Privacy Policy

Version of 8 November 2026. This policy covers the website coworking.live and the "Coworking" browser extension.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

We are not legally required to appoint a data protection officer. For all data protection matters, please contact us at the address above.

2. Overview

We process personal data only to the extent necessary to provide our website and extension, and in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG). We do not sell personal data. We currently do not use it for advertising and do not use analytics or tracking tools on this website or in the extension.

3. Visiting this website

Hosting and server log files

This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"), which delivers it through its global network. When you access the website, the browser automatically transmits information that is stored in server log files: IP address, date and time of the request, requested page, referrer URL, browser type and version, and operating system. This data is not combined with other data sources.

Until our move to Cloudflare is complete (expected by the end of 2026), Vercel Inc., USA ("Vercel"), may still deliver some requests as a fallback, processing the same data under the same conditions.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient delivery of the website and in detecting and defending against attacks. Cloudflare and Vercel process this data on our behalf under data processing agreements (Art. 28 GDPR). For transfers to the USA, see section 8.

No cookies, no tracking, no external content

This website does not set cookies, does not use analytics or tracking, and does not load fonts, scripts or other content from third-party servers. The only information stored on your device is what the focus timer needs to work (see below). Consent under § 25 TDDDG is therefore not required, and we don't show a consent banner. Links to external sites (such as the Chrome Web Store) only transmit data to the respective provider once you click them.

Focus timer (coworking.live/app)

The focus timer works without an account. Your tasks, the timer state, your timer settings and the radio volume are stored only in your browser's local storage on your device. They are not transmitted to us, and we cannot see them. This storage is strictly necessary to provide the timer you have expressly requested (§ 25 (2) no. 2 TDDDG). You can delete the data at any time by deleting your tasks or clearing this site's data in your browser.

The lofi radio only starts when you press play. Your browser then loads audio files from audio.coworking.live, which we store with Cloudflare R2, a service of Cloudflare (see "Hosting and server log files" above). Cloudflare processes the same server log data as for the website, as our processor, on the same legal basis (Art. 6 (1)(f) GDPR, our legitimate interest in delivering the music you requested).

Live room: who is here, reactions, quick phrases and group sessions

While the focus timer is open, it shows how many people are using it right now and their countries, and lets visitors send reactions (such as 👏 or 🔥), pick a quick phrase (such as "Good luck, everyone") and join group focus sessions. For this, your browser keeps a connection open to listeners.coworking.live, a service we run on Cloudflare Workers (see "Hosting and server log files" above).

For each open connection, our server keeps only this, in memory: whether you are counted, your country, the table you sit at (groups of up to 50 people), the group session you joined, and when you last sent a reaction or a phrase. We read the country from the connection information Cloudflare already has. We never read your city, region, postal code or coordinates, and we do not store your IP address for this feature. There is no id, no cookie and no account. Your browser sends nothing about what you do in the app on its own: not your timer, tasks or settings, and not whether the radio is on. It only sends a reaction, a phrase or a group-session join when you tap one. Reactions and phrases come from fixed lists; there is no free text. When you close the tab, the entry is gone, and nothing is stored.

What others see: everyone sees the number of counted visitors and their countries as small flags with a number, such as "Germany 2", and how many people joined the next group session. The people at your table see your reactions, and your phrases together with your country's flag if you are counted (for example "🇩🇪 Good luck, everyone"); when several people say the same thing at once, only the number is shown. Everyone sees how many of each reaction the whole room sent in the last minute. Nobody ever sees anything more precise than your country.

This is on by default. You can switch it off with "Count me in" in the timer's settings. Your browser then connects without being counted, and our server does not read your country. You still see the room and can send reactions and phrases, without a flag. Legal basis: Art. 6 (1)(f) GDPR, our legitimate interest in showing that others are focusing at the same time and letting them encourage each other. Switching off "Count me in" is the quickest way to object under Art. 21 GDPR (see section 12).

4. Using the extension

The "Coworking" extension lets you create and join rooms, share a focus timer, see who is present and chat. Using the extension requires an account.

Data we process

• Account data: name and email address (received from Google at sign-in, see section 5), user ID.
• Profile data: display name, selected work types, daily focus goal, and the time you completed setup and accepted the terms.
• Room data: rooms you create or join, room names, invite codes, your membership and the shared timer state.
• Chat messages: content and time of messages you send in a room.
• Focus sessions: start time and length of completed focus sessions, used for your statistics, your daily goal and the beta's daily allowance.
• Invitations: if you join a room within three days of creating your account, we record which user invited you (the room's creator). When you complete your first focus session, that user's beta allowance is unlocked. The inviting user sees only how many invited friends have joined, not who.
• Local settings: your names for upcoming sessions, sound preferences and room order are stored only on your device and are not transmitted to us.
• Presence data: while a room is open, the fact that you are online and your optional "working on" status. Presence data is transmitted in real time and not permanently stored.
• Technical data: when the extension communicates with our backend, your IP address and technical request data are processed in server logs (see "Backend" below).

Legal basis: Art. 6 (1)(b) GDPR (performance of the contract of use, see our Terms). For technical log data: Art. 6 (1)(f) GDPR, based on our legitimate interest in operating the service securely.

Visibility to other users

Your display name, presence, status, chat messages and timer actions are visible to the other members of the rooms you join. Please don't share information in rooms that you don't want other members to see.

Backend (Supabase)

Account and app data are stored and processed by Supabase, Inc. ("Supabase") as our processor under a data processing agreement (Art. 28 GDPR). The database is hosted in the EU (Frankfurt am Main, Germany). Supabase processes server logs, including IP addresses, to operate and secure the service. Support or maintenance access from outside the EU cannot be ruled out; see section 8.

Storage on your device

The extension stores your sign-in session and a few interface preferences (for example, tips you have dismissed) in the browser's extension storage. This is strictly necessary to provide the service you have expressly requested (§ 25 (2) no. 2 TDDDG). The session is removed when you sign out; preferences are removed when you uninstall the extension.

Browser permissions

The extension uses the Chrome permissions "storage" (sign-in session and preferences), "identity" (Google sign-in), "sidePanel" (display) and "notifications" (notice when a timer phase ends). It does not request access to the content of websites, your browsing history, camera or microphone.

Chrome Web Store

The extension is distributed through the Chrome Web Store, operated by Google. Google processes data in connection with the installation and updates under its own responsibility and privacy policy.

The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Sign-in with Google

You sign in with your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When you sign in, you are redirected to Google; Google then transmits your name, email address and a user identifier to us. We do not receive your Google password. Legal basis: Art. 6 (1)(b) GDPR. Google processes data in connection with the sign-in under its own responsibility; see Google's Privacy Policy.

6. Contacting us

If you contact us by email or phone, we process the data you provide (for example name, email address and the content of your message) to handle your request. Legal basis: Art. 6 (1)(b) GDPR if your request relates to the use of our services, otherwise Art. 6 (1)(f) GDPR (our legitimate interest in answering enquiries).

Emails to addresses at coworking.live are forwarded by Cloudflare's Email Routing service to our mailbox, which is hosted by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Both process emails on our behalf under data processing agreements (Art. 28 GDPR). For transfers to the USA, see section 8.

7. Recipients and processors

Personal data is only disclosed where this is necessary for the purposes described above:

• Processors: Cloudflare (website hosting, the live room and email forwarding, with Vercel as a fallback for hosting during the move, see section 3), Supabase (backend) and Google Workspace (our mailbox, see section 6), bound by data processing agreements.
• Other members of the rooms you join (see section 4, "Visibility to other users").
• Google, to the extent described in sections 4 and 5.
• Public authorities, where we are legally obliged to disclose data.

8. Transfers to third countries

Some of our service providers are based in, or may access data from, countries outside the EU/EEA, in particular the USA. Where no adequacy decision exists, transfers are based on appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR). For providers certified under the EU-US Data Privacy Framework, transfers are based on the European Commission's adequacy decision (Art. 45 GDPR).

9. Storage period

We store personal data only as long as necessary for the purposes described, or as long as statutory retention obligations require. In particular:

• Account, profile, room and focus-session data: for as long as your account exists. After deletion of your account, this data is deleted, unless statutory retention obligations apply.
• Chat messages: as long as the room exists or until your account is deleted. If you leave a room, messages you sent remain visible to its members.
• Live room (count, country, table, reactions, phrases, group joins): only in memory while your tab is open; deleted when you close it.
• Server log files: deleted after a short period in line with the providers' standard retention, unless further retention is necessary to investigate a specific security incident.
• Correspondence: until your request has been handled; business correspondence may be subject to statutory retention periods (up to six years under § 257 HGB, up to eight or ten years under § 147 AO).

Backups are overwritten in regular cycles; deleted data may remain in backups until they expire.

10. Security

We use appropriate technical and organisational measures to protect your data, including encrypted transmission (TLS) and access controls in the database. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing (Art. 21 GDPR, see section 12);
• lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights, including deleting your account, contact us at contact@coworking.live. We may ask you to confirm your identity. The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. You can also contact the supervisory authority in your place of residence or work.

12. Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6 (1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

13. Other information

Obligation to provide data

You are not legally or contractually obliged to provide personal data. However, the extension cannot be used without an account and the data described in section 4. The website can be used without providing any data beyond the technical data described in section 3.

No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Children

Our services are not intended for persons under 16. We do not knowingly process data of children under 16.

Former coworking.live web app

Until 2026, coworking.live offered a separate web app, which has been discontinued. If you had an account there and would like your data deleted or want to know what we store, contact us at contact@coworking.live.

Changes to this policy

We may amend this privacy policy to reflect changes in our services or the law. The version published on this page at the time of your visit applies.