Privacy policy

1. Who is responsible

The data controller is Elisma, which trades as Slide Roulette. The full details are at the end of this page. Write to support@slideroulette.com about anything on it.

2. Signing in

To host a game, keep a history or buy something you need an account, and an account is an email address. We send you a link to sign in; there is no password. Sign-in and the account record are run by Supabase, on servers in the EU (Frankfurt), and the mail itself is sent by Resend.

We process your email address to give you the account you asked for, which is the contract between us. A display name is taken from the part of the address before the @ and is used nowhere a stranger can see it.

3. Buying something

Payments run through Stripe. You type your card details on Stripe's own checkout page, and we never see them, receive them or store them. For the payment itself Stripe is an independent controller and its own privacy policy applies.

What we keep is what tells us you have paid: Stripe's customer reference, the checkout session reference, the subscription reference where there is one, which product it was, whether it is active, and when it started and ends. We process it to give you what you bought, which is the contract, and we keep the record of the sale because Danish bookkeeping law says to.

4. Playing a game

A player joins a room with a display name and nothing else. No account, no email address, no sign-up. While the room is alive it holds the display names in it, the votes, the reactions and the scores, so that the game can be played. That is our legitimate interest in running the game the room asked for, and it goes when the room goes.

If a signed-in host opened the room, the evening is also written to that host's history: the room, and for each scored talk the presenter's display name, the deck, its topic, the score and how many people voted. That is what the host came for, and it is what the highlight card is made from. Nothing about a player leaves the room and the host's history.

If the host turned the applause meter on, the screen showing the slides asks that one browser for the microphone and measures how loud the room is while it votes. What is kept is a single number from 0 to 100 for each talk. The applause meter records, keeps and sends no audio. For the meter it is the screen showing the slides that is asked for the microphone, never a player's phone, and a browser that says no simply means the room plays without a meter.

If the host turned Pictures from the room on, the room can be asked for one picture between talks. The host chooses that, and it is off unless he turns it on. The asking happens on each phone, one picture at a time, and the sentence saying what the picture will be used for is on the screen before any camera opens. The task is always about something you have or about a thing, and never about another person. If you decline, nothing happens and nobody can see that you declined.

What is kept is the picture itself, which seat handed it in, when, and which version of that sentence was on the screen. No name and no account. The picture is held in a private store that serves nothing without a signature that expires, and your phone reduces it and writes it out as a fresh JPEG before it leaves the device, so none of the camera's own data about where, when or on what device it was taken goes with it. We rely on your consent, and you can take it back from your own phone at any point for the rest of the evening, including while the picture is on the big screen: it is deleted at once, and the slide goes back to the picture the deck itself carries.

A picture is not altered by any model, is not sent to any third party, does not appear on a highlight card, in a recap or behind any link, and is not kept past the evening. Everything is deleted when the room closes, and in any case within twenty-four hours of the picture being taken: a scheduled sweep runs every hour and deletes everything older than a day without looking at which room it came from. If your phone cannot prepare the picture, nothing is sent and the evening carries on.

If the host turned Remote play on, whoever the wheel lands on can give their talk with a camera and a microphone when they are somewhere else. It is off unless he turns it on. Before the camera opens, the presenter is asked on their own device and told what will be sent. The room itself is never on camera. For the talk itself, only the presenter's camera and microphone are sent, and only while they have the floor.

No recording is made and none is kept. Picture and sound are sent live through Cloudflare to the big screen and to the people watching. We do not keep picture or sound afterwards. What the game keeps is what it always keeps: that the talk happened, its score and how many people voted.

We rely on your consent. You can turn the camera or the microphone off from your own device at any point, and the talk carries on without it. If you decline, or the device does not allow it, you give the talk with the slides alone and no picture or sound is sent.

A highlight card is reachable by anyone holding its link, which is a long unguessable address. Share it as widely or as narrowly as you like; we do not list them anywhere.

5. Decks and pictures

A deck or a picture uploaded through the deck studio or from your own account is stored in our Supabase storage, together with the pages rendered from it, and is used to show slides in a room. Whoever uploads it is responsible for it and warrants the right to share it, as the terms say. Documents are not read for anything except turning them into slides.

6. How we count, and why there is no banner

We measure whether the product works. It matters to us how many rooms are opened, how many people are in one, how long a talk runs, and whether somebody who started a checkout finished it. We use PostHog on its EU cloud, in cookieless mode.

• Nothing is stored on or read from your device. No cookie, no local storage, no session storage. PostHog works out an identifier on its own servers from a salt that changes every day, so it cannot follow you from one day to the next, and there is nothing to consent to storing.
• No free text is ever sent. Not a name, not a room code, not a deck topic, not a slide, not an email address, not a referrer and not the address of the page you are on. The events carry a fixed list of named values and numbers and nothing else, and a test refuses to build the app if one of them could carry a string.
• No IP address is sent as part of an event. PostHog does use the IP address of the request, together with the daily salt and your browser's user agent, to work out that day's identifier, and it does not keep it as data about you.
• If your browser says Do Not Track or Global Privacy Control, nothing happens at all. We do not load the analytics library, so no request is made. That is the opt-out, and it works whatever the law would have allowed.

We rely on our legitimate interest in knowing whether the thing we built works. There is no consent box, because nothing is stored on your device and nothing is asked of you; a dialogue in front of the code box on the front page would cost more evenings than the numbers are worth.

7. Cookies

We use these cookies and no others. A sign-in session cookie set by Supabase when you sign in, which is what keeps you signed in. A cookie that remembers what the bar at the top of the page should show: the piece you play as, the first part of your sign-in address, and which plan you are on. It exists so that a page we serve from a cache can tell you that you are signed in without asking anybody who you are. It holds nothing secret, it names nobody, and nothing on this site is decided by it. A referral cookie, set only when you have arrived on a link with somebody's referral code in it and press Keep the discount, which keeps that code for 30 days so the discount is there when you buy. And, if a part of the site is ever closed behind a passcode, a cookie that remembers you typed it, so you only type it once. The room also keeps a few things in your browser's local storage: the name and the piece you play as, the key that lets a phone that lost its connection rejoin as the same player, and your sound and reaction settings. All of it is necessary for something you asked for. Analytics sets no cookie at all.

8. Who else processes it

Supabase, for the account, the history and the files, on servers in the EU. Stripe, for payments. Resend, for the sign-in email. PostHog, on its EU cloud, for the counting. Sentry, in Frankfurt, for the error reports. Hostman, in Frankfurt, which runs the machine that turns an uploaded presentation into pictures. Vercel, which serves the website, and Cloudflare, which runs the rooms and also passes picture and sound through when a talk is given from elsewhere. Vercel and Cloudflare both run servers around the world and a request of yours may be handled by one of them outside the EU; what is stored rather than passed through is stored in the EU.

One more, when the deck-writing feature is switched on: Anthropic, in the United States, whose model writes a deck from the topic a host asks for. It is off at the moment and nothing is sent to it. When it is on, what crosses is the topic, the tone and the language of the deck being asked for — never a display name, an email address, a room code or anything a player typed. The transfer out of the EU rests on Anthropic's data processing addendum and the European Commission's standard contractual clauses, and the terms say the same thing from the other side: a deck written on demand is written by an AI model.

9. How long it is kept

• Your account and its history, until you ask us to delete it. Write to support@slideroulette.com and it goes.
• A room, 24 hours after the last thing that happened in it. Then its storage is deleted, display names and all.
• A presentation you uploaded, until you take it down. When you do, the document and the pictures made of it are deleted with it. Delete your account and they go the same way, with everything else of yours. What never becomes a finished presentation we clear away ourselves: the document behind a failed conversion after seven days, and the file behind an upload that never finished after no more than a day.
• The record of a sale, five years from the end of the financial year it falls in, because the Danish bookkeeping act says so. That record is the one Stripe holds and the one in our accounts. It is not the row in our own database: the entitlement is attached to your account and is deleted with it, which is why deleting an account also ends any subscription it was carrying. Ask us to delete the account and the app forgets you; the bookkeeping keeps the sale, because it has to.
• Analytics events, in PostHog. The ones your browser sends carry an identifier that changes every day and is not tied to you. The ones a room sends carry an identifier made from that room. The ones about a purchase carry an identifier made from your account with a secret key, so a checkout that was started and a payment that went through can be counted as one buyer, without an email address or a name ever being sent.
• Error reports, in Sentry, for as long as it takes to fix the error, and at most 90 days.

10. Your rights

Under the GDPR you may ask us for:

• a copy of what we hold about you, and to have it corrected if it is wrong;
• deletion of it, or that we stop using it for a while;
• it in a portable form, or sent to somebody else;
• that we stop processing it where we rely on a legitimate interest, which includes the counting above.

Write to support@slideroulette.com. We answer within a month.

You may also complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark (datatilsynet.dk).

11. Children

Slide Roulette is not directed at children under 13 and we do not knowingly collect anything about one. A player joins a room with a display name and no account, so nothing about a player who is a child reaches us beyond that name and what they did in the game. If you believe a child has an account here, write to support@slideroulette.com and we will remove it.

12. Changes to this policy

We may change this page. A change is announced here, and the date at the top is the date the version you are reading took effect.