Privacy Policy

Last updated 23 October 2026

This policy explains what AskOne stores, why, for how long, and what you can ask us to do about it. It is written to be checked: everything below describes what the software actually does.

Who is responsible

HURYN Sp. z o.o. is the controller for the data described here. We have not appointed a Data Protection Officer; we are not required to.

The people AskOne knows about

Administrators and moderators sign in and run rooms. Participants do not: they open a link on a phone, ask and vote, and never create an account. Hosts inside Zoom or Google Meet, and people using the AskOne plugin in ChatGPT, can also start a room without an AskOne account. We hold different things about each.

If you are a participant

We do not know who you are, and we have no way to find out. When you open a room that is accepting participation, your browser is given one cookie containing a random number. Nothing about you is written to our database at that moment. The first time you ask, vote, answer a survey or set a name, we store the SHA-256 hash of that number — never the number itself — as the only handle we have on you.

• That hash, so the same phone is the same participant when you reload: it is what makes your question yours and stops one person voting twice.
• A display name, only if you type one. Leave it empty and you stay a guest.
• The questions you ask, stored exactly as you typed them, and which questions you upvoted.
• The survey answer you pick, if the host runs a survey — one answer per survey, held against the same hash so the room counts each phone once and can show you what you chose.
• When you first joined a room and when you were last seen in it, which is how the host’s screen shows how many people are in the room now.

We do not store your email address, any name beyond the display name you choose, your IP address, or any identifier from your device. The hash cannot be reversed, so it connects you to no person and to nothing you do outside AskOne — not for us, and not for anyone who obtained a copy of our database.

It is, though, the same hash in every room you act in from that browser: one cookie covers every room you open on AskOne directly. That is deliberate — it is what lets a ban reach every room owned by the workspace that issued it, instead of being shrugged off by opening the next room. It also means the rooms you have acted in can be linked to one another by anyone reading the database directly — though a room you only read leaves no record of you at all. Clear the cookie and you are a new participant in every room you open that way; the meeting-app cookie described below is a separate identity, and clearing one does not touch the other.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in running a question queue that works — one vote per person, one survey answer per phone, questions that stay attached to whoever asked them, and moderation that can be enforced. This is the minimum that makes the feature possible.

If the room uses AI moderation, we send the question text together with the room’s name and description to OpenRouter, which passes it toTypeSafe for classification. We send no participant identifier, cookie or IP address with it. A question using a word on our short list of offensive words the AI is known to miss is sent nowhere and waits for a moderator instead. A person running the room can review and reverse a rejection.

If you choose a display name, we first compare it with a short list of offensive words our AI check is known to miss; a match is refused and sent nowhere. Otherwise we send that name by itself to OpenRouter and TypeSafe before it can appear. This check runs in every room, whatever question moderation the administrator selected. We send no room name, description, participant identifier, cookie or IP address with the name. A confident finding that a name is offensive or insulting removes your existing display names in that workspace and prevents naming there for 24 hours; a list match, an uncertain result or a provider failure only refuses that attempt.

If you are an administrator or a moderator

Your account — email address, name, password or social login, and your organization memberships — is held by Clerk, our authentication provider. Our own database stores only your Clerk user or organization identifier, so that rooms can belong to somebody; when you connect an AI assistant to AskOne by signing in, the API usage log described under Analytics records the same identifiers. We read your name and email from Clerk when a page needs to show them; we never copy them into our database.

When an administrator or a moderator bans a participant, we record who did it, as their Clerk identifier, together with the ban.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — you asked us to run rooms for you.

If you start a room inside Zoom without an account

Zoom supplies an authenticated, encrypted app context. We use its user identifier to compute a keyed hash, so you can return to your rooms from a later meeting. We store that hash as the owner of an anonymous workspace, not the Zoom identifier itself. We request no email address, profile or meeting content, store no meeting identifier, and receive no Zoom access token.

To limit automated room creation, we also store daily keyed hashes of the start request’s IP address and host hash, with the date and a random request identifier. We never store the raw address in this ledger. These hashes change each UTC day; previous-day rows are removed by the next cleanup or room start. They are not attached to participant questions or votes.

These rooms always use AI moderation, with the same question and display-name screening described above. If classification cannot run, questions wait for the host to approve or hide them. Keeping rooms requires an AskOne account and your confirmation; we do not connect an anonymous Zoom workspace to your account just because you sign in.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for running the rooms you request, and our legitimate interest (Art. 6(1)(f) GDPR) in preventing abusive room creation for the daily counters. The Start screen links these terms and this policy before you create a room.

If you start a room from ChatGPT without an account

When you use the AskOne plugin, ChatGPT sends us an anonymized user identifier that OpenAI creates for AskOne; it is not your name, email address or OpenAI account. We use it to compute a keyed hash, so you can return to your rooms in a later conversation, and store that hash as the owner of an anonymous workspace, not the identifier itself. We do not receive your conversation. What the plugin needs from you is a room name, or a poll’s question and choices, when you ask for one. Each request also carries technical metadata from ChatGPT, such as request and session identifiers and your approximate location (your country, and sometimes your time zone). We keep none of it; the only use is that, when a time zone is sent, a room you do not name is named after its local start time.

We check that every request that uses the plugin (creating a room or a poll, reading results, closing a room or getting a host link) comes from OpenAI’s published server addresses. Only connecting to the plugin and reading its name, its instructions to ChatGPT and its list of tools, which hold nobody’s data, work from anywhere. Those are OpenAI’s servers, not your device, and we do not store them. The daily counters that limit automated room creation use daily keyed hashes of your ChatGPT identifier, not an IP address, and are removed as described above for Zoom.

What reaches OpenAI. The plugin returns to ChatGPT only what answers your request. Creating a room or a poll returns the room’s name and join code, a link to the room, a link to its projector and a one-time link to your host controls, and a poll’s question. If you already have an open room, it returns that room’s name, join code and number of questions, and how many new rooms you can still start today. Closing a room returns its name and join code. When you ask for results, it returns your latest room’s name, join code and whether it is open; each survey’s question, type, status and number of respondents, with each choice and how many picked it, a rating’s average and how many gave each score, and up to 30 of a word cloud’s words with how many gave each; and up to 40 of its answered and approved questions, with their text, vote counts, whether each is answered and any comment the host wrote on it. A refusal returns only its reason and, when you have to wait, for how long. Once returned, that content is handled by OpenAI under its own terms and privacy policy, as part of the conversation you are having with it. Nothing else is returned: not your ChatGPT identifier, not participants’ display names, hashes or identifiers, not waiting or hidden questions, and no internal IDs or timestamps.

These rooms work like rooms started in Zoom: always AI moderation, the same screening, the same lifetime and deletion, and the same choice to keep them in an account, which you make from the host controls. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for running the rooms you request, and our legitimate interest (Art. 6(1)(f) GDPR) in preventing abusive room creation for the daily counters.

If you use AskOne in Google Meet

The AskOne add-on for Google Meet runs in the meeting’s side panel and main stage. People who ask and vote there are participants as described above, recognised by the meeting-app cookie below, and never sign in.

Hosts who start a Q&A in Meet sign in with Google, because Meet does not tell an add-on who is using it. Until you have signed in, the add-on loads Google’s sign-in script and Sign in with Google button from Google, and Google may offer to sign you in with an account already signed in to your browser (Google’s One Tap prompt). The prompt and the button are Google’s own content, served by Google under Google’s Privacy Policy, and may use Google’s own cookies; we do not see what happens inside them.

When you sign in, Google gives the add-on a token signed by Google that contains your account’s identifier and, as every Google sign-in does, your email address and basic profile (name and picture). We use only the identifier: we check Google’s signature on the token, compute a keyed hash of the identifier and store that as the owner of an anonymous workspace, so you find your rooms in a later meeting. We discard your email address, name and picture as soon as the token is checked and never store them. Google gives us no access or refresh token, we call no Google API on your behalf, and we do not read your meetings, calendar or contacts. So that each sign-in works only once, we keep a hash of its one-time random code, which says nothing about you, until the sign-in could no longer be used anyway: at most 60 minutes, plus our 15-minute cleanup.

These rooms work like rooms started in Zoom: always AI moderation, the same screening, the same daily limits, the same lifetime and deletion, and the same choice to keep them in an account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for signing you in and running the rooms you request.

AskOne’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

AskOne uses essential cookies only. There is no cookie banner because there is nothing to consent to: we set no advertising, profiling or cross-site tracking cookies at all.

• askone_visitor — the participant cookie described above. It holds a signed random value and nothing else. HttpOnly, SameSite=Lax, 30 days. Strictly necessary: without it an open room cannot tell participants apart, so it cannot count a vote once or enforce a ban. This is why an open room asks you to turn cookies on.
• askone_embed_visitor serves the same purpose inside a meeting app. It is HttpOnly, Secure, SameSite=None and Partitioned, lasts 30 days, and is restricted to our embedded pages. Its storage is separate for each top-level site: joining on your phone and inside a meeting makes you two participants. It is not a cross-site tracking identifier.
• askone_zoom_host lets the Zoom panel recognise the host of an anonymous workspace. It contains a signed keyed hash, lasts 6 hours, and is HttpOnly, Secure, SameSite=None and Partitioned, restricted to /embed/zoom. It grants no access to member pages and is separate from the participant cookie.
• askone_zoom_keep temporarily carries a one-use keep ticket while you sign in and confirm a move. It lasts 1 hour, is HttpOnly and SameSite=Lax, and is restricted to /keep; it is Secure on HTTPS. Only the ticket’s hash is stored in the database. A replacement ticket invalidates the previous one, and a successful move consumes it.
• askone_zoom_handoff briefly carries the one-use code from a host-controls link from Zoom, Google Meet or ChatGPT, until you select Open host controls. It lasts 10 minutes, is HttpOnly and SameSite=Lax, and is restricted to /h; it is Secure on HTTPS. Only the code’s hash is stored in the database, and using it, replacing it or the 10 minutes running out deletes it. Using it sets the Zoom host cookie above in that browser.
• askone_meet_host lets the Google Meet add-on recognise the host who signed in with Google. It holds only the keyed hash described above, signed, lasts 30 days and is renewed for another 30 days whenever you open the add-on. It is HttpOnly, Secure, SameSite=None and Partitioned, restricted to /embed/meet, and grants no access to member accounts.
• askone_meet_nonce ties a Google sign-in in the Meet add-on to the browser that started it: it holds a signed one-time random code, which Google also puts into the sign-in token. It lasts 60 minutes, is HttpOnly, Secure, SameSite=None and Partitioned, is restricted to /embed/meet/sign-in, and is cleared when a sign-in is checked.
• askone-theme remembers Light or Dark for up to one year when you choose a theme different from your device’s current setting. Choosing the matching theme removes the cookie and follows your device again. It holds no identifier and is a first-party functional preference cookie. It needs no consent banner. Inside a meeting, askone-embed-theme stores the same choice with Secure, SameSite=None and Partitioned attributes, restricted to embedded pages.
• Clerk session cookies — set only while you are signed in, to keep you signed in. Strictly necessary.

Analytics

We use Microsoft Clarity to see how the screens are used — where people hesitate, what they never find. It is configured to run without cookies: the Clarity project has cookie storage switched off and the page tells Clarity that both analytics and advertising storage are denied before it collects anything. In that mode Clarity assigns an identifier per page view and cannot follow you between visits or across sites.

Clarity records how pages are used, not what you typed: text you enter is masked before it leaves your browser. If Clarity is not configured on the deployment you are using, no analytics script loads at all. Clarity does not load inside our embedded meeting pages.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the product, weighed against a cookieless configuration that does not track individuals.

API and MCP usage log. When an AI assistant, a script or the AskOne plugin in ChatGPT calls our API or MCP server, we record one line per request, so we can see which tools are used and how often: the time, the endpoint and the method or tool called, whether it succeeded or why it was refused, how long it took, which software called (the client ID it signed in with, which is often a web address, or else the name and version it reports, or else its user-agent string, up to 200 characters), and the workspace it concerned. To tell callers apart we record an API token’s internal ID and its organization’s Clerk ID; for a signed-in call, your Clerk user and organization IDs (the identifiers our database already holds for members, never your email or name) and a keyed hash of the user ID; and for ChatGPT, a keyed hash of ChatGPT’s anonymized identifier, separate from the one that owns your rooms. We record no tool arguments, room content, questions, IP addresses or tokens. A line is deleted once it is 13 months old, by the cleanup that runs every 15 minutes. The identifiers in it are the same each time you call, so your calls can be counted together over that period. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding how the API and its integrations are used and keeping them working.

Who else processes it

• Clerk — accounts, organizations, sign-in, and subscription billing.
• Supabase — the database holding rooms, questions, votes, survey answers, participant hashes and the API usage log.
• Our hosting provider — serves the application.
• Microsoft Clarity — cookieless product analytics, as described above.
• OpenRouter and TypeSafe — classify question text in rooms whose administrator selected AI moderation and in anonymous Zoom, Google Meet and ChatGPT rooms, and screen display names in every room, as described above.
• Stripe, through Clerk, if you buy a paid plan. We never see or store your card details.

Each is a processor acting on our instructions under a data processing agreement. Where any of them processes data outside the European Economic Area, that transfer relies on the European Commission’s Standard Contractual Clauses.

How long we keep it

• Organization room data, including rooms kept from Zoom, Google Meet or ChatGPT — questions, votes, survey answers, participant hashes and display names — is kept while the room is open and for 30 days after it is closed.
• Administrator and moderator accounts are kept until you delete the account with Clerk.
• Ban and display-name block records are kept for as long as the workspace exists. Each stops applying after 24 hours; retained expired rows are ignored.
• API and MCP usage log lines are kept for 13 months, whether or not the workspace they name still exists.

A room started without an AskOne account, in Zoom, Google Meet or ChatGPT, closes automatically 48 hours after it opens, unless you close it sooner. Its questions, votes, participant hashes and display names are deleted 7 days after it closes. Cleanup runs every 15 minutes; when no rooms remain, the anonymous workspace and its keyed user hash are deleted too. Before deletion, Sign up to keep your rooms lets you move all your remaining rooms into an organization after creating an account or signing in, and confirming. Their join codes stay the same, the anonymous workspace and its user hash are removed, and the rooms follow the organization retention policy.

Your rights

Under the GDPR you may ask us to:

• tell you what we hold about you, and give you a copy (Art. 15);
• correct anything inaccurate (Art. 16);
• delete it (Art. 17);
• restrict what we do with it (Art. 18);
• hand it over in a portable form (Art. 20);
• object to processing based on legitimate interest, including the analytics above (Art. 21).

There is no charge, and we answer within one month. Write to us at the address above or at contact@askone.org.

You also have the right to complain to a supervisory authority. Ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland — https://uodo.gov.pl.

Security

Only our server talks to the database; no key that could read it is ever sent to a browser. Row-level security is switched on for every table with no policies at all, so a leaked public key reads nothing. Participant cookies are signed, and only their hashes are stored. Every change to a room is checked against the workspace that owns it, on the server, on every request.

Children

AskOne is not directed at children under 16. Participants are never asked for personal details, so a child joining a room shares no more than an adult does: a question, a vote, a survey answer, and a name only if they type one.

Changes

If this policy changes we update the date at the top. Material changes affecting administrators and moderators are notified by email through Clerk.