Privacy Policy

Protocol15 is operated by Ilya Vaiman, a sole proprietor trading as Protocol15 (“Protocol15,” “we,” “us”). Ilya Vaiman is the data controller for personal information processed to operate the Protocol15 website, host accounts, hosted sessions, participant access, and related service operations.

For privacy requests or questions, contact support@protocol15.com.

Where privacy law requires a legal basis, Protocol15 processes information to perform a contract with hosts, based on legitimate interests in operating and improving the service, with consent where required for optional analytics or communications, and to comply with legal obligations.

Protocol15 uses essential cookies, local storage, session storage, and similar technologies to operate the service, including authentication, security, redirect recovery, language preferences, participant session continuity, and live-session functionality.

On public pages, optional PostHog analytics is off by default. The PostHog browser library is loaded and sends individual analytics events only after you explicitly accept analytics. It uses random browser and session identifiers, cookies, and browser storage; these are not linked to your host or participant account.

PostHog uses its EU region. Automatic click capture, session recording, heatmaps, advertising tracking, full referrer URLs, raw URL query strings, and fragments are disabled. We do not create identified person profiles.

After consent, we collect the referring website domain, public campaign labels (utm_source, utm_medium, and utm_campaign), browser language, and clicks on Start Free Demo buttons. Only validated campaign labels are retained, not the full query string. Referral and campaign context is kept in memory during the current page document and cleared on withdrawal. Demo-button clicks measure interest, not completed signups or started sessions.

For consented public-page visits, PostHog uses your IP address to estimate location, such as country, region, and city. This is approximate network location, not GPS location. The IP address is discarded before the analytics event is stored.

Usage reporting clarification (September 10, 2026): we also count public pageviews using our own service. Basic counting is on by default to improve the site. The counter stores only a fixed page category and daily total for 90 days; it does not store visitor identifiers, IP addresses, or referrers. Only completed daily page-category totals are sent from our server to PostHog (EU), where they may be retained for up to one year. No individual visit time, visitor identifier, IP address, browser details, referral data, or campaign tags are included in this export. Basic counts do not measure unique visitors or sessions. You can turn off Basic page counts in Cookie preferences; Reject analytics turns off both basic counts and optional browser analytics. Counts already aggregated cannot be associated with a visitor or removed individually. Hosting providers may separately retain request logs. We retain daily sign-in counts by host for 90 days. Authorized operators can view aggregate account, sign-in, exercise, participation, and order counts from service records.

You can reopen Cookie preferences in the public-page footer to change your choice. Rejecting or withdrawing analytics consent stops new optional browser captures and removes its stored analytics identity. Accessible legacy Google Analytics cookies are removed during the transition. Blocking essential browser storage can break host login, participant join, or live session behavior.

Protocol15 disables optional analytics on authentication, account, host, participant-join, live-game, presentation, and Operations routes. Analytics events are limited to an approved parameter list that excludes room codes, account and participant identifiers, and user-provided names.

Protocol15 does not sell personal information. Protocol15 also does not use participant gameplay data to create formal psychological, employment, credit, health, or educational assessments.

Protocol15 is not directed to children under 13 and should not be used by children under 13 without legally valid school, parent, or guardian authorization. Hosts using Protocol15 with students or minors are responsible for obtaining required permissions, following school or organization policies, and avoiding unnecessary personal information. Participants should use non-identifying nicknames where appropriate.

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or opt-out of certain processing. To make a privacy request, contact support@protocol15.com. For account access or authentication issues, contact auth@protocol15.com. Protocol15 may need to verify the request and may keep information where allowed or required by law.

Protocol15 uses technical and organizational safeguards designed to protect information, including authentication, row-level access controls, participant-scoped access tokens, and provider-managed infrastructure. No internet service is completely secure, so hosts and participants should avoid entering sensitive or confidential information into the product.

Protocol15 may process and store information in countries other than where you live. Those countries may have data protection rules different from your local rules. Where required, Protocol15 relies on appropriate transfer mechanisms or provider safeguards.

Protocol15 may update this Privacy Policy as the product, providers, legal requirements, or business model change. The updated version will be posted on this page with a new effective date.

For privacy requests or questions, contact support@protocol15.com. For account access or authentication issues, contact auth@protocol15.com.