Privacy policy

1. Who is responsible

The data controller is Blue Pineapple Ocean Corp, a company incorporated in the British Virgin Islands, with its registered office at Casablanca House, Luck Hill, Road Town, Tortola, British Virgin Islands. For any privacy question write to help@psst.team.

2. What we collect

• From your Google account, when you sign in (openid, email and profile scopes): email, whether it is verified, name, photo, language and your Google Workspace domain if your account has one.
• Workspace membership: which workspaces you belong to, your role and status, the invitations you send or receive (with the invited email), and the quick messages and mutes you configure.
• Devices: a random identifier and the public encryption key of each browser where you use the extension, and when it was last used.
• Meetings: while you are in a meeting, the server uses a hash (HMAC) of the meeting code to bring the members of your workspace into the same room. We do not keep which meetings you attended beyond 24 hours, and only as a hash.
• Aggregated metrics per workspace: daily number of meetings with at least two members and of messages sent. Never their content.
• Daily activity counters per person: how many pssts you sent and received each day and in how many meetings with your team you had (psst)Psst on. No content, nothing about to whom or from whom, no meeting code. We keep them for your own activity mosaic, which only you see; your team only ever sees the team's total per day, never anyone else's detail.
• For the getting-started emails: the date of your first (psst)Psst (never its content), which of those emails we already sent you and whether you unsubscribed.
• Usage metrics of the extension, which you can turn off in its options (“Send usage metrics”): events such as “(psst)Psst sent” (to how many teammates and whether it is a reply, never the text), “(psst)Psst received” with its delay, 👍 / 👎, “safe mode on”, “a teammate started presenting” or a technical error with personal data already scrubbed. They are tied to your internal (psst)Psst identifier (before you sign in, to a random identifier of the installation), never to your email or name, and they go through our server: PostHog never receives your IP address.
• On the website and the web panel: pages visited (without the parameters of the address), clicks on “Add to Chrome”, panel actions (team created, invitation sent or accepted, role changed, leaving the team), technical errors and session recordings with every field masked (on the panel, every text as well: your team's names and emails are never recorded). If your browser asks for “Do Not Track”, none of this is loaded.
• Billing (paid plans): Stripe processes payments; we keep the customer and subscription identifiers and their status. We never see or store your card details.
• Audit log: administrative actions (creating a workspace, inviting, removing someone) with internal identifiers, never emails or names.

3. What we do not collect

• The content of your messages. It is end-to-end encrypted in your browser; the server only relays it in memory and never stores it, not even encrypted.
• Meet video, audio, your screen, chat or transcripts.
• The list of meeting participants who do not use (psst)Psst. The extension reads the Meet page only as much as needed to locate video tiles (visible names and position) and to detect whether you are presenting; that information never leaves your browser.
• Your browsing history: the extension only runs on meet.google.com.

4. How we use the data

We do not sell personal data or use it for advertising.

• To provide the service: sign-in, workspace management, showing which teammates are in the same meeting and delivering messages.
• To show the panel's activity mosaic: each person their own counters; the team only the team's total per day.
• Security and abuse prevention: send limits, revoking sessions and devices, enforcing the acceptable use policy.
• Billing for paid plans.
• Support and stability improvements, using aggregated telemetry.
• Sending you a few getting-started emails, from hey@psst.team and in your language: a welcome when you first sign in, a reminder after 2 days if there is still nobody else on your team or you have not sent your first (psst)Psst, and after 2 weeks a single question about what you would change. Each one goes out only once. Every one has a one-click unsubscribe link at the bottom (or write to help@psst.team); unsubscribing does not stop your team's invitations.

5. Legal basis

We process your data to perform the contract you accept with the terms of service, for our legitimate interest in the security of the service and in measuring how it is used to improve it (metrics you can turn off), and to meet legal billing obligations. This covers the GDPR, Brazil's LGPD and Argentina's Law 25,326.

6. Google user data

(psst)Psst's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your email, name, photo and domain only to identify you within (psst)Psst and do not transfer them to third parties other than the providers listed below, to run the service.

7. Providers

These providers process data in the United States and the European Union. For those transfers we rely on each provider's safeguards: EU standard contractual clauses or their participation in the EU-U.S. Data Privacy Framework, as applicable.

• Cloudflare: hosting of the API, database, real-time message relay and web panel.
• Google: sign-in with OAuth.
• Stripe: payments and taxes for paid plans.
• Transactional email provider (currently Resend): sending invitations and the getting-started emails.
• PostHog (PostHog Inc., United States): product analytics, masked session recordings and error reports, with personal data scrubbed.

8. How long we keep data

• Messages: not stored. They live in memory until delivered or until they expire after 10 seconds.
• Meeting code hash: up to 24 hours.
• Account, workspaces and settings: while you have an account.
• Daily activity counters: while you are in the team. They are deleted the moment you leave the team (or are removed) or delete your account, and with the team if it is deleted.
• Invitations: up to 30 days after they expire, are accepted or are revoked.
• Sessions: expire after 60 days without use.
• Database backups: 30 days.
• Usage events in PostHog: up to 12 months. Session recordings in PostHog: 30 days.
• Billing records: as required by law.

9. Deletion and your rights

You can delete your account from the panel (Account → Delete my account). Access stops immediately and the data is physically deleted within 30 days; the audit log is anonymized. If you own a workspace that has other members, you must delete that workspace first, from its settings.

To exercise your rights of access, rectification, portability or objection, write to help@psst.team. A data processing agreement (DPA) is available for customers on paid plans.

10. Security and the limits of encryption

Messages are end-to-end encrypted with a per-device key (X25519, with libsodium) and travel over TLS. The server cannot read them and does not store them.

An honest limit: the server distributes the devices' public keys. A compromised server could substitute them and read future messages (a man-in-the-middle attack). We do not yet offer out-of-band key fingerprint verification.

(psst)Psst hides itself when you present from Meet, but it cannot detect screen sharing from another application (Zoom, OBS, the system recorder). In that case use the Alt+Shift+P shortcut.

11. Children

(psst)Psst is a work tool and is not directed at people under 16.

12. Changes

If we change this policy in a material way, we will tell you by email or in the panel before the change takes effect.