Privacy
Version of 2026-10-06. Written in plain language: if something is unclear, ask us.
Who processes your data
With class lists (Aula plan), the controller of the students' data is the school or teacher who creates the list; we process it on their behalf and only to run the session. When the teacher belongs to an organisation (a university, for example), the organisation is the controller.
If you are a student or attendee
You don't need an account. What is stored depends on how you join:
- Anonymous (the usual case): we store your presses (slower, I'm lost, all good) with a random identifier. Neither your name, your email nor your IP is linked to them.
- With a nickname: also the nickname you type. The teacher sees it and it is stored with the session.
- With a class list: you join with your name from the list and the teacher sees that you are in class. The list is created by your school or teacher and never contains your email.
- With a verified account (only some adult sessions): your account (your email) is used to identify you in that session.
Identified to join, anonymous when you press: in sessions with a class list or a verified account, before joining you choose whether your presses go with your name or are anonymous. If anonymous, they go to a separate random identifier and the link between the two exists only on your phone: it is not stored anywhere on our servers, so neither the teacher nor we can tell what you pressed. The teacher only sees how many students chose it. In some schools the organisation decides (always with your name, or always anonymous) and the session screen tells you before you join. In very small groups, the context could give away who pressed.
Cookie: just one, technical and signed, to recognise you if you reload the page. It lasts 24 hours from your last connection. No third-party cookies and no analytics: we do not track students.
Your IP: it is not stored with your data. It is only kept in memory for a few minutes to stop abuse (at most 1 hour for the joining limit and 10 minutes for the wrong-code limit).
How long: in free-plan sessions, your presses, nickname or name are deleted 24 hours after the class ends; only statistics for the class as a whole remain (how many signalled what, and when), with nothing of yours. In paid plans they are kept so the teacher can see the session report, for as long as they have that plan. If the plan ends, they are kept hidden for at least 90 days; after that, everything of yours is deleted and only statistics for the class as a whole remain, which are removed 365 days later.
Want something deleted: ask your teacher (they can remove you from the session at any time) or write to us.
If you are a teacher
- Your account: email, first and last name, password (hashed; we never see it), two-factor methods and the date you accepted this policy. To provide the service (contract).
- Security: sign-in records (date, IP and browser) and security emails. To protect your account and detect abuse (legitimate interest).
- Your content: sessions, outlines, folders, settings, class lists and reports. You can delete them at any time and download all your data as a ZIP whenever you want, from your account (students appear as «alumno1», «alumno2»…).
- Payments: your card is processed by Stripe; we never see it. We keep the record of charges and billing details to issue the invoice and meet tax obligations (legal obligation).
How long: for as long as you have an account. If you ask us to close it, we delete your content; the record of charges and invoices is kept for as long as tax law requires, and security records for as long as needed to protect you against abuse.
If your paid plan ends (or your organisation's): the sessions you gave with it are hidden, not deleted, for at least 90 days, and they reappear instantly if you have a plan again. After that we keep a copy (with no personal data of your students, in the EU) and delete the individual data of those sessions; their overall statistics remain and are removed 365 days later. We tell you the exact date 30, 7 and 1 day before each step, and you can download all your data at any time.
Unused free accounts: if you do not log in, give a session or use an API key for 6 months, we delete the account with all its data. We warn you after one month, three months, five months (with the date) and 7 and 1 day before; logging in is enough to keep it. We keep a copy, with no data of your students, for 90 days in case you ask for it.
Who we work with
Only providers needed for the service, under a processing agreement and with GDPR safeguards:
- Hosting and database in the European Union.
- Cloudflare: network and attack protection (web traffic).
- Stripe: payments (only teachers on a paid plan).
- Postmark: sending emails (only teachers).
- Google: only if you choose «Sign in with Google».
Some of these providers may process data outside the EU; in that case they do so with the safeguards the GDPR requires.
Your rights
You can ask to see your data, correct it, delete it, restrict or object to its use and take it with you. If it is class-list data, also contact your school. If you think we are not doing it right, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.