Privacy

What we keep

• Your name. The one you type when you first open GoBraw, or the one your sign-in gives us.
• Your email address, if you sign in and Google, Microsoft or Discord has checked it is yours.
• The id Google, Microsoft or Discord uses for your account. It is a number, not a password.
• The web address of your sign-in’s picture, if you have none in GoBraw. We keep the address, never the picture.
• Each device you use GoBraw on: its name, what kind it is (Mac, Windows and so on), a public key that lets it prove it is yours, and when it was added and last seen.
• A scrambled copy of the key that keeps a device signed in. We cannot read the key back from it.
• If you make a Place or are added to one: the Place’s name, its rooms and screens, its bookings, who its members are and which views each may open.
• If you ask to join a Place or an experience: who asked, the name of the device you asked from, how you signed in, whether you used its invite link, and the answer. An ask ends after 7 days unless the Place sets another time.
• A Place’s invite link, until it ends after 7 days or someone who may add people stops it. The link only lets someone ask; it never lets anyone in.
• If someone adds you to a Place by your email address before you have signed in: that address, for up to 30 days unless the Place sets another time.
• If you share an experience: its name and who may open it. Never its slides.
• If you sign in on gobraw.com: a sign-in record with your network address and the name of your browser, and one cookie from app.gobraw.com that keeps you signed in. Signing out deletes both; a sign-in left alone stops working after 7 days without a visit.

Paying for a Place

• Paddle takes payments in pounds and Creem takes dollars and euros. Each is the seller: it keeps your card and charges any tax. We never see or keep card details.
• For each Place we keep whether its subscription is running, the date it is paid up to, monthly or yearly, the currency, Paddle’s or Creem’s numbers for the customer and the subscription, and who started paying.

What Google, Microsoft and Discord give us

• When you sign in we ask for three things only: that it is you, your email address and your name (the permissions called openid, email and profile).
• With Discord we ask for your account’s name, picture and email address (the permissions called identify and email).
• If it is a work or school account, we also see which organisation it belongs to. We use it only to put you in a Place that has asked for everyone from that organisation.
• We never see your password. GoBraw has no passwords of its own.
• We cannot read your mail, your calendar, your contacts or your files.
• We check the sign-in once and do not keep the token Google, Microsoft or Discord sent.

What we never keep

• Your experience. Slides, words, pictures and video stay on your own computers. GoBraw will never have storage.
• Presses on a shared screen. If you share a screen in your Place, GoBraw Host on your computer writes down each press made on it by a member from elsewhere: who pressed, their computer's ID, the screen, the press and the time. It stays on your computer and is never sent to us. Each day's record is deleted after 30 days.
• Passwords.
• Tracking you across sites. This website sets no cookies of its own and keeps nothing in your browser; the only cookie is the sign-in one above. Everything on it, its typeface and code too, comes from gobraw.com.

Where it is kept

• On servers run for us by Railway, in its EU West region (Amsterdam, the Netherlands). The database is there too.
• Logs and errors, from GoBraw’s servers and from this website, are also sent to PostHog, in its EU region (Frankfurt, Germany).
• If a Place shares the link to its screen sizes, anyone with that link can see the Place’s name and its screens’ names and sizes. Nothing about its people.

Logs

• The logs we write say what happened, with ids and counts. They never carry a name, an email address, a key or anything you typed.
• Each call to GoBraw’s servers writes one line: what was asked, the answer’s code, how long it took, your account id if you are signed in, and the ids PostHog gave your browser for this visit, so a failure on this website can be matched to its line.
• These lines are kept by Railway and by PostHog. PostHog deletes logs after 14 days; errors are kept as long as PostHog keeps our project’s events.
• To stop one computer flooding sign-in, we count tries against a scrambled form of its network address, never the address itself. Each count is deleted when its minute or hour is over.

Errors and visits on this website

• To find and fix problems, gobraw.com tells PostHog, in the EU, which pages are opened, where people click (never the words on the page), script errors, and calls to GoBraw that failed, with the id the GoBraw server gave that call.
• If you are signed in, it tells PostHog your GoBraw account id, never your name or email address. It never sends anything you type, the part of a link after #, or a recording of your screen.
• PostHog sees your network address and browser like any website does. Nothing is kept in your browser, so each visit starts fresh.

How to be forgotten

• In GoBraw Studio, open You and press Forget me on GoBraw. Your account, your devices and your sign-ins are deleted from our servers. A Place only you are in goes with you.
• Your computer keeps your experience. Forgetting never deletes it.
• If other people are in a Place and you are the only one there who can do everything, GoBraw asks you to give someone every permission you hold first.

Linked storageNot available yet

• Later you will be able to link your own storage, OneDrive first, then Dropbox, then Google Drive, so a screen in another building can fetch an experience’s pictures and video.
• The files will sit in your storage, not ours. This page will say what that asks for before it is switched on.

Who runs GoBraw

GoBraw trading as MacRae Ventures LTD.

To ask anything about this page, or to be forgotten without the app, write to hello@gomacrae.com.