Privacy Policy

TinyFloor ("TinyFloor", "we", "us") is a virtual office you use in your browser at tinyfloor.com. It is run by Jitto Joseph, an individual based in India, who is the controller of the personal data described here (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023).

For anything about this policy or your data, write to support@tinyfloor.com.

When you make an account

• With an email and password: your name, your email address and your password. The password is stored only as a bcrypt hash; we never see or keep the password itself.
• With Google: your name, your email address, whether Google has verified that address, and the ID Google gives your account for TinyFloor. We ask Google only for your basic profile and email. We don't receive your Google password, contacts, files or anything else in your Google account.
• The character you pick, which is saved on your account.

When you visit as a guest

The name and character you choose. Guests don't give an email address.

While you use TinyFloor

• Sessions: a random token in a cookie keeps you signed in. We store only a hash of it, with when it was made, when it expires, when it was last used, and the first 200 characters of your browser's user agent.
• Offices: each office's name, its members and their roles, invitations (including the email address an invitation was sent to) and guest links.
• Chat: the messages and reactions you post, and how far you have read in each channel. Messages are visible to the people in that office, or in the public lobby for lobby chat.
• The floor: what is drawn on an office's whiteboard and the music that is playing, so they are still there when people come back.
• Activity: when your account was made and when you were last active.
• Country: the country your connection comes from, as reported by our hosting provider, Cloudflare. We keep the country only, not your IP address or a more precise location.
• Usage totals: for each office and each day, how many people were on the floor at most and how many minutes were spent there and in calls. These are counts, not a record of who was where.

Calls

Voice and video are sent live between the people in a call, through Cloudflare's real-time network when a direct connection isn't possible or for group meetings. We don't record, store or listen to calls, and neither does anything we run.

Security

To stop abuse we process your IP address briefly: to limit how many sign-ups and sign-ins can come from one address, to lock out repeated wrong passwords for a short time, and for Cloudflare Turnstile, which checks that sign-ups and new guests aren't bots. These counters clear themselves within minutes.

• To run TinyFloor: to sign you in, show you on the floor with your name and character, connect calls and keep your office's chat.
• To keep it safe: to prevent spam, fake accounts and attacks, and to enforce our Terms.
• To understand and improve it: to see how many people sign up and come back, where they come from by country, and how the website is used.
• To reply when you write to us, and to tell you about important changes to the service or these policies.

When someone walks into the public lobby, or makes a new office, a short note goes to our team's private Discord channel: the person's name and character, or the office's name and who made it, with the approximate city, region and country of the connection. It lets us see the service being used as it happens. Lobby chat and what happens inside offices are not sent.

We don't sell personal data, we don't use it for advertising, and we don't build profiles of you for anyone else.

Where the law asks us to name one (for example the GDPR in the EU and UK), we rely on:

• Contract: to provide the service you signed up for or asked to use.
• Legitimate interests: to keep TinyFloor secure, to understand how it's used and to improve it, in ways you would reasonably expect.
• Consent: where it is required, for example for analytics cookies in some countries. You can withdraw it at any time.
• Legal obligation: where the law requires us to keep or disclose something.

Under India's DPDP Act, we process your personal data for the purposes above, with your consent or for legitimate uses the Act allows.

We share personal data only with the services that help us run TinyFloor, each for its own part and bound by its own terms:

• Cloudflare hosts the website, the database and the real-time servers, relays calls and runs Turnstile.
• Google signs you in, if you choose Google, and provides Google Analytics.
• Microsoft provides Clarity, which shows us how people use our pages.
• Discord carries the team notes described above.

Other people in TinyFloor see what the service shows them: your name, character and status in the offices you are in and in the public lobby, and the messages you post there. An office's members can see its member list, including email addresses of members and of people invited.

We may disclose information if the law requires it, to protect people's safety, or to defend against legal claims. If TinyFloor is ever transferred to someone else, your data would go with it under this policy, and we would tell you first.

• Session cookie: keeps you signed in, for 30 days with an account or 7 days as a guest. It can't be read by scripts on the page. TinyFloor doesn't work without it.
• Analytics cookies: Google Analytics and Microsoft Clarity set their own cookies to count visits and to understand how our pages are used. Clarity records interactions such as clicks, scrolling and mouse movement, and masks what is typed into fields. Inside TinyFloor itself (your offices, the lobby, chat and your account) it is set to hide everything on the screen, so names and messages are never recorded.
• Turnstile: Cloudflare may use cookies or browser signals for its bot check.
• Your browser: TinyFloor keeps a few preferences on your own device, such as your theme, your microphone and camera choices, the name and character you last used and whether you've seen the tour. They never leave your browser.

You can clear or block cookies in your browser's settings. Blocking the session cookie signs you out.

• Accounts: until you ask us to delete yours.
• Guests: deleted after a week without a visit.
• Sessions: deleted once they expire.
• Office chat: each channel keeps its most recent 5,000 messages. Lobby chat is deleted after a week.
• Offices: when an office is deleted, its members, invitations, guest links, chat, whiteboard and music are deleted with it.
• Invitations and guest links: deleted 30 days after they expire, are used or are revoked.
• Usage totals: kept for 13 months.

Our database provider keeps point-in-time backups, so deleted data can remain in them for up to 30 days before it is gone for good.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a copy of it in a portable form, object to or restrict how we use it, withdraw consent, and nominate someone to exercise your rights if you can't.

You can change your name, character and password in your account settings at any time. For everything else, including deleting your account, write to support@tinyfloor.com from the address on your account. We will reply within 30 days, and may need to confirm it's you first.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to your local data protection authority, or in India to the Data Protection Board of India.

TinyFloor runs on Cloudflare's global network, so your data may be processed in countries other than your own, including the United States and India. Where the law requires it, these transfers rely on appropriate safeguards, such as the standard contractual clauses our providers offer.

Everything travels over encrypted connections. Passwords are hashed with bcrypt, session tokens and invitation links are stored only as hashes, and sign-ins are rate limited. Access to the service's data is limited to the people who run it. No system is perfectly secure, and if a breach ever affects your data we will tell you and the authorities as the law requires.

TinyFloor is not meant for children under 13, and we don't knowingly collect their personal data. If you are under 18, use TinyFloor only with the permission of a parent or guardian. If you believe a child has given us personal data, write to support@tinyfloor.com and we will delete it.

If we change this policy, we will update the date at the top of this page. If a change is significant, we will tell people with accounts by email or in TinyFloor before it takes effect.