Privacy & records
Operational information · updated 27 October 2026. Data controller and contact for privacy requests, retention decisions and student account recovery: Arthur Reinhart, art@cameraobscura.cloud.
Student-launch policy review is not complete. Legal bases, final retention rules and provider/backup arrangements must be confirmed before real student use. Reading this page or creating an account is not consent to activity monitoring.
Information stored
Account email, display name, account/access roles and authentication records; project membership and crew; project work, files and screenplay revisions; Meetings plans, documents, exercises, individual/group submissions, feedback, scheduled sessions, check-in/out, attendance decisions and correction requests.
Security, access changes, deletion decisions and recovery operations may retain audit records. Hosting and authentication providers may retain operational logs such as request/network information. These are distinct from automatic student activity estimates.
Automatic student activity recording is disabled by the current application configuration.
How information is used
Information is used to provide accounts and project tools, organize Meetings and course work, record attendance and feedback, maintain security, respond to requests and recover records where possible. Some information is supplied by instructors or other participants, such as feedback and attendance decisions.
The legal basis for each purpose and any school or institutional role still require review. Any monitoring that relies on consent must have a separate, clear choice; account creation alone is not that choice.
Who can access work
Project access governs shared project work. Participants see published Meetings content and their own or current group submissions/feedback; instructors and authorized managers can review work. Confidential projects and screenplays additionally require their explicit grants and MFA. Classroom membership does not grant access to linked source files in other projects.
Teaching-evidence archives require active administrator access and verified MFA. Confidential teaching snapshots are restricted to the deleting administrator. Deleted-file recovery has separate administrator/MFA controls. Downloaded or exported copies leave application access control.
Service providers used by the app include Vercel for hosting, Supabase for the database and authentication, Amazon Web Services for file storage, and Resend for notification email. When a user loads an external map, the map provider receives a request that can include the user’s IP address and the area viewed. Provider contracts, retention, processing locations and any international transfer safeguards require review; provider access does not make shared work public.
Retention & deletion
Arthur Reinhart reviews records at the end of each Meetings programme, not after every scheduled session. Teaching archives have a target for manual review 24 months after the programme ends. This is a review target, not a guarantee of deletion: no automatic expiry is configured, and a documented deletion process and final retention rules are still required.
Hiding/removing a project file does not erase its stored versions. Project deletion can preserve teaching evidence or explicitly delete it; file recovery metadata/versions are separately retained. No automatic expiry is configured for teaching archives. Required audit history and provider backups can have separate retention; an application deletion is not a guarantee that all exports, backups or downloaded copies disappear.
The previous test-data cleanup is not a retention policy for student work. Future backup scope, access and expiry must be reviewed before collecting real records.
Request a review
Contact Arthur Reinhart at art@cameraobscura.cloud, through your established course contact or in person. Identify the Meetings or record and the access, export, correction or deletion you need. Identity and the request’s scope may need to be verified; shared records and legal retention obligations can require review. Account deletion and permanent removal are not automatic.
Depending on the applicable law and circumstances, you may also have the right to restrict or object to processing, receive portable data, or withdraw consent where processing relies on it. You may complain to your data-protection authority. Where the GDPR applies, requests are generally answered without undue delay and within one month; an extension may apply in the circumstances provided by law, and you will be informed.
For Meetings attendance, use the existing “Request attendance correction” action when available. Other requests can be prepared below; this application does not deliver the downloaded request automatically.