Privacy

Who runs this service

Classroom is operated by Baja Labs. Your workspace is the unit of ownership: the person who created it (or who has since been made an admin) decides who may join it and what leaves it.

What is stored

• Account — your email address, display name, and an optional profile photo.
• Content — the folders, projects, boards, items, docs, comments, captures, forms and files you and your team create.
• Sessions — for each device you are signed in on: when the session started, when it last refreshed, the browser's user-agent string and the IP address it connected from. You can see and end these on your account page.
• Operational records — audit entries for workspace changes, job runs, usage counters, and error reports.

Where it lives

Application data is held in a self-hosted PostgreSQL database (Supabase) running on hardware the operator rents in Helsinki, Finland (Hetzner). It is not on a managed multi-tenant cloud database. The database is not reachable from the public internet: applications connect through an authenticated private tunnel.

Backups are taken nightly and held off-box. Backups are encrypted at rest and are restored only to recover the service.

The web application and the background services are hosted on Vercel and Railway respectively, which means requests are processed outside Finland even though the data at rest is not. The full list of providers is on the subprocessors page.

Files and media

Uploads are stored in a private bucket. Nothing in it is publicly addressable: every read is a short-lived signed URL issued to a signed-in person who has already been checked against the workspace's permissions, and those links expire in minutes.

AI features

Where a workspace turns on an AI feature, the text you send to it is forwarded to the model vendor configured for that workspace, through the operator's own gateway. Nothing is sent to a model vendor unless a workspace has enabled the feature and someone in it invokes it. The vendors that may receive content are named on the subprocessors page.

Deleting your account

Deleting your account from the account page is a soft deletion, and it is deliberate. It signs you out everywhere, removes you from every workspace you can leave, clears your display name and photo, and closes the account so it can no longer sign in (the account is banned and stamped with a deletion timestamp).

Content you contributed to a workspace stays in that workspace — otherwise deleting one account would tear holes in other people's boards and documents. Removing that content is the workspace owner's action: an owner can delete a workspace, and purging it from the trash destroys its rows for good.

You cannot close an account that is the only admin of a workspace, or that is billed for one; hand those over first. If you need the account record itself erased rather than closed, ask the operator.

Retention

• Workspace content is kept until someone deletes it. A deleted workspace sits in the trash until an admin purges it.
• Test workspaces created by the operator's own end-to-end suites are flagged as drills and swept automatically — soft-deleted after seven days and purged seven days after that. They never contain customer data.
• Sessions expire on their own and can be ended at any time from the account page. Operational logs are kept for as long as they are useful for debugging and billing.
• Backups roll: a deletion is reflected in backups once the older copies age out.

Your choices

You can edit or clear your name and photo, set or change a password, turn on two-factor sign-in, see and end sessions, and close your account — all from the account page, without asking anyone. Export and deletion of a whole workspace are admin actions inside that workspace.