Cloudimot Privacy Policy

Last updated 18 September 2026

Cloudimot ("we", "us") is a web application at cloudimot.com that lets organisers collect words from an audience via a link or QR code and display them as a live word cloud. This policy explains what information we collect, why, and what happens to it.

There are two kinds of people this policy covers:

Organisers — people who sign in with Google to create and manage word clouds.
Participants — people who add words to a cloud, or view a cloud's result page. Participants usually do not have an account.

1. Information we collect

1.1 Organiser accounts

When you sign in with Google we receive and store your name, email address and profile picture from your Google account. We use these to identify your account, show who you are in the app and attribute the clouds you create to you. We never see your Google password.

We also store a session cookie so you stay signed in, and the OAuth tokens Google issues to us for that sign-in.

1.2 Word clouds you create

We store everything you set up for a cloud: its title, prompt, styling choices, visibility, submission window, content-filter settings, expiry date and any logo image you upload. If you protect a cloud with a viewer password we store only a one-way hash of that password, never the password itself.

1.3 Participant submissions

Every time someone adds words to a cloud we record:

the words submitted, after normalisation (lower-cased, trimmed);
the date and time;
the participant's IP address, taken from the connection;
a participant id — a random identifier stored in a cookie on your device (see section 4), used to enforce the per-person word limit and to tell repeat submissions apart;
a device fingerprint — a salted, one-way hash of the IP address and browser user-agent;
the participant's account name and email, but only when the organiser has required sign-in for that cloud and the participant signed in with Google.

Words that are rejected by a content filter (profanity, hateful language, or the organiser's blocked-word list) are still recorded, marked as filtered, so the organiser can review them. They are never shown in the cloud.

Words the organiser removes are hidden from the cloud but kept in the record until the cloud is deleted.

1.4 Viewing a result page

When you unlock a password-protected cloud we set a cookie for that cloud so you do not have to re-enter the password. The cookie contains a signed token, not the password. It expires after 30 days and is invalidated if the organiser changes the password.

Result pages refresh automatically about once per second while open. Those requests carry no personal information beyond your IP address and the cookies above.

1.5 Analytics

We use Google Analytics to understand how the site is used: which pages are visited, roughly where visitors come from, what devices and browsers they use, and how they move through the site. Google Analytics sets cookies (see section 4) and collects your IP address, device and browser details and the pages you view, and sends that data to Google. We have IP anonymisation enabled where Google offers it and we do not link analytics data to your account or to the words you submit.

You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies from google-analytics.com and googletagmanager.com. Google's handling of this data is described in How Google uses information from sites that use its services.

1.6 Technical logs

Our web server (nginx) and application keep standard access and error logs that include IP addresses, requested URLs, timestamps and browser user-agent strings. These are used for security and troubleshooting and are rotated automatically.

2. How we use information

To run the service: sign you in, save your clouds, accept submissions and display them.
To let organisers moderate their clouds: organisers can see every submission to their own clouds, including the words, timestamps, IP addresses, device fingerprints and, where sign-in was required, the participant's name and email.
To enforce organiser settings such as submission windows, sign-in requirements and content filters.
To detect abuse, such as repeated submissions from one device.
To keep the service secure and diagnose problems.
To measure how the site is used and improve it, through Google Analytics.

We do not sell personal information, use it for advertising, or profile users.

3. Who can see your information

Organisers see the submission data described in section 1.3 for clouds they own.
Platform administrators (a small, named list of Cloudimot operators) can view platform-wide statistics, look up organiser accounts by email, and open and edit any cloud, including its submission data, to provide support and handle abuse.
Viewers of a public cloud see the words in the cloud and the total count if the organiser has enabled it. They never see who submitted a word.
Service providers that process data on our behalf:
- Amazon Web Services — hosting and database, in the US East (Virginia) region.
- Google — sign-in (Google OAuth), web fonts and analytics. Result pages and the organiser dashboard load fonts from Google Fonts, and every page loads Google Analytics, which means your browser sends requests, including your IP address, to Google's servers. Google's handling of those requests is covered by Google's privacy policy.

We disclose information when required by law or to protect the rights, safety or property of Cloudimot, its users or the public.

4. Cookies

Cookie	Purpose	Lifetime
`authjs.session-token` and related `authjs.*` cookies	Keeps organisers signed in; protects sign-in against forgery	Session, up to 30 days
`cloud_access_<id>`	Remembers that you unlocked a password-protected cloud	30 days
`cloudimot_pid`	A random participant id set when you first submit, so each person can add only the allowed number of words to a cloud; it is stored with your submissions and shown to the organiser as an anonymous id	1 year
`_ga`, `_ga_*`	Google Analytics: distinguishes visitors and sessions	Up to 2 years

We do not use advertising cookies. Your browser may also store small preferences locally. See section 1.5 for how to opt out of analytics.

5. Retention

Organiser account data is kept while the account exists.
Cloud settings, logos and all submissions (including filtered and removed entries) are kept until the organiser deletes the cloud, which permanently removes the cloud and every submission attached to it.
A cloud that reaches its expiry date goes offline but its data remains until deleted.
Server logs are retained for a limited period and then rotated.
To delete your organiser account and everything it owns, contact us at the address below.

6. Security

Traffic to cloudimot.com is encrypted with TLS. Viewer passwords are stored as bcrypt hashes. Access cookies are signed so they cannot be forged. Access to the production server and database is restricted to platform administrators. No system is perfectly secure, so we cannot guarantee absolute security.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete personal information we hold about you, or to object to or restrict how we use it. Organisers can view and delete their own clouds and submissions in the app at any time. For anything else, including requests from participants, email us and we will respond within 30 days. If you are in the EEA or UK you also have the right to complain to your data protection authority.

If you submitted words to a cloud and want them removed, contact the organiser of that cloud first, as they control that data. We will help if you cannot reach them.

8. Children

Cloudimot is intended for organisers aged 18 or over. Organisers running clouds with younger participants, for example in a classroom, are responsible for complying with the laws that apply to them, including obtaining any consent required.

9. Organisers' responsibilities

If you run a cloud you receive personal information about participants (IP addresses and, where you require sign-in, names and emails). You are responsible for using it lawfully, telling participants that their submissions are recorded, and for any privacy obligations that apply to you as the person collecting it.

10. International transfers

Cloudimot is operated from the United States and data is stored there. If you use the service from elsewhere your information will be transferred to and processed in the United States.

11. Changes

We will post any changes to this policy on this page and update the date at the top. Material changes will be highlighted in the app for signed-in organisers.

12. Contact

Questions or requests: privacy@cloudimot.com (placeholder — replace with the address you want to use).

This policy describes the application as built on 15 September 2026.