Privacy Policy

Pomlet is responsible for the data it processes to operate the website, accounts, subscriptions, security, support and product. For quizzes, classroom games, employee training, participant answers and organization content, the customer, host, school, employer or organization may also be responsible for deciding what data is collected and why. In those cases, Pomlet may act as a service provider or processor where applicable law recognizes that role. Its commitments as a processor are set out in the Terms of Service (section 8a).

Privacy questions and rights requests may be sent to support@pomlet.com.

Depending on how you use Pomlet, we may collect:

• account data: name, email address, password hash, email verification status, login method and plan;
• authentication and session data: session tokens, device identifiers, account identifiers, reset tokens and verification tokens;
• quiz content: titles, descriptions, questions, answers, explanations, settings, themes, folders, images and slide content;
• whiteboard content: names, backgrounds, sticky notes, text, shapes, connectors, drawings, positions, votes and snapshots needed for persistence and synchronization;
• collaboration and access data: whiteboard and session identifiers, owner, admin, editor or viewer roles, guest links, email invitations, presence and contributions;
• AI input data: prompts, instructions, source URLs and extracted document or PDF text submitted for AI quiz generation;
• AI output data: generated quiz titles, descriptions, questions, answers, explanations and image search keywords;
• organization data: organization name, roles, members, invitations, licence assignments and billing status;
• affiliate data: affiliate code and link, clicks and sign-up attribution, affiliate-account status and acceptance of program terms, country selected for Stripe Connect onboarding, currencies, amounts, statuses and timestamps in the commission and payout ledger, and the Stripe Connect account identifier and status;
• MCP data: authorized OAuth clients, client identifiers, granted permissions, authorized organization, connections, timestamps and action logs for Pomlet objects;
• player data: game PIN, nickname, answers, score, rank, streak, team, connection state and game progress;
• reports: session summaries, player names, question statistics, answer distributions and scores;
• billing data: customer identifiers, subscription identifiers, plan, licence count, payment status, invoice status and billing portal events from our payment provider;
• communications: emails, support requests, legal notices, feedback and related metadata;
• technical data: IP address, request metadata, browser/device information, timestamps, security logs, rate-limit records and error information.

Pomlet does not intentionally store full payment card numbers. Card details are handled by the payment provider. For AI PDF generation, the browser extracts text from the PDF. Pomlet intends to transmit and process extracted text, not to store the original PDF file as a server-side upload for that feature.

We use data to:

• provide, maintain, secure and improve Pomlet;
• create accounts, verify emails, authenticate users and prevent abuse;
• store, edit, organize, launch, share, embed and display sessions, quizzes and whiteboards;
• synchronize real-time collaboration, apply roles and access settings, store contributions and create related reports;
• operate live and self-paced sessions, teams and elimination modes, leaderboards, QR codes and reports;
• process AI quiz generation requests and return generated quiz drafts;
• manage organizations, members, roles, invitations and licences;
• process subscriptions, renewals, prorations, cancellations, invoices and billing support;
• operate the affiliate program, attribute sign-ups and subscriptions, calculate, validate and pay commissions, reconcile transactions and prevent fraud;
• send transactional emails, account notices, security messages, invitations and billing confirmations;
• monitor service health, enforce limits, detect fraud, prevent attacks and comply with law;
• respond to support, privacy, legal and abuse requests.

Where laws such as the GDPR, UK GDPR, Swiss FADP or similar rules apply, we rely on legal bases that may include contract performance, legitimate interests, consent, compliance with legal obligations and, where applicable, the instructions of a customer acting as controller.

Examples: account and subscription processing are generally needed to perform a contract; security logging and abuse prevention are based on legitimate interests and legal obligations; marketing or optional cookies, if introduced, would rely on consent where required.

If you use AI generation inside the Pomlet application, you instruct Pomlet to send relevant prompts, instructions, source material and extracted document text to OpenRouter, which routes the request to third-party model endpoints. Those providers process data under their own systems, policies and contractual terms.

Pomlet does not control the independent retention, abuse monitoring, security or policy decisions of AI providers. You are responsible for ensuring that you have the right to send the content to an AI provider and that the content is appropriate for AI processing. Do not submit trade secrets, confidential documents, personal data, student records, health data, financial data, regulated data or other sensitive information unless you are authorized and accept the third-party processing risk.

As of the date above, Pomlet configures OpenRouter calls to use only endpoints that declare Zero Data Retention (ZDR), so prompts and outputs are not retained after processing on those endpoints. Provider policies can change, and OpenRouter's ZDR documentation is available at OpenRouter's Zero Data Retention docs.

AI output is stored in Pomlet as quiz content until you delete it or your account is deleted. Source text used for AI generation is not intentionally stored as a separate source document after generation, but it may appear in generated questions, answers, explanations, logs, provider systems or support/security records.

AI providers used: as of the date above, OpenRouter forwards requests to OpenAI models hosted by Microsoft Azure and, as a fallback, to Google Gemini models, using only endpoints that declare Zero Data Retention.

Idea board: during a session, the question and the text of ideas submitted by participants follow the same route so that similar ideas can be grouped by theme. Participant nicknames are not sent.

Before an AI assistant is connected through MCP, Pomlet's authorization screen shows the email address of the signed-in account, the space concerned (your personal space and, where applicable, the organization), the permissions requested and the domain the connection returns to. When you connect an assistant to Pomlet, Pomlet processes OAuth client identifiers, permissions, connection tokens, the authorized organization and technical metadata needed for authentication and security. To perform a request, Pomlet receives tool arguments, such as a quiz identifier, question text, answers, a whiteboard change or a media URL. Pomlet does not automatically retrieve your entire conversation history. Conversation text is received only if the client includes it in the submitted arguments.

In return, the client and, where applicable, its provider receive results needed for the requested tool within the granted permissions: account context and capabilities, accessible content lists, questions and correct answers, explanations, whiteboard content, media metadata and links, Pomlet links, or PINs and participation links when a session is created. These results may appear in the conversation and be processed by the assistant's model. MCP tools do not provide access to individual participant reports; content you place in a quiz or whiteboard can nevertheless contain personal data.

The interactive panel displays selected data and authorized media inside the assistant. Answers entered in this preview are a local simulation, without saving participant responses or changing the quiz. Context about the selected content may be sent to the client to continue your request; quiz edits take place through the conversation or the full Pomlet editor. Loading a panel, media or a Pomlet link can also transmit an IP address and request metadata to our hosting infrastructure. Opening a link to the Pomlet application takes you to the site's interfaces and access controls.

MCP requests use your assistant's model: Pomlet does not send them to OpenRouter or deduct Pomlet AI-generation credits. The Zero Data Retention configuration described for AI generation inside Pomlet does not apply to conversations, tool results or other data retained by ChatGPT, Claude or another client. Their retention, model-improvement and deletion rules depend on their policy, your plan, your settings and, where applicable, your organization's contract.

Pomlet uses these exchanges to perform the requested action, enforce permissions and limits, retain your content and secure the service. Pomlet does not sell MCP tool data or use it for targeted advertising or to train its own models. Enabling the connector does not itself send your whole library to the assistant: content is returned by the tools called. Limit permissions and shared data to your needs; avoid including participant or other people's data without an appropriate legal basis and notice.

You can inspect and revoke connections at any time from the MCP window in your Pomlet account. Revocation blocks future access by that connection; it does not delete content already saved in Pomlet or conversations and copies held by the assistant provider. Deleting your Pomlet account revokes its connections and applies the deletion rules below. For copies already transmitted, also use the third-party service's deletion controls and procedures. Requests about Pomlet's processing can be sent to support@pomlet.com.

Support, product feedback and billing requests include your contact details, the account or contract concerned, your message and follow-up dates. Authorized staff process them with messaging and support providers to respond, track requests and retain evidence of handling. Transactional acknowledgements may retain attempt status and provider identifiers; provider acceptance alone does not establish receipt or reading. Declarations and records needed for disputes or legal obligations may be retained after account deletion for as long as required for that purpose. Avoid including unnecessary sensitive information in messages.

We may share data with:

• service providers that help us host, process, secure, email, bill, support or operate Pomlet;
• AI providers when you use AI generation features;
• payment providers for checkout, subscriptions, invoices, fraud prevention and billing support;
• image providers when you search or import public images, or when AI-generated cover keywords are used to find cover images;
• KLIPY when you search for GIFs: the search query, language and a pseudonymous customer identifier are sent to it; because the search is made directly from your browser, KLIPY also directly receives your IP address and technical request and browser metadata;
• organization admins and members according to their workspace role and access rights;
• participants and collaborators according to the session mode, whiteboard role and settings;
• anyone who can access an embed, public PIN, QR code, whiteboard guest link or shared page that you publish;
• law enforcement, regulators, courts, advisors or other parties where legally required or needed to protect rights, safety and security;
• successors in connection with a merger, acquisition, financing, reorganization or sale of assets.

Where data lives and who processes it. As of the date above, Pomlet runs on Cloudflare Workers. Core relational data (accounts, quizzes, reports, organizations, affiliate attribution and ledger records, and durable snapshots) is stored in Cloudflare D1; uploaded images and other media in Cloudflare R2; and active game and collaborative-whiteboard state in Cloudflare Durable Objects. Cloudflare may also process technical logs through Workers Observability and, when enabled, usage data through Cloudflare Web Analytics.

Depending on the features you use, Resend processes email delivery, Stripe processes payments, subscriptions and Stripe Connect payout accounts, Google processes Google sign-in, OpenRouter (and the model endpoints it routes to) processes AI-generation requests, Pixabay processes image searches and imports, and KLIPY processes GIF searches made directly from your browser. Card details are entered and processed by Stripe and are not stored by Pomlet. Affiliate bank details, identity documents and verification data are also processed by Stripe; Pomlet stores only the connected-account identifier and status. These providers may operate infrastructure in multiple countries, so Pomlet does not promise a single storage country unless separately agreed by contract. You may contact support@pomlet.com for the current provider list and available location information.

GIFs: when a quiz or whiteboard contains a KLIPY GIF, participants' devices load it directly from KLIPY's servers, which then receive their IP address and technical browser metadata.

Internal notifications: Pomlet receives internal notifications on Telegram. They show the first name (or, failing that, the email address) of new accounts, noting a sign-up with Google, and of buyers; for billing, the amount, number of licences, dates and payment status; otherwise pseudonymous technical identifiers (account, organization, payment, product feedback) and technical or security alerts.

Emails sent to an @pomlet.com address are routed by Cloudflare Email Routing to the Pomlet team's mailbox.

Main providers and countries

We keep data for as long as reasonably necessary for the purposes described in this Policy, including to provide the service, maintain accounts, comply with law, resolve disputes, enforce agreements, maintain security and keep business records.

• Account data is generally kept while the account exists.
• Sessions expire automatically according to their validity period; revoked sessions and revoked devices are purged no later than 30 days afterwards.
• Sessions, quizzes, whiteboards, images and organization content are kept until deleted by an authorized user or account deletion process.
• Session and whiteboard reports are kept until deleted by an authorized user or account deletion process.
• Billing records may be retained as needed for accounting, tax, fraud prevention and legal compliance.
• Affiliate attribution, account, commission, payout and audit data is kept for as long as needed to administer and reconcile the program, resolve disputes, prevent fraud and meet accounting, tax and legal duties. Where records must remain after account deletion, account identifiers may be dissociated from those records.
• Security logs in Pomlet's operational database and the technical webhook ledger are purged by daily cleanup after 30 days; rate-limit counters are removed when their window expires.
• MCP authorizations are kept until revocation, expiry or account deletion. Cached responses used to prevent duplicate actions expire after 24 hours; MCP action records expire after 90 days. They are removed by daily cleanup or account deletion. A revoked connection may therefore still appear in those records during their retention period.
• When an action has an uncertain outcome, a technical reservation without a copy of the request's content may remain until resolution or account deletion to prevent repeating the action. It contains technical references and a request fingerprint, not quiz or conversation text. Hashed revocation fingerprints and their date are retained without expiry, including after account deletion, so an old token or revoked authorization cannot become usable again. They contain no password, plaintext token or quiz content.
• These periods apply to MCP operational data stored by Pomlet. Infrastructure logs and copies held by the assistant provider follow their own retention settings and rules; the 24-hour and 90-day periods do not automatically apply to them.
• Product feedback sent from the app is kept while the account exists and deleted with it; a copy is also emailed to support.
• The log of actions taken by the Pomlet team on an account (for example granting complimentary Pro) is kept for security and as a record of those actions. It keeps the email address concerned after account deletion; no automatic retention period applies yet.
• An account with no sign-in for 24 months receives a notice by email. Without a sign-in within 30 days of that email, it is deleted with its personal data; content created in an organization stays with the organization. Signing in once is enough to keep the account. This does not apply to accounts with a subscription or complimentary Pro in progress, nor to the owner of an organization that has other members or a subscription.
• An account whose email address is never confirmed is deleted after 30 days, unless it is already linked to an organization, an invitation, a subscription or complimentary Pro.
• Uploads that are never saved are deleted after about 24 hours. Abandoned game state is removed no later than 48 hours; a removed image may remain for up to 72 hours when an active game still uses it and while the next daily cleanup is pending.

Pomlet and its providers may process data in countries other than where you live. Those countries may have different data protection laws. Where required, we use appropriate safeguards such as contractual commitments, transfer mechanisms or provider terms.

Using ChatGPT or Claude may transfer tool results to the United States, among other locations, according to OpenAI's and Anthropic's published information. Those providers describe reliance on adequacy decisions and standard contractual clauses for the relevant transfers. Cloudflare also describes international processing and reliance on the Swiss–U.S. Data Privacy Framework or contractual clauses depending on the transfer. This is not a promise of storage exclusively in Switzerland; other locations depend on the service and applicable settings.

Official information about processing, transfers and privacy controls: OpenAI, Anthropic, Cloudflare.

Depending on your location and role, you may have rights to access, correct, delete, restrict, object to or port personal data, withdraw consent and complain to a supervisory authority. You may also have rights to opt out of certain processing.

To exercise rights, contact support@pomlet.com. We may need to verify your identity and may direct player, student or employee requests to the relevant host, school, employer or organization where they control the data.

Pomlet is not intended for children to create accounts without appropriate authorization. Players can join games without accounts, but hosts should avoid collecting unnecessary personal information from minors. Schools, teachers and organizations are responsible for obtaining any required notices, consents, approvals or data processing terms before using Pomlet with children or students. Pomlet's own commitments for participant data are set out in section 8a of the Terms of Use.

We use reasonable technical and organizational measures designed to protect data. No internet service is completely secure. You are responsible for using strong passwords, limiting who receives game PINs and embeds, managing organization roles and avoiding unnecessary sensitive content.

Pomlet uses necessary cookies and browser storage to keep users signed in, remember player names, reconnect a guest to a whiteboard, maintain demo return paths and operate the service. A functional cookie also remembers attribution when a visitor opens a valid affiliate link. See the Cookie Policy for details.

We may update this Privacy Policy as the product, providers, laws or practices change. The updated date above shows when the page was last changed. Continued use of Pomlet after an update means the updated Policy applies.