Privacy policy
Last updated 8 October 2026
Ideas at Play is a place to make, share and use interactive teaching models. It is run by Alexis Diamond, an individual based in Ottawa, Ontario, Canada (“we”). This policy explains what we collect, why, where it is kept and for how long. Questions or requests: hello@ideasatplay.org.
In short: students can take part without an account and we never ask for their names. Teachers and creators sign in with Google. We don’t sell data, show ads or use analytics trackers.
Students in a live session (no account)
- An anonymous browser ID. Your browser signs in to our session service (Google Firebase) anonymously and invisibly. The ID isn’t linked to your name, email or school.
- A random seat name and colour, such as “Teal Otter”, shown to your room.
- What you do in the activity: the settings you change, anything you type into answer boxes, who is in the room, and a log of moves your teacher can replay.
Everyone in your room and your teacher can see this. Don’t type personal information (your name, contact details, health information) into answer boxes unless your teacher asks for it.
How long: session data is deleted automatically 12 months after the session started, and your teacher can delete it sooner. Anonymous IDs are deleted 12 months after they were last used.
In Zoom: if you open Ideas at Play inside Zoom, we use Zoom’s meeting and breakout-room identifiers only to put you in the right room. We store a scrambled code made from them, not the identifiers themselves, and we don’t receive your Zoom name or email.
Teachers and creators (Google sign-in)
| What | Why |
|---|---|
| Your name, email address and profile picture from Google; the handle, bio and institution you add | To sign you in, show you as the author of your work, and let others find your creator page |
| Artifacts and their versions, assumption ledgers, comments, likes (on artifacts and comments), reports, follows, folders, and the email addresses you share folders with; notifications about activity on your work (kept 180 days) | These are the service: storing, publishing and sharing your work, and telling you when others respond to it (comment emails can be turned off on the Notifications page) |
| Documents and links you upload to design artifacts from (we keep the extracted text), your prompts and the AI’s suggestions | To generate and revise artifacts, and to show their history |
| Your own AI provider API key, if you add one (stored encrypted) | To make AI requests on your account instead of the free allowance |
| A Google access token, if you use “Create Google Doc”, limited to files Ideas at Play creates (the drive.file permission) | To create a Google Doc of your class’s answers in your Drive. We can’t see your other files |
| Access tokens you create for your own AI assistant, and those of apps you connect (such as Claude): the app’s name and return address, and a scrambled form of each token, plus when it was last used and a running count of recent calls | To let the assistant act as you, to stop runaway use, and to show you what is connected. Revoked tokens stop working at once and are deleted after 30 days; a connected app unused for 90 days must be approved again |
| Generation counts and records of AI jobs | To apply the free allowance and show progress. Job records are deleted after 30 days |
How long: for as long as your account exists. Ask us to delete your account and we will delete your account and the content only you can see within 30 days, and remove it from backups within a further 30 days. Copies others made of your published work under its licence (remixes) belong to them.
Everyone who visits
- Server logs: our host keeps standard request logs (IP address, browser, page) for a short time, to run and secure the site.
- Error reports: when something breaks, an error report goes to our error-tracking service (Sentry). We configure it not to collect names, emails, cookies, request headers or form contents, and never to record screens. Reports are kept for up to 90 days.
- Messages you send us with the contact form: your name (optional), email address and message, and a scrambled code made from your network address (to stop spam; we don’t keep the address itself). They are emailed to us so we can reply, and deleted after 2 years.
- Cookies and browser storage: a sign-in cookie (only if you sign in), a language cookie, and browser storage for your anonymous ID, seat name and a few preferences. No advertising or tracking cookies.
AI providers
When you generate or revise an artifact, your request and any source text you supplied are sent to an AI provider: Anthropic by default, or OpenAI or Google if you choose them with your own key. New comments are also checked by AI to screen out abuse. Under these providers’ API terms, data sent through their paid APIs isn’t used to train their models by default. If you use your own key, your agreement with that provider applies. Students’ session activity is never sent to AI providers.
Who processes data for us, and where
| Service | Used for | Location |
|---|---|---|
| Vercel | Hosting the website | United States |
| Neon | The main database (accounts, artifacts) | United States (Virginia) |
| Google Firebase | Live sessions and anonymous IDs | United States (Iowa) |
| Sign-in; Google Docs export if you use it | Global | |
| Sentry | Error reports | United States |
| Resend | Delivering contact-form messages to us | United States |
| ImprovMX | Forwarding email sent to hello@ideasatplay.org | United States / European Union |
| Anthropic, OpenAI, Google | AI generation and comment screening | United States |
| Zoom | Only if you use the Zoom app | As set by your Zoom account |
Your information is therefore stored and processed outside Canada, mainly in the United States, where it may be accessible to authorities under local law. We don’t sell personal information or share it with anyone else, except if required by law.
Children and schools
Ideas at Play is designed for higher education and isn’t directed at children under 13. A teacher using it with younger students is responsible for any consent their school requires. Schools that need a data-processing agreement can contact us.
Your rights
You can ask to see, correct or delete your personal information, or withdraw consent, by writing to hello@ideasatplay.org. We reply within 30 days. Students: because sessions are anonymous, tell us the session and room, or ask your teacher, who can delete the whole session. If you aren’t satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to the data-protection authority where you live.
Security
Data travels encrypted. API keys are encrypted at rest. Artifacts run in an isolated sandbox that can’t read your account. Session data can only be written by the browser it belongs to. No system is perfectly secure; if a breach puts your information at real risk, we will tell you and the regulator as the law requires.
Changes
We will post changes here and update the date at the top. If a change materially affects how we use information you have already given us, we will tell signed-in users before it takes effect.
See also our terms of use and support page.