Last updated: October 2026
Workshopy is a platform for running live, instructor-led workshops. This policy explains what data we collect, why we collect it, who can see it, and the choices you have. The short version: we collect the minimum needed to run your workshops, we never sell personal data, participants can join without giving us any contact details, and your content is always yours to export.
If you host workshops (teacher account): your email address and display name; if you sign in with Google, the basic profile Google shares (email, name, avatar); the content you create — workshop templates, uploaded images, and session configuration; records of the sessions you run; the days you open your workspace or use its AI — the date only, never which pages you saw or what you clicked, kept for 13 months — so we can tell whether teachers come back to Workshopy; and, if you connect an AI app, which app and when (section 6).
If you publish to the public lesson library: the lessons you publish and the public name, page address, short bio, link and picture you choose are public — anyone can see them, and search engines may list them. Your picture is the photo of the Google account you sign in with (if it has one), unless you choose your initials or upload a photo instead (we redraw it and remove its location data). Nothing else from your account is shown — never your email. Taking a lesson out of the library removes it; deleting your account removes all of them.
If you join a workshop (participant): only the display name you type when joining — no email address and no account are required. During a session we record your activity in that session: which step you are on, the status you report (in progress / done / stuck), chat messages and annotations you write, quiz and poll answers, and help requests. This activity is visible to the workshop host, which is the point of the product.
Payments: subscriptions are processed by Polar, our merchant of record. Card numbers never touch our servers — we store only your plan and subscription status.
Technical data: with your consent (see section 3), anonymous product analytics and a record of whether one of our ads brought you to sign up or upgrade; and error reports when something in the app breaks, so we can fix it.
Solely to provide and improve the Workshopy service: running your live sessions, showing hosts their participants' progress, generating session reports, billing, support, and debugging — and, with your consent, learning which of our own ads work. We do not sell personal data, we do not show ads in Workshopy, and we do not use your workshop content to train AI models.
Emails: we email a teacher account when it is created, when we answer a support message you haven't read yet, and when it is deleted. A summary after each class you run comes only if you turn it on, and stops with one click in any summary. The day after your first lesson, if you haven't run a class yet, we send one reminder about it — once, and it stops with one click or in Settings. We don't track whether you open our emails or click their links. We keep a record of each email — which one, when, and whether it arrived, with your address shortened — for 90 days. Participants never get email from us.
Product analytics (PostHog, hosted in the EU) is off by default and only starts after you click Accept in the cookie banner. If you reject, no analytics events are sent. The same Accept turns on Google Ads conversion measurement: when you arrived from one of our ads, Google's tag notes that you signed up, started your first class, had someone join one of your classes for the first time, or bought Pro — that it happened, never what was in the class — so we can tell which ads work. It stores Google's ad-click cookies; we don't use it to build advertising audiences, and it never runs on the screens participants use to join and follow a workshop. If you reject, Google's tag is never loaded. Essential cookies that keep you signed in and keep participants connected to their session are always active — the product cannot work without them. We also use Vercel Analytics for aggregate, cookie-free traffic statistics and Sentry for error reporting. The public demo keeps a daily tally of how often each of its screens is opened and used, and the lesson library one of how often each lesson's page is opened, learned or copied; they store no cookie, no IP address and nothing else about you.
Workshop hosts see the in-session activity of participants in their own sessions (progress, statuses, answers, chat) — that is the product. Participants see the workshop content the host shares with them and, where the host enables it, each other's chat messages. Workshopy staff access account data and content only when needed for support you requested, to investigate abuse or a security incident, or where the law requires it — never to browse your content. Opening an account requires staff to record a reason, access expires after 30 minutes, and every access is written to an internal log that cannot be edited and is kept for 24 months. Staff dashboards show only aggregate statistics built from the service's own records; they never list participants, and small groups are hidden so no one can be singled out.
We run on a small set of infrastructure providers, each processing data only on our behalf: Supabase (database, authentication, file storage), Vercel (application hosting and traffic analytics), PostHog EU (product analytics, consent-gated), Sentry (error monitoring), and Polar (payments, as merchant of record), Resend (the emails we send teachers — your address and the email itself, nothing about your students), and Anthropic and OpenAI (the AI features in section 6 — only what each request needs, never a student's name). With your consent, Google receives the ad measurement described in section 3 and processes it under its own terms as an independent controller (Google's privacy policy applies to it). We do not share personal data with anyone else.
You can connect an AI app — such as ChatGPT, Claude or Codex — to your account through Workshopy's MCP server, so it can work on your templates for you. You sign in and approve each app yourself on a Workshopy page that lists what it may do. A connected app can read and change your workshop templates and your media library, go back to an earlier version of a template, add images from public links, and read how your finished classes went as numbers; it cannot reach your live sessions, your participants' names, their answers or anything they wrote, or your account and billing — the database refuses those requests.
What the app receives: what it reads to do what you asked — template titles, descriptions, tags, settings and steps (quiz answers included), their earlier versions, the names of your media files and, when you ask about a class, its numbers — how many participants finished, got stuck or answered each quiz question right, with participants counted, never named. That information goes to the app's provider (for example OpenAI or Anthropic) because you asked for it, and they process it under your own agreement with them, not on our behalf. No participant's name, contact or anything they wrote is ever available to a connected app.
What we keep: the connection — which app, and when you approved it — until you disconnect it or delete your account; a mark on templates an app changed and the change in your account's history, both deleted with your account; a counter of your account's requests used to limit their rate, deleted after two hours; daily counts of requests per app and tool, which contain no account; and short-lived technical logs of each request (account, tool, whether it worked) at our hosting provider, for fixing problems. Workshopy staff see only aggregate numbers of connected accounts (small groups hidden); one account's apps are visible only under the access rules in section 4.
Your controls: Settings → Connected apps lists every app and disconnects it; the app loses access on its next request. How AI apps work with Workshopy.
Workshopy's own AI: Ask AI, Create with AI and the class AI helper send what each request needs to Anthropic or OpenAI, who process it on our behalf: your question and the conversation so far, the template you are working on, and material you add. Asked about a class from its report, Ask AI also sends that class's numbers and the questions its students asked the class AI helper — never a participant's name, the chat or a help note. When a student asks the class AI helper, the question, the lesson's visible steps and the teacher's hidden sources are sent — never the student's name, and nothing about other students. We don't keep your Ask AI conversations (they live in your browser tab until you close it). We keep: the text of a teacher's hidden sources (not the file) until the teacher removes them or the template; students' questions and the answers, for the class's teacher, until 30 days after the class ends, when they are deleted; monthly counts per account to apply plan limits; and daily counts per feature and model, which contain no account. Workshopy staff never read the questions or answers. The class AI helper answers no student until the teacher has confirmed they may use it with their students, and each student is told what happens to a question before asking their first.
Session reports stay available for at least 30 days on the free plan and 12 months on Pro, and you can export them as Markdown at any time. Workshop templates and uploaded assets stay in your account until you delete them; each template keeps its earlier versions (the lesson as it was before a round of changes) for 30 days, and they go with the template. To be transparent: we do not currently run automatic deletion of session data past those windows — if we enable it, we will announce it in advance so you can export anything you want to keep. Deleting your account, or asking us to, removes your personal data and content, including your account's change history.
You can access and export your content yourself at any time ( templates and reports export as Markdown). You may request a copy, correction, or deletion of your personal data, or object to processing, by emailing us — we honor these requests regardless of where you live, in line with GDPR and similar laws. If you joined a session as a participant, note that we usually cannot identify you from a display name alone; include the session details in your request.
Participants join with a display name only — Workshopy does not ask students for an email address, an account, or any contact details, which keeps the data we hold about them to a minimum. Hosting an account requires being at least 16. If you use Workshopy with minors in a school setting, you are responsible for following your institution's consent requirements.
Data is encrypted in transit and at rest, accounts are isolated from each other at the database layer, and uploaded files live in private storage served through short-lived signed URLs. See our Security page for the full picture.
If we make material changes, we will update the date above and notify account holders by email or in-app before the changes take effect.
Questions or requests: privacy@workshopy.io