Privacy Policy

Effective 16 September 2026 · Applies to openchair.tech

openchair (the "Service") is a community-based research platform about reclined working environments. This policy explains what personal data we collect, why, how long we keep it, and what rights you have.

1. What we collect

1.1 When you sign in with Google / YouTube

Sign-in is available only through Google OAuth. When you sign in we receive and store:

• Your Google account identifier (sub), email address, display name and profile picture URL.
• Your YouTube channel, via the youtube.readonly scope: channel ID, channel title, handle (@…) and thumbnail URL. If you have no channel or decline the scope you can still sign in; these fields stay empty.

We do not store YouTube access tokens. The token is used once, during sign-in, to look up your channel and is then discarded. We do not request refresh tokens (offline access). Your channel details are re-fetched and refreshed each time you sign in.

1.2 Data created while you use the Service

• Posts and comments you write, with creation and edit timestamps.
• A session cookie (oc_session, keeps you signed in for 30 days) and a short-lived cookie used only during the sign-in handshake (oc_oauth, 10 minutes).
• Standard request logs kept by our hosting provider, Cloudflare (IP address, user agent, path, time). We run no analytics or advertising trackers.

2. Why we use it

• To identify you and keep you signed in.
• To attribute posts and comments to you (name, or your YouTube handle and thumbnail).
• To run the community: spam and abuse handling, and determining administrator rights.
• To keep the Service reliable and diagnose failures.

3. How long we keep it

• Account data: until you ask us to delete it.
• Posts and comments: hidden immediately when you delete them; kept internally for a retention window so reply threads keep their shape, then purged. Deleted together with your account on request.
• Sessions: removed at expiry (30 days) or when you log out.
• Infrastructure logs: per Cloudflare's retention (a matter of days).

4. Third parties

We never sell personal data. The following providers process data on our behalf to run the Service:

• Google LLC — authentication and channel lookup through the YouTube Data API. This Service uses YouTube API Services. By signing in you also agree to the YouTube Terms of Service; Google's handling of your data is governed by the Google Privacy Policy.
• Cloudflare, Inc. — hosting, database (D1) and request logs.
• YouTube embeds — videos in posts are embedded from youtube-nocookie.com; YouTube may set its own cookies and process data when you play a video.

5. Your rights

• You can ask to access, correct or delete your data, or delete your account, at the contact below. We act without undue delay.
• You can revoke this Service's access to your Google / YouTube data at any time in your Google account security settings. After revocation we fetch nothing new; data already stored is deleted on request.
• You can block cookies in your browser, but you will not stay signed in.

6. Children

The Service is not directed at children under 14 and we do not knowingly collect their data.

7. Security

All traffic is encrypted with HTTPS. Session cookies are HttpOnly, Secure and SameSite. Administrator rights are granted only to designated accounts.

8. Changes

Changes are posted on this page with a new effective date. Material changes are announced within the Service.

9. Contact

Data controller: the openchair operator · support@openchair.tech