold.community, or DM @bitinvestigator on X if email isn't an option.

The short version: 48-hour acknowledgement from a real human, 90-day coordinated disclosure window (extendable by mutual agreement), public credit on the site once the fix ships, and written safe-harbour for good-faith research. No bug bounty at this stage — we're pre-revenue and we'd rather be honest about that up front than hint at a reward pool that doesn't yet exist. If you'd like the full rules-of-engagement (scope, rate limits, what not to touch), read the file; it's about 4 KB of plain text.