What we collect, and what we do with it.

The contact form

Collects your name, your email address, your organisation (optional), what the message is about, the message itself.

To read your message and reply to it.

It is emailed to the studio inbox and you get an automatic acknowledgement. It is not written to any database.

The project enquiry form

Collects your name, your email address, your company, what you want to achieve, the problem in your words, your budget range, your timeline.

To judge whether the studio is a fit for the work before either side spends an hour on a call finding out.

It is emailed to the studio inbox and you get an automatic acknowledgement. It is not written to any database.

The checklist request form

Collects your name, your email address, which checklist you asked for.

To send you the checklist you asked for, and so the studio knows which problem brought you here.

It is emailed to the studio inbox and the checklist is emailed to you. It is not written to any database, and you are not added to a mailing list.

The room itself

Collects the email address your invite arrived at, which is checked and never stored: what is kept in its place is a one-way fingerprint of it, the handle you choose, which is shown next to everything you post, the passphrase you set, which is stored only as a scrambled form that cannot be turned back into what you typed, a shared room code, on one path only and checked without being stored: claiming a handle that posted here before accounts existed, for which no invite address was ever collected, the code carried in your invite link, which your browser sends once and which is checked and never stored. It is worked out from your handle and the fingerprint of your address rather than kept anywhere, how many wrong passphrases have been typed against your name recently and when, kept only to lock out guessing and cleared the moment you sign in correctly, the date your account was made and the date you set your passphrase, the messages you post in the room, the date you first came in, and the time you were last in the room, recorded to the second and refreshed while the page is open, which is what the member count in the header is made of, how far you have read: the room keeps the number of the most recent message you have been sent, so the person who wrote a message can be told it was seen. It is one number that only ever moves forward, not a record of what you opened or when.

To let you in, to keep your handle yours rather than anyone else’s, to show other members who said what, to keep the conversation readable when you come back, and to show the room how many members it has and how many are here now, and to tell somebody their own message was read.

Your handle and your messages are stored in our database and are visible to every other member of the room. So is the fact that you are a member and the time you were last here, though other members see only the totals, never a list of who is online. They are not public, not indexed, and not shared outside it. We do not keep your email address itself. What we keep instead, for everybody invited since 2026-09-09 and for anybody claiming a handle carried over from before accounts existed, is a one-way fingerprint of it, enough to check a later answer against and not enough to write to you or to identify you without our server key. That fingerprint is still personal data under the Act and every right below applies to it. Your passphrase is never stored as you typed it. One thing to know before you pick a handle: typing one into the enter screen tells you, and tells anybody else who tries, whether that handle already belongs to a member, and we accept that trade so a returning member is not asked for a code they no longer have. How far you have read is shown ONLY to the person who wrote the message you have reached, and only as your handle beside their own message: no member can ask what anybody else has read, and there is no page anywhere that lists it. It goes with your roll entry when you delete your account. Ask and your messages go, your roll entry with them so the member count stops counting you, and your account too, which frees the handle for somebody else.

Your member profile

Collects a short bio you write about yourself, up to 280 characters, up to six interests you tag yourself with, one link you choose to share, which may be a website or a way to reach you, a profile photo, if you upload one. It is re-encoded before it is stored, which removes the location and camera data your phone attaches to it, the date you last changed any of this, if you choose to delete your account, the word you type to confirm it, which exists so that an accidental tap on a phone cannot erase everything you have written.

So the other members of the room know who they are talking to, and nothing else. None of it is required, and the room works exactly the same if you leave every field empty.

It is stored in our database and shown to every other member of the room. It is not public, not indexed, not shared outside the room, and not used to send you anything. You can change any of it whenever you like. Deleting your account removes it, along with your messages and any file you shared, and that deletion is permanent rather than a hiding.

Files, photos and video you share in the room

Collects the image, video or document itself, its size and format, and for an image its dimensions, the handle you posted it under, and when, the caption you typed with it, if any.

To show what you shared to the other members of the room, and to let the room see how much of its storage is in use.

It is stored in a private bucket. It is never public: a file is reached only through a temporary signed link that the room hands to members, and it is not indexed anywhere. IMAGES are re-encoded before storage, which removes the location and camera data your phone attaches to them. VIDEO AND DOCUMENTS ARE NOT: they are stored exactly as you sent them, so a video filmed on a phone may still carry the place it was filmed, and a PDF may still carry the name of whoever made it. The room says so at the moment you attach one rather than only here. A moderator who removes a file deletes it outright rather than hiding it, and deleting your account deletes everything you shared.

Pinning a file, and reacting to a message

Collects which file you pinned, and the fact that you pinned it rather than somebody else, which message you reacted to, which of the eight emoji you chose, and that you may remove it again at any time, the handle you are using in the room, attached to both, because the room shows other members who pinned a file and who reacted.

So the room can put the files people thought were worth keeping at the top of the shared list, and so a message can be acknowledged without another message. Naming who did it is deliberate: an anonymous pin is an unattributed edit to what everybody else sees.

Both are stored in our room database, as rows readable only through the room. A reaction disappears the moment you remove it. A pin disappears when anyone unpins it, which any member may do. Removing a message removes every reaction on it, deleting your account removes everything you pinned and reacted to, and neither is ever sent anywhere outside the room.

A private message in the room

Collects what you wrote, exactly as you typed it, who you wrote it to, and who wrote to you, when it was sent, and when the person you sent it to first opened it.

So you can leave something for one member that the rest of the room does not see, and so they find it waiting when they next sign in. The moment it was first opened is stored for one reason only: it is what turns the red count on your side off, and there is nothing else in the room that reads it.

Stored in our room database as rows readable only through the room, and never sent anywhere outside it. No other member can read a message you did not send or receive. The studio can, because the studio holds the database: a private message is private FROM THE ROOM, not from us, and anyone who needs the stronger thing should not use a website for it. Deleting your account deletes the whole of every private conversation you were part of, in both directions, and that last part is stated plainly because it costs somebody else something: the other person loses their own words in that thread too. A two-party conversation with one party erased is not a conversation any more, and the alternative would be keeping an erased person’s name and the messages sent to them indefinitely.

Moderation of the room

Collects the action a moderator took, such as hiding a message or banning a handle, one field holding whichever the action concerns: the id of a message or file, or the handle of a member, a short reason the moderator typed, if they gave one, the moderator code itself, when somebody enters it, which is compared and never stored.

So that a removal is a record rather than a hole in the conversation, and so the room can show that its own rules were applied rather than merely claimed.

It is stored in our database and is not shown to other members. It is kept even after the message it concerns is gone, because a log that disappears with the thing it describes proves nothing. If you delete your account, the log keeps one line recording that an erasure happened, and that line carries no content of yours: it exists so the studio can show your request was honoured.

The room join form

Collects your email address, the handle you post under, which is not your legal name, one line on what you cannot do yet, nothing new at any later stage: approving a request seals your email address, your handle and the time the request arrived into an invite link inside the studio copy of this email, and the line about what you cannot do yet is deliberately not in it. That link stays usable for thirty days and can be pressed more than once, which is what lets the studio re-send an invite that failed to arrive.

To decide whether to send you an invite, and to send it to you.

It is emailed to the studio inbox and nowhere else. While it waits to be read it is not written to any database, you are not added to a mailing list, and there is no automatic acknowledgement: the reply is written by a person. If the studio approves you, two things are then written to the room so the invite can be claimed by you and nobody else: the handle you asked for, which is held for you from that moment, and a one-way fingerprint of your email address. The address itself is still never stored. Ask and it is deleted.

The prayer request form

Collects your name, your email address, your phone number, the prayer request itself, the topics you tag it with, which include anxiety, grief, health, relationships and family, whether you would like someone to talk to you.

So the request can be prayed for, and so someone can contact you if you asked them to.

It is delivered by FormSubmit.co, a third-party form service, to the ministry inbox. It is not written to any database.

If you go into the room, one cookie is set on your device holding the handle you chose, signed so it cannot be edited.

It is what keeps you in the room without retyping the code every visit. It holds nothing but that handle and the date it was issued, it expires after thirty days, it is not readable by JavaScript, and it cannot follow you to any other site. Delete your cookies and you are simply asked for the code again.

Once you are inside the room, a small script called a service worker is saved by your browser, so the room can be installed on your phone or desktop like an app.

It is what makes the install possible, and it is the only reason it is there. It stores no messages and no copy of the room: the room is live only, and offline it shows a page saying so rather than the conversation from yesterday. It is saved only after you enter the door code, never for a visitor who only opens the page, and uninstalling the app or clearing your site data removes it.

If you switch the room between its light and dark appearance, that one choice is remembered in your own browser, using localStorage.

So the room opens the way you left it instead of asking every visit. It stores one word, either "light" or "dark", and nothing else. It never leaves your device, it is never sent to us, it is not readable by anyone else, and it is set only if you press the control: leave it alone and nothing at all is stored, because following your device own setting requires storing nothing. Clearing your browser data removes it and the room simply follows your device again.

Two of the interactive demos in the concepts library keep what you type in your own browser, using localStorage.

It is the feature. A budget tracker that forgets your budget when you refresh is not a budget tracker. It never leaves your device, it is never sent to us, and clearing your browser data removes it.

The exception, stated rather than glossed over

The concepts library holds standalone demo pages. Most were built before the studio wrote this position down and are not as clean as the rest of the site; the ones built since carry no third-party requests at all. If you open one of the older demos:

• Most of the demos, and the prayer request page, load their typefaces from Google Fonts rather than from this site. Your browser asks Google for the font file, which tells Google your IP address and which page you asked for. It does not tell Google what you typed.
• One demo, a restaurant concept, loads its photographs from Unsplash. The same effect, with Unsplash rather than Google.
• That same demo embeds a Google map of a fictional address. This is the one thing on this domain that can set a cookie, and it is Google’s cookie rather than ours. It loads only if you open that particular demo.

None of it is our tracking and none of it tells us anything. It is still a request your browser makes to a company that is not us, which is why it is written here rather than left inside the word “site”. Tidying those pages is on the studio’s own list.

Ask what is held on you

Email the grievance officer and you get a summary of what the studio holds, what it has been used for, and who else has touched it.

Correct or complete it

If something is wrong, say so and it is corrected.

Have it erased

Ask and it is deleted, unless there is a legal or contractual reason to keep it, in which case you are told what that reason is.

Withdraw your consent

Email the grievance officer. Withdrawing is deliberately no harder than sending the form was.

Nominate someone

You can name a person to exercise these rights for you if you die or cannot act for yourself.

Complain

Raise it with the grievance officer first. If the answer does not satisfy you, you can take it to the Data Protection Board of India.