Privacy Policy

Draft — 14 November 2026. Operator, hosting and operational retention details still need confirmation before public launch. This draft describes the current application; it does not certify GDPR compliance.

Who is responsible

The service operator is the controller for account and service administration data:

Aleksandr Vashkyavichus
hello@onairhq.io

Privacy contact: hello@onairhq.io.

Data and purposes

Creating an account requires an email address and password. A name is optional. We store the email, optional name, a salted scrypt password hash, account creation time, acceptance time for the Terms and Privacy Policy, account status and Event limits. We do not store your password in plain text. This data is used to provide and protect your account.

We store your Events: titles, dates, time zones, Rundown Segments, speaker names, topics and notes, Display settings, Timer state, Messages, Controller and Display access tokens, and edit history. Avoid entering sensitive personal data. You are responsible for having a lawful basis to include other people in your Rundowns. Where we handle this content on your instructions, our role may be that of a processor; the applicable processing terms and provider arrangements remain to be confirmed.

We use a necessary sign-in cookie containing a random session token. The server stores its SHA-256 hash, account reference and creation time. Password reset tokens are also stored as hashes with expiry times. No advertising or analytics scripts, including Yandex Metrika, are loaded on this international copy.

The server uses IP addresses and email addresses in memory to limit abusive requests. Connected Displays report a tab identifier, optional Display name, browser/device label, connection times and clock accuracy. Service and web-server logs may contain request paths, IP addresses, account identifiers and technical errors. Application error logging masks long token-like path components; infrastructure access logs may still contain access links.

Pilot counters store daily totals, language and country from the local proxy, without IP addresses or email. Hashed account and Event references recognize real Events and returning accounts. A real Event needs 30 continuous minutes of running and two simultaneous live streams (Displays or Controllers). A necessary cookie stores language. Beta price requests separately store email, date, plan, language and country, without payment or confirmation email. Retention periods for pilot data and price requests must be published by the operator.

Legal bases

Providing accounts and requested Timer features is necessary to perform the service agreement (GDPR Article 6(1)(b)). Abuse prevention, security and fault diagnosis serve the operator's legitimate interests in operating a reliable service (Article 6(1)(f)), subject to your rights. Acceptance of this policy is an acknowledgement, not blanket consent to unrelated processing. There is no automated decision-making with legal or similarly significant effects.

Retention and deletion

• Accounts and active Events have no automatic inactivity expiry. They remain until deleted. Edit history keeps up to 50 undo and redo steps, with an approximate 2 MB limit per Event.
• Deleting an Event removes its live state and edit history. Its description enters Trash for up to 30 days. Cleanup runs at startup and every 6 hours; a limit of 500 trashed descriptions may remove older entries earlier. Restoration currently requires operator help.
• In Dashboard → Account → Delete account, confirm your password to remove the account, its sessions, active Events, their edit histories and its existing Trash. Their access links stop working. This action is permanent in live application storage.
• Sessions expire after 60 days. At most 20 sessions are kept per account. Expired sessions are ignored and removed on access, startup or subsequent session cleanup; physical disk cleanup can occur later than logical expiry.
• Reset links expire after 1 hour. At most 3 live reset hashes are retained when a new link is created. Expired hashes may remain in the account file until a later reset update or account deletion.
• Demos expire after 3 hours and are deleted at startup or the next 5-minute cleanup. Disconnected Display presence is forgotten after about 15 minutes when the presence list is refreshed. Rate-limit entries expire logically after their configured windows, normally 15 minutes or 1 hour; memory cleanup is opportunistic.
• Browser caches and local storage can retain previously received Timer snapshots and application files until cleared or replaced. Account deletion does not remotely erase copies on other devices.

Operational retention pending: the application does not set retention for hosting logs, mail-provider logs or backups. The operator must publish their actual retention periods and backup deletion process. Deleting live data does not itself erase infrastructure logs, backups or recipients' copies.

Recipients and location

This international copy is intended for EU hosting. The hosting provider, server location, any backup providers, and configured SMTP provider and processing locations have not yet been specified. These providers may process data on the operator's behalf. Their identities, contracts and any transfers outside the EEA, including the applicable safeguards, must be confirmed and published before launch. We do not claim that all processing is confined to the EU based on the application code alone.

Controller links grant control without signing in; Display links grant access to the current Display. Anyone with the relevant link can use it. Share links carefully. Changing a Controller link disables the previous Controller link. Disabling an account alone does not revoke delegated Event links.

Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability of your personal data and object to processing based on legitimate interests. You can change your optional name and delete your account in Dashboard. Contact the operator for other requests, including an export; there is no automatic account export feature. Requests should normally be answered within one month, with extensions where GDPR permits. You may complain to a competent data protection supervisory authority, including the authority where you live or work. See European Commission information on your rights.

If processing is separately based on consent, you may withdraw that consent without affecting earlier lawful processing. You do not have to create an account; without the required email and password, account features cannot be provided.