Privacy

• When a host opens a room we store the room's PIN, its start and end time, and an anonymous host id. Rooms with "verify presence" also get a random secret used to check the live QR code.
• When someone checks in we store the name they type, the time they joined, an anonymous student id and, in verify rooms, whether they scanned the live board.
• All of this is deleted automatically when the room's timer runs out (at most 24 hours), or earlier if the host ends the room or removes a name. If the host is signed in, the finished room is saved to their account first (see Saved rooms).
• We also keep a list of which PINs belong to a host id so the host can find their open rooms again. Entries for rooms that have ended are removed the next time that list is read.

• teacherId: anonymous host id, so you can manage rooms you opened. 30 days.
• studentId: anonymous id, so checking in again updates your entry instead of adding a duplicate. Deleted when you close the browser.
• wasStudent: remembers that this browser checked in to a room before, so we can count how many new hosts first saw Im Here! as a participant. It only holds the value "1". 1 year.
• ref: which of our own links brought you to the page for opening a room (for example "join"). 7 days, removed once you open a room.
• host: only set when you open a room. Holds the date of your first room, how many rooms you've opened, the week and day of your latest one, and whether you first came from an ad, from checking in to a room, or directly. We read it to count how many hosts come back, and store only the totals. 400 days.
• session: only if you sign in with Google. 30 days, removed when you sign out. Short-lived sign-in cookies are used during the Google sign-in itself.

These are all first-party, needed for the app to work or counted anonymously, and never shared.

Signing in is optional and only for hosts. If you do, we store your email address, name, profile picture link and Google account id, plus when you signed up and were last seen. Your rooms are saved to that account so they follow you across devices (see below). Your profile picture is loaded from Google's servers when it's shown.

If you don't sign in for 18 months, we delete your account and everything saved to it. You can also delete your account yourself at any time from the account menu on the page for opening a room.

• When a signed-in host's room ends, we save it to their account: the PIN, when it started and ended, whether it used "verify presence", and the names that checked in with their join times and verified status. Rooms that were kept in your browser before you signed in are saved the same way the next time you open the page for opening a room.
• The list of names is encrypted before it's stored, and is only decrypted to show it to you.
• Saved rooms are kept until you delete them, or until your account is removed after 18 months without signing in.
• To delete one room, press the × next to it under "Past rooms". To delete all of them, use "Delete all saved rooms" in the account menu.
• When you sign out, we remove your rooms from this browser. If a room hasn't reached your account yet, we try to save it first, and only keep it in the browser if that fails.
• If you don't sign in, nothing changes: past rooms stay in your browser only. People who check in never have accounts.

Your roster, sign-in sheet settings, the rain effect setting and your cookie choice are saved in your browser's local storage on this device.

If you're not signed in, your past rooms and their attendance lists are kept in your browser only, and we never receive them. Clearing your browser data removes them.

If you're signed in, your past rooms are kept in your account, not in the browser. The browser only holds a copy of a finished room until it's saved to your account, then removes it.

We keep daily and weekly totals such as "rooms opened", "check-ins", "rooms opened from a link on a room page" and "hosts who came back this week". They are plain numbers, not linked to any person, device or IP address, and are kept for about 13 months. To slow down abuse, our server briefly counts requests per IP address (for at most an hour).

We advertise on Google and Microsoft Bing. If you arrived from one of those ads, the ad click id in the link is kept in this browser tab's session storage, and when you open a room we record that the room came from an ad, without the click id itself.

On pages about hosting (like the page for opening a room) we load Google Ads and Microsoft Advertising tags, which set their own cookies to count which ad led to someone opening a room. When a host comes back to that page, we may also tell them that a room with several check-ins was held, without any names or room codes. They never load on room or check-in pages, and ad personalisation is turned off. Visitors in the EU, UK and Switzerland are asked first. Anyone can turn them off below.

We don't sell data and aside from Cloudflare Web Analytics, there are no other trackers or analytics tools not previously mentioned.