Privacy Policy

One account signs you in to every app. It lives at liveworkspace.app, and you only need one if you want to: every app works without signing in.

• What it holds. Your email address and your first and last name. You confirm the address with a 6-digit code we email you, or by continuing with Google, in which case we take your name and email from Google and leave your Google picture behind. We never ask for a password.
• Signing in to an app. When an app sends you to liveworkspace.app to sign in, we give that app a short-lived token naming your account, your email and your name, and keep a record of which apps you have signed in to, and when you first did, so you aren’t asked again.
• Your teams. Each team’s name, and for each member their account, email address and role. If you invite someone, we store the address you typed and email them the invitation, with up to three reminders while nobody has answered it, each with a link to decline it; it waits on liveworkspace.app until they accept or decline it. The token an app gets when you sign in also lists the teams you are in, which is how we decide who may open a team’s work. The apps keep no copy of your teams.
• API tokens, if you create them. We store a one-way hash of each token (never the token itself), its name, whether it is read-only, and when it was last used. A token works in every app, expires after six months and is deleted with your account. An app that a token is used with keeps a note of that token (never the secret) and of anything paired through it, such as a workbench.
• Your onboarding emails. Which of the onboarding emails we have sent you, which milestone emails each app has sent you, and when you last saved something in any app, which is how we know whether to nudge you.
• Keeping abuse out. The sign-in pages use Cloudflare Turnstile to check you are a person, and we count code requests per network address and per email address for a minute at a time, so nobody can flood an inbox. Codes expire after 10 minutes and are stored only as a hash.

• Your documents. What you make is saved so it is there when you come back, and so the people you share it with can see it. Each document is stored on its own on Cloudflare, with its comments beside what they are about. While people work on one together, each comment, answer, idea and vote that passes through the live session is also noted in that document’s own storage, so none is lost or counted twice, and is removed with it. A document you make in Offline Mode (This Browser), which every app has, stays in your browser and never reaches our servers, unless you use an AI feature on it or add a web link to it (our server fetches the link’s preview). A guest’s new documents start in This Browser; someone signed in starts on our servers. Either can move a document between the two.
• Your Explorer. liveworkspace.app keeps one list of what you make in every app, so the Explorer in each app can show all of it: each document’s title, app, owner, team, folder, favourite and Trash state, its share links, when you last opened it, and a small summary for its card (such as how many elements it has). For the Timeline it keeps what happened to each document (created, renamed, shared, commented on) and who did it, and for the Inbox it keeps, for each comment thread and action, who is in it, whether it is resolved or done, and the start of the latest comment (up to 500 characters).
• Images you upload are kept in Cloudflare object storage. Before a JPEG is stored, identifying metadata such as GPS location and camera details is stripped from it. An uploaded image that no document uses is removed once it is more than 30 days old.
• A guest id. If you use an app without an account, liveworkspace.app gives your browser a random guest id, the same in every app, to link your documents to your browser. It is not tied to your name or email. We note the day it was last handed to an app. If you later sign in or create an account, what you made as a guest becomes your account’s.
• Your display name and colour, the ones collaborators see, against your guest id or account. liveworkspace.app keeps them, so they are the same in every app; an account shows its own name until you choose a display name.
• Connected AI tools, if you connect one. If you connect a tool through an app’s MCP server, we store the tool’s registration (its name and redirect address, for 30 days), short-lived authorisation codes that expire within minutes, and for an hour a count of registrations from your network address, to stop abuse.
• Form responses. Each response to a form you publish is stored in your document, holding only what the person typed. People filling in a form need no account, and we store no name, account or browser id for them. A report about a form stores its reason, an optional note, a random key kept in the reporter’s browser and a one-way hash of their network.
• Votes from guests. To stop one person voting many times, a guest’s vote stores a one-way hash of their network address combined with the document’s id. It is deleted with the document.
• Operational logs. Our host, Cloudflare, keeps standard request logs that help us run the service securely.

Each app’s Community is a public gallery of documents people choose to share. Its posts, likes, copies and reports are kept by liveworkspace, in one database for every app’s Community; the documents themselves stay in each app.

• A post holds the title, description, category and tags you write, which document it shows, when you shared it, and its like and copy counts. Your account is stored with it so you can manage it, but never shown: the post appears as Anonymous, or, if you turn that off, with your display name and picture. Removing the post, or deleting the document or your account, deletes it.
• Likes, copies and reports are stored against a random key your browser keeps for the Community, not against you, with a one-way hash of your network combined with the post’s id, so one network can add only a few. A report stores its reason and an optional note too. Reports are counted automatically; nobody reads them by hand.
• Posts are public. Anyone can find, view and copy a shared document, and it shows the document’s latest version, including its document and tab names, until you remove it. Comments are never shown with it. Copies people made before you removed it remain theirs.

The AI features run only when you use them, and only where an AI provider is set up.

• Connected AI tools, such as Claude, read and change your documents through our API with the token you approved. What the tool does with what it reads is governed by its own terms and privacy policy.

We do not use your documents to train AI models.

In livediagram, livedocuments and livedesign, the image picker’s Search tab sends your search words from your browser to Openverse, run by the WordPress Foundation, which sees them and your IP address under its own privacy policy; our servers never see the search. A picture you pick is downloaded from its original host and stored like any image you upload.

To learn which features actually help, the apps and the Explorer on liveworkspace.app record anonymous, first-party product events, such as “a document was created”. Each event is a few fixed labels (a category, an action and an optional type) and the app it came from (the Explorer’s count for the app it shows, or for liveworkspace.app). Events never include anything that identifies you or your work: no names, no content, no account id, no IP address. Page views are counted the same way, with ids and anything after a ? or # removed in your browser first, as are errors (only a generic kind) and timings (only the range they fell in).

Your browser sends them straight to liveworkspace’s telemetry service at liveworkspace.app, without cookies, which keeps them in its own database, apart from your documents and account, for 60 days. To count sign-ups and sign-ins once each, an app’s server also remembers which sessions it has already counted, for 90 days, and that an account has been seen before (deleted with the account). Only the totals are published. The data is never sold or shared: the only place it goes beyond our own use is the public telemetry dashboard, which shows exactly the totals we see. You can turn off the events your browser sends: signed in, one setting turns them off in every app and on liveworkspace.app; as a guest, in each app’s Settings, and on liveworkspace.app your browser’s Global Privacy Control or Do Not Track does. A few totals are counted by our servers and can’t be turned off: sign-ups and sign-ins, first visits to a share link, multiplayer sessions, emails sent and server errors.

We do not use tracking pixels, advertising, or third-party analytics. We do not sell your data, and we do not build advertising profiles.

If you sign in, liveworkspace.app sets a cookie to keep you signed in, and each app you use sets its own to remember that you are. If you use an app without an account, liveworkspace.app sets a cookie holding your guest id. The apps keep your guest id, your preferences (also saved to our database so they follow you) and your Community key in local storage, and liveworkspace.app keeps your light or dark choice there. We do not use advertising or tracking cookies.

• Sign-in codes, from liveworkspace.app, when you ask for one.
• Account and service emails: team invitations from liveworkspace.app (with up to three reminders while unanswered), a confirmation when you delete your account, a one-time reminder a week before an API token expires, and a note if one of your forms is suspended after reports.
• Notifications about your work: when someone first opens a document you shared, comments on one you own, fills in one of your forms, answers a team invitation you sent, assigns you an action or mentions you. A mention quotes the comment (up to about 280 characters); an assigned action includes its name and the start of its description.
• A short onboarding series: a welcome, a few tips in your first two weeks, a nudge if you haven’t made anything or have been away a while, and the occasional milestone.

You can turn off every notification, tip and milestone email in each app’s Settings, or from the link at the bottom of each one. We send no advertising, and share your address only with our email providers, to deliver these. People who use an app without an account are never emailed, apart from team invitations and what follows from them.

• Cloudflare: hosting, databases, image storage, Turnstile on the sign-in pages, and delivering every email we send, sign-in codes included.
• Google: sign-in with Google, if you choose it.

The editors load fonts from Google Fonts, and an embedded video, link card or website loads from its provider, which sees the viewer’s IP address. Link previews are fetched by our server. An app that uses anyone else says so in its section below.

Anything in a document you share is visible to people with the link. You can protect a link with a password or an expiry, and revoking a link stops further access through it.

You can delete any document you own at any time. It waits in the Trash for 30 days so you can restore it, and is then removed for good. A document left empty and untouched for 30 days moves to the Trash on its own.

You can delete your account yourself from Settings, then Account, then Delete Account, in any app. Your liveworkspace account closes, for every app at once: the documents you own in every app (the Trash included), your folders, favourites, images and preferences, your account details, sessions, API tokens and sign-in records are deleted straight away, and you leave every team (a team you ran alone goes; one you were the only admin of passes to its longest-standing member). Documents that belong to a team stay with the team.

Other things are kept only as long as they are useful: anonymous product events for 60 days, and changes made by connected AI tools for 30 days, so they can be undone. A guest’s documents have no account to delete: remove them in the Explorer, or ask us. A guest id that no app has been handed for 400 days can’t be used again, so its preferences, display name and colour are then deleted; its documents stay.

Every request is checked for authentication and access. If you find a security vulnerability, please report it to us privately through the contact form below.

If you connect Google Drive in Cloud Sync, liveworkspace asks Google for access to only the files it creates, or that you open with it (the drive.file scope), and to appear in Drive’s Open with menu (drive.install). It cannot see any other file in your Drive.

• Our Drive service keeps a copy of your own work, from every app, in those files, and brings renames, moves and deletions you make in Drive back to your work. It runs on our servers, so it keeps up whether or not you have a tab open.
• We store an encrypted refresh token, the id of the Google account you connected, the ids of the files and folders liveworkspace created, and the state it last wrote to them.
• We use Google user data only to provide the sync you asked for. We do not use it for advertising, sell it or use it to train AI models, and nobody reads it unless you ask us to for support, it is needed for security, or the law requires it.
• Disconnecting, or deleting your account, revokes access at Google and deletes what we stored. Your files stay in your Drive.

liveworkspace’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The apps are not directed at children, and we do not knowingly collect data from them.

We may update this policy from time to time. The date at the top shows the latest version.

For privacy questions or requests, reach us through our contact form.