Privacy Policy

1. Who is responsible

RealHatApps provides the Service and is responsible for the personal data described in this policy. Contact: support@askroomlive.com.

2. What we collect

From teachers

• Account details: your name and email address, a hashed password if you set one, and when you accepted the Terms.
• Sign-in providers: if you use Google or Microsoft, we store the identifier they give us for your account, your name, your email and, if provided, a profile picture. We never see or store your Google or Microsoft password.
• Your content: the assessments, questions, answers keys, explanations and images you create or upload.
• Session records: which assessments you ran, when, with what settings, and the results.
• Reports you send us through the report page, and any emails you send us.
• Preferences such as your chosen colour theme, stored in a cookie on your device only.

From students

• The display name typed when joining, the answers given, how long each took, and the join and finish times.
• A random token stored in the browser so a student who loses connection can rejoin the same session. It identifies the browser, not the person.

Students do not create accounts and we do not ask them for an email, phone number, date of birth or any other personal details.

Automatically

• Your IP address and browser type, used to protect against abuse (for example limiting repeated sign-in attempts) and held in short-lived server logs.
• Strictly necessary cookies: a signed session cookie that keeps you logged in, and short-lived cookies used during sign-in and email verification. We do not use advertising or tracking cookies.

3. Why we use it

• To provide the Service: running live sessions, marking answers, producing reports and exports.
• To keep accounts secure: verifying your email, resetting passwords, detecting abuse.
• To respond to reports and support requests.
• To understand, in aggregate, how the Service is used (for example, how many sessions ran this week) so we can improve it. We do not profile individual teachers or students.

Where the law requires a legal basis, we rely on performing our agreement with you, our legitimate interest in running a secure service, and your consent where you choose an optional feature such as Google sign-in.

4. Who we share it with

We do not sell, rent or trade personal data. We share it only with the providers needed to run the Service, each of which may only use it to provide their service to us:

• Hosting and database providers, which store the Service and its data on our behalf.
• Email delivery providers, which send verification, password reset and notification emails.
• Sign-in providers, only when you choose to sign in with one of them instead of a password.
• Network and security providers, which route traffic to the site and protect it from attacks.

Each provider works under an agreement that limits what it may do with the data. You may ask us for the current list of providers by writing to the address in section 1.

We will disclose information if required by law, a court order, or to protect the safety of students, teachers or the Service. If the Service is ever transferred to another organisation, your data may transfer with it, and we will tell you before that happens.

5. Students and children

Students take part under the supervision of a teacher and do not create accounts. Teachers are responsible for using the Service in line with their school's policies and any consent requirements that apply to children where they are. Teachers should ask students to use only a first name or a nickname where their school requires it. We do not knowingly collect personal information from children beyond a display name and their answers to the teacher's questions, and we do not use any of it for marketing. Results belong to the teacher's account and are removed when the teacher deletes the session or the account.

6. How long we keep it

• Your account and content: until you delete them. Deleting a session removes its results. Deleting your account removes everything you created.
• Deleted data may remain in encrypted backups for up to 30 days before it is overwritten.
• Verification codes: 10 minutes. Reports: until resolved and for 12 months after, so we can spot repeat problems.
• Server logs containing IP addresses: up to 14 days.

7. Your rights

You can see and change your name from your account page, and export your results at any time. You can delete your account there too. You may also ask us to access, correct, delete or restrict your data, or object to how we use it, by emailing support@askroomlive.com. We answer within 30 days. If you are in a country with a data protection authority, you may also complain to it.

8. Security

All traffic is encrypted with HTTPS. Passwords are stored only as strong one-way hashes. Sign-in attempts, code requests and uploads are rate limited. Uploaded images are checked to be genuine image files. Access to the server is by key only. No system is perfectly secure, so please use a password you do not use elsewhere.

9. Where data is stored

Your data is stored on servers run by our hosting provider and may be stored or processed in a country other than the one you live in. Our providers may also process data in other countries under their own safeguards. Wherever it is processed, it is protected as described in this policy.

10. Changes

We will post any changes here and update the date at the top. For significant changes we will show a notice on the site or email you.

See also the Terms of Service and the Content Guidelines.