Deckroom
Sign in
Privacy Policy
Deckroom is a web app for live, interactive presentations. This policy explains what data we collect when you use Deckroom at deckroom.live, why, who else handles it, and the choices and rights you have. We keep it in plain language and we only describe what the app actually does.
In short: we collect what we need to run your account and your presentations, we don’t sell your data, we don’t show ads, and we don’t use analytics or tracking cookies.
Who we are
Deckroom is operated from India. For anything about your data, write to privacy@deckroom.live.
There are two kinds of people who use Deckroom:
- Presenters create an account, build decks and run live sessions.
- Attendees join a presenter’s session with a link or QR code. They don’t create an account.
For presenters’ accounts and decks, we decide how the data is used. For what attendees contribute in a session (answers, questions, names), the presenter decides what to ask and how to use the results; we process that data to run the session for them.
What we collect
If you are a presenter
- Account details: your name and email address. If you sign up with a password, we store only a salted hash of it (PBKDF2), never the password itself.
- Google sign-in: if you choose “Continue with Google”, we receive your Google account ID, email address, whether Google has verified it, and your name. We don’t receive your Google password or access to anything else in your Google account.
- Your decks: the slides, questions, speaker notes and image links you add.
- Images you upload: stored with Cloudflare and shown on your slides. Anyone who has an image’s address can open it (attendees’ browsers need it to show your slides), and the addresses are long and random, so they can’t be guessed. Search engines are told not to index them.
- Sign-in sessions: a record that you are signed in, so you stay signed in on your device.
- Failed sign-in attempts: the email address and time, used only to slow down password guessing. These records are cleared after a successful sign-in and regularly removed.
If you are an attendee
- The name you enter when you join, or a random name we assign if you don’t enter one.
- What you send in the session: poll and quiz answers, words, votes, reactions, questions and upvotes, and pace signals (“too fast”, “too slow”). Quiz points are calculated from your answers and timing.
- A random identifier stored in your browser, so a page reload keeps your answers and score. It isn’t linked to your identity.
- Whether the session page is currently open on your screen, shown to the presenter only as a count (for example, “24 of 26 watching”).
Camera and microphone
- Camera: if a presenter turns on their camera, still frames from it are sent through our servers to the session’s attendees as they happen. We don’t store them. Attendees’ cameras are never used.
- Microphone: the voice-following teleprompter uses your browser’s built-in speech recognition, on the presenter’s device only, and only while the presenter has it switched on. Deckroom never receives or stores audio. In Chrome and Edge, the browser may send audio to Google or Microsoft to turn speech into text, under their own privacy terms.
Technical data
Like any website, our hosting provider processes your IP address, browser type and request details to deliver pages and protect the service from abuse.
How we use it
- To provide Deckroom: sign you in, save your decks, and run live sessions.
- To keep it secure: prevent abuse, password guessing and unauthorised access.
- To run the AI editor when you ask it to, and to count how many AI edits you’ve used each day.
- To respond when you contact us.
We don’t sell personal data, we don’t share it for advertising, and we don’t use it to build profiles. We don’t use your decks or session data to train AI models.
Where the law requires a legal basis (for example the EU and UK GDPR), we rely on performing our contract with you (running your account and sessions) and our legitimate interest in keeping the service secure.
Who else handles data
- Cloudflare hosts Deckroom: the website, the database, live sessions and network security. Data is processed on Cloudflare’s global network, which may be outside your country.
- Google, if you use Google sign-in. Pages also load fonts from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with Google.
- cdnjs (run by Cloudflare) serves an animation library used by the live session pages.
- DeepInfra, only when you use the AI editor: the slide you’re editing (and its question, if it has one), the deck’s title, the titles of the slides around it, and your instruction are sent to DeepInfra’s AI service to generate a suggestion. Nothing else is sent: no attendee data, and not your email or name. Don’t put sensitive personal information in slides you ask the AI to edit.
We may disclose data if the law requires it, or to protect the rights and safety of our users or the service.
Cookies and browser storage
dr_session: keeps a presenter signed in. Lasts 30 days, or until you sign out.dr_oauth: protects the Google sign-in step. Lasts 10 minutes.- Local storage in your browser holds your attendee identifier, a session’s join code, a presenter’s session key on their own device, and display preferences.
These are strictly necessary for Deckroom to work. We don’t use analytics, advertising or tracking cookies. Cloudflare may set its own strictly necessary security cookies.
How long we keep data
- Your account: until you ask us to delete it.
- Decks: until you delete them.
- Live sessions: a session’s data (attendee names, answers, questions, reactions) is kept with its deck so the presenter can present it again, and is erased when the presenter deletes the deck.
- Sign-in sessions: up to 30 days.
Your rights
You can ask us to access, correct, delete or export your personal data, or object to how we use it. Write to privacy@deckroom.live and we’ll respond within 30 days. Presenters can also delete their decks themselves at any time.
If you were an attendee, your data sits in a presenter’s session. You can ask the presenter, or contact us and we’ll help.
- EU and UK: you have the rights above under the GDPR and UK GDPR, and you may complain to your data protection authority (in the UK, the ICO).
- California and other US states: you have the right to know, delete and correct your data. We don’t sell or share personal information for cross-context behavioural advertising, and we won’t treat you differently for using your rights.
- Canada: you have rights of access and correction under PIPEDA, and you may complain to the Office of the Privacy Commissioner of Canada.
- India: you have the rights given by the Digital Personal Data Protection Act, 2023.
Security
Deckroom is served only over HTTPS. Passwords are stored as salted hashes, sign-in cookies can’t be read by page scripts, and each deck and session is only available to its owner. No system is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.
Children
Presenter accounts are for adults (18 or over). Attendees don’t create accounts. If you present to children, for example in a classroom, you are responsible for any consent your school or the law requires; attendees can always join with a made-up name. If you think a child has given us personal data, contact us and we’ll delete it.
Changes
If we change this policy, we’ll update it here and change the date at the top. If the changes are significant, we’ll tell presenters by email or in the app before they take effect.