Privacy policy

Last updated 8 October 2026. This policy describes the hosted service at openroom.app. Self-hosted deployments are operated by whoever runs them.

Who this covers

OpenRoom is used by tutors (hosts) who sign in, and by participants who join a live session without an account. A tutor may also issue a learner a link to that learner’s own records. That link is not an account.

What we collect

Host accounts

When you sign in with Google we store your Google subject id, email, and display name, plus the decks, folders, spaces, memberships, presentation contexts, and compact session notes you create. Personal API tokens are stored as SHA-256 hashes; the raw token is shown once.

Live sessions

Each live session holds the session outline, a server-generated participant id, a join timestamp, and — depending on identity mode — a session-local handle or the display name the tutor wrote on the context. It also holds the current ballot per participant per question and the recomputed aggregate. Participants are never asked for a name, email, or password.

Learner access links

A tutor can mint a link that reaches one context’s learner-visible records. We store a SHA-256 of the token, a visible prefix, and creation, expiry, and revocation timestamps. The raw token is shown once and cannot be read back.

Public website

The landing page, this policy, the terms, and the manual load Umami Cloud to count page views. Umami records the page, referrer, browser, operating system, device type, and country. It does not store personally identifiable information, and it does not receive host accounts, live sessions, answers, or learner records. The workspace, join, and stage apps do not load it.

What we do not collect

• Original school documents and model conversations used to prepare a deck. Those stay in the tutor’s own agent or desktop app.
• Participant accounts. There is no student sign-up.
• Advertising, analytics, tracking scripts, third-party fonts, or beacons in the browser apps.
• Application logs of participant answer text.

How we use the data

Host data is used to provide the product: save decks, start sessions, share a space, and recover recent host controls. Live session data is used only to run that session and to show aggregate results. Learner links are used only to show that context’s learner-visible records.

When an MCP client or ChatGPT plugin connects, OpenRoom receives an OAuth access token or personal API token for the signed-in host and uses it to run the same tutoring actions the browser can run. OpenRoom does not proxy or bill model tokens.

How long we keep it

• Ballots and the participant roster are deleted 30 minutes after a session ends. Remaining text and Q&A entries have participant ids replaced so they cannot be tied back to a person.
• The whole live session is deleted 24 hours after it ends.
• Host account data, decks, and compact notes remain until the host deletes them (normal deletion is trash; permanent deletion requires a short-lived browser confirmation).
• Learner links expire after 180 days by default and can be revoked sooner.

Sharing

We do not sell personal data. Hosts share a space with people they invite. A leaked learner link reaches exactly one context. A leaked roster invite reaches exactly one session. Google receives the OAuth sign-in for hosts. Stock photographs stay hosted by Pixabay and are embedded by URL.

Contact

Questions about this policy: email hello@openroom.app.