Privacy Policy — The Pitch Room

Draft for founder and legal review. Not yet published.

Every factual claim below was written from the database schema and the code, not from a template. Where the code does something a founder might not expect, this policy says so plainly rather than smoothing it over. Placeholders in [[double brackets]] are decisions only you can make.

Version: [[choose, e.g. 2026-09-13]]

Last updated: [[date you publish]]

Who we are: The Pitch Room is run by [[your full name]], an individual, not a registered company. [[Postal address for legal notices.]]

Contact for privacy questions: [[email address]]

The short version

The Pitch Room is a private beta where founders publish short video pitches and viewers must genuinely watch before they can respond.

We collect what the product needs to work: your account, what you choose to put on your profile and your pitch, and how much of a video you actually watched. We do not run analytics trackers, we do not use advertising pixels, and we do not sell your data or hand it to advertisers.

We do use one thing for marketing, and we would rather say it here than bury it: your published pitch video. If you publish, that video and your public profile details may appear on our social media accounts. Your deck never does.

Three things are worth knowing before you go further, because they surprise people:

1. A published pitch video is public, and we may post it on social media. Once your pitch goes live, its video and captions are served from unauthenticated URLs, and we may share that video on Instagram, LinkedIn, X, YouTube and similar platforms to promote The Pitch Room, alongside the profile details you chose to make public. Your PDF deck is never used this way. Section "Promoting pitches" explains exactly what this covers. Before publication, your video is private.
2. We email you. Sign-in codes, notifications about your pitch, and a newsletter. You can switch the notifications and the newsletter off; you cannot switch off sign-in codes, because they are how you get in.
3. Deleting your account is a request, not a switch. It hides your public profile immediately and starts a removal process a person completes by hand. Some records are kept deliberately, and this policy says which and why.

What we collect

Your account

When you sign in, we store your email address so we can recognise you. You can sign in with a one-time code sent to your email, or with Google. Authentication is handled by Supabase, our database and authentication provider; if you use Google, Google tells Supabase your email and basic profile.

What you put on your profile

All of this is optional except your name, and you choose how much of it is visible:

• Your name, which we show next to your pitch
• A username, if you want a profile page
• A role, a location, and a short bio
• Links to your website or social profiles, each marked public or private to you
• A contact address or booking link

You choose one of three visibility settings: a public profile page, your name only, or your startup's name only. If you choose "startup name only", your name is removed from every public view of your pitch.

Your contact details are never on a public page. They are shown to one viewer at a time, and only to someone who has already watched your pitch and given their reaction. Reviewers also see them, including the links you marked private, because that is what the private marking means.

What you put in a pitch

Your startup's name, industry, domain, one-line description, stage, team size, whether you are raising, what you are asking for, optional notes, your video, and an optional PDF deck.

How you watch

This is the part that makes the product work, so we describe it exactly.

While a video plays, we record how many seconds you genuinely watched. Time only counts when the tab is visible, you are not dragging the scrubber, and playback is near normal speed. We also record how far through the video you reached, when you started, and when you were last seen.

We record this for signed-out visitors too, using a random identifier stored in a cookie. That identifier is not linked to a name or an email unless you later sign in.

We do this to enforce the gate: you cannot react to or rate a pitch until you have actually watched it. It is the mechanic the whole product rests on.

How you respond

Your reactions, your scores, your comments, whether you found someone else's comment helpful, who you follow, and what you save.

Reports and moderation

If you report a pitch or a comment, we store your report and your reason. Moderator decisions are recorded in an internal log, which may contain notes a moderator wrote about the situation.

A small amount of product telemetry

We record a fixed list of product events, such as which surface a click came from and the domain of a referring site. These stay in our own database. They are not sent to any analytics company, because we do not use one.

Promoting pitches on social media

We promote The Pitch Room by sharing published pitches on social platforms, including Instagram, LinkedIn, X, YouTube, TikTok and similar services, and in our own newsletter and marketing material.

What we may use: your published pitch video, in whole or in an edited clip; a still frame from it; your startup's name, one-line description, industry and stage; and the profile details you chose to make public, which may include your name, your role, your location and your public links.

What we never use: your PDF deck or any other document you attach, your contact address or booking link, any link you marked private, your email address, anything from an unpublished draft, and any response you gave to someone else's pitch.

The deck is deliberately out of scope. A deck often carries financials, a roadmap, or customer names. Viewers of your published pitch can open it on the site, but it never appears in anything we post or send.

Your visibility setting is respected. If you chose "startup name only", we will not attach your name to a post. If you chose "name only", we will not link to a profile page you do not have.

Two consequences worth stating plainly, because they cannot be undone later:

• Once a post is live on a third-party platform, that platform's own terms apply to it, and people can screenshot, download, duplicate or repost it in ways nobody controls. Removing your pitch from The Pitch Room does not pull those copies back.
• We will remove our own posts on request, as far as each platform allows, but we cannot remove what others have reshared.

We rely on your consent for this, and only your consent. It is a separate, optional tick box at the review step, unticked by default and apart from the box that accepts the terms. We do not treat accepting the terms as permission to use your face and voice in marketing, and we do not infer permission from your having published.

Your choice is recorded against that specific pitch version at the moment you submit it, alongside the terms version you accepted. If you do not tick it, no permission exists and we do not post. To withdraw a permission you have given, write to us; we will stop posting and remove our own posts as far as each platform allows.

Email

We use your email address for three things:

1. Sign-in codes. You cannot switch these off. They are how you sign in.
2. Notifications about your own activity, such as the outcome of a pitch review. You can switch these off.
3. A newsletter about The Pitch Room. You can unsubscribe at any time, using the link in every issue or from your settings.

We do not sell or rent your email address, and we do not pass it to anyone for their own marketing.

What we do not do

Each of these was verified against the code, not assumed.

• We do not use Google Analytics, PostHog, Sentry, Mixpanel, or any third-party analytics or error-tracking service.
• We do not use tracking pixels or advertising tags.
• We do not sell your personal data, and we do not hand it to data brokers or advertisers. Promoting published pitches on our own social accounts, as described above, is the one marketing use we make of what you publish.
• We do not have direct messages. There is no private inbox to read.
• We do not store raw IP addresses. Where we need to limit automated abuse, we convert the address into a one-way hashed value and keep only that.
• We do not use non-essential cookies, so we do not show a cookie banner.

Cookies and browser storage

We set three kinds of cookie, all of them strictly necessary. None are used for advertising or analytics.

All are HTTP-only, so scripts on the page cannot read them, and all are sent only to this site.

We also use your browser's session storage, which is cleared when you close the tab, to hold an unsent comment draft, a reaction you made just before signing in, and a remembered display name.

Who else processes your data

Mux generates captions by transcribing your video's audio. That is speech-to-text performed by Mux as part of their captioning service. We do not run facial or voice recognition on your video, and neither do we ask anyone else to.

[[Confirm with each provider where they store data, and add the locations and any transfer mechanism your jurisdiction requires.]]

Who can see what

Before you publish. Your draft video is private. It plays only through short-lived signed links, and only for you and a reviewer.

After you publish. Your video and its captions become public. They are served from URLs that do not require an account, so anyone who has the link can watch, and search engines could index a link someone shares. Please treat anything you say in your pitch as public.

Your deck. A PDF deck attached to a published pitch can be opened by anyone viewing that pitch, through a link that expires after five minutes. There is no requirement to have watched or reacted first.

Your contact details. Shown only to a viewer who has watched your pitch and given a reaction, and to reviewers.

Your responses. Your reaction and your scores are never shown attached to your name. The room's numbers appear only after enough independent people have responded: five for reactions, ten for scores. Your comments appear with the name on your profile.

How long we keep things

We will be direct about this, because the honest answer is not "as long as necessary".

Kept indefinitely, deliberately: reactions, scores, comments, watch and view records, reports, consent records, and moderation logs. Reactions and scores cannot be edited or deleted at all, by anyone, including us. That immutability is enforced in the database, and it exists because the product's promise is that the numbers reflect real, un-retouched responses. A system that lets responses be quietly rewritten cannot make that promise.

Deleted on a schedule: abuse-limiting records are deleted after two days. Drafts you abandon are archived after [[30]] days of inactivity, and the video files behind archived, removed, or deleted pitches are deleted from our video provider.

Deleted when you ask: a PDF deck you remove is deleted from storage.

A comment you delete has its text replaced with a marker. The row remains so the conversation around it still makes sense.

[[If you want to promise a retention limit on watch data, view records, or product events, that requires new code. Today there is none, and this policy must not claim one.]]

Your choices and your rights

Change what is visible. Your profile settings control whether you have a public page, whether your name appears, and which links are public. That setting also governs what we may attach to a social media post about your pitch.

Switch off email you did not ask for. Notifications and the newsletter can both be turned off. Sign-in codes cannot, because without them you cannot sign in.

Ask us to take down a post. If we have shared your pitch on social media and you would rather we had not, tell us and we will remove our own posts as far as each platform allows. We cannot recall copies other people have made.

Delete your account. Request deletion from your settings. Your public profile is hidden immediately. The rest is completed by a person, who removes or anonymises your account, your content, and your stored files, then marks the request complete. We do this by hand deliberately, so that moderation evidence and other people's conversations are handled correctly rather than being torn out automatically.

What survives a deletion. The records listed as deliberately kept above. Where we can anonymise rather than delete, we will.

[[Depending on where you and your users are, people may have rights to access, correct, port, or object to processing, and to complain to a regulator. Add the rights that apply, how to exercise them, and how quickly you will respond.]]

Children

[[Set a minimum age and state it here. The code does not currently ask for or check age anywhere, so whatever you state must either be enforced by an attestation you add to sign-up, or described honestly as a rule rather than a control.]]

Security

Access to the database goes only through server-side functions. Browser-level roles hold no direct read or write access to any table, which is verified by an automated test on every change. Session cookies are signed and HTTP-only. Draft videos play only through expiring signed links. PDF decks are validated on upload and rejected if they contain active content.

No system is perfectly secure, and this is a beta.

Changes

If we change this policy we will update the version and the date at the top. If a change materially affects how we use what you have already given us, we will say so on the site rather than changing this page quietly.

Contact

[[Email address for privacy requests.]]

[[If your jurisdiction requires a named data controller, a representative, or a data protection officer, add them here.]]