What we know about you, and why.

Our servers keep ordinary technical logs, which include your IP address, in order to serve pages and to notice attacks. We also count page views using Vercel Web Analytics, which is a deliberately limited tool: it writes nothing to your browser and keeps no identifier for you, so it can report that a page was visited and roughly from where, but it cannot follow you between visits or across sites.

This is why there is no consent banner. The rule that produces those banners is about storing or reading things on your device, and we do not do that for counting visits.

To be in a room with other people, you share your display name and your live audio and video with the others in that room. Your live camera and microphone are not recorded or stored unless the meeting is a recorded one — see below.

We do store:

• Your display name for that meeting. You choose it, it is specific to that meeting, and you can change it while you are there.
• Chat messages you send. These are kept with the meeting so people can read back. They cannot be edited or unsent.
• When you joined and left, along with the kind of device, operating system and browser you used — so we know whether the rooms work on real machines.
• Connection measurements every thirty seconds: how good the connection was, delay, resolution, lost packets, whether your video stuttered. This is how we tell whether the service is actually any good rather than guessing. It describes your connection, never what was said. Kept for thirty days, then deleted automatically.

Recording is off unless it is deliberately enabled for a meeting. When it is on, you are told before you settle into the room and you have to agree; declining offers you a way out rather than quietly starting the camera. People who arrive late get the same notice, and recording stays visibly indicated while it runs.

Recordings are encrypted before they are stored, and can only be played back by an administrator through a link that expires after two hours. If the purpose changes later — deciding to publish something that was recorded as a private archive — that needs a fresh decision and a fresh agreement, not the original one.

Hosting requires an account, so we hold your email address and a password managed by our authentication provider. Administrators can see the email addresses of hosts in the usage figures, because knowing who is running meetings is part of running the service.

Only things the site cannot work without, which is why none of them ask permission:

• A sign-in session, so you are not asked to log in on every page.
• The last room you joined, so you can get back to it easily.
• Your camera, microphone and speaker choices, so a meeting does not start by sending your voice to the wrong device.
• One cookie, __vdpl, set only while you are in a room. It keeps a long meeting on a single version of the software so that releasing an update does not interrupt you. It is removed when you leave.

Your data is stored on servers in Europe:

• Vercel — the website itself and the visit counting, served from Dublin.
• Supabase — accounts, meetings, chat and the measurements above, hosted in Ireland.
• Hetzner — the servers that carry live audio and video, and the encrypted recording storage, in Germany.
• Zoom or LiveKit Cloud — only if a particular meeting is placed on one of them instead of our own servers, which the host can see.

Two of those are companies headquartered outside Europe even though the servers holding your data are inside it. We mention the distinction because it is a real one and because privacy notices that say “everything is in Europe” often quietly mean only the first half.

• Connection measurements: thirty days, deleted automatically.
• Everything else — meetings, chat, attendance, recordings — is kept until it is deleted on request. We have not yet set fixed maximum periods for these, and we are setting them before the service opens publicly. Until then, asking is the way to have something removed, and we would rather say that plainly than publish a period we are not keeping to.

If you are in the EU or UK you have the right to see what we hold about you, correct it, have it deleted, take a copy elsewhere, and object to how it is used. You do not need an account to ask — write to us and describe the meeting.

We ask people for a display name rather than a real name, and we do not require an account to attend a meeting, so in many cases the least we know about you is the most we ever knew.

So Many Rooms is operated by Light Connections SAS, a company registered in France (SIREN 810 972 109), which is the data controller for everything described here.

For anything on this page — a copy of your data, a correction, a deletion, or just a question — write to contact@somanyrooms.com.

Because we are established in France, our lead supervisory authority is the CNIL. You are equally entitled to complain to the data protection authority of the country you live in.