Privacy policy

01Who we are

Tablecast is operated by Cloudcast Systems Pty Ltd ("Cloudcast Systems", "we"), an Australian company. Tablecast is a remote studio: organisations use it to plan, record, produce and publish video programmes with people who are not in the same room.

This policy covers tablecast.studio, the Tablecast web application, the Tablecast iOS app, and the APIs behind them. Privacy questions go to privacy@tablecast.studio, and we answer them ourselves rather than routing them to a ticket queue.

02Two roles, and which one we are

This distinction decides most of the answers below, so it comes first. Tablecast holds two different kinds of information and stands in a different relationship to each.

Our own customers

When you create a Tablecast account and an organisation, we decide what to collect and why. That is our data, our responsibility, and this policy governs it directly.

Your shows and the people in them

When your organisation records a session, invites a guest or streams a programme, the organisation decides what is captured and what happens to it afterwards. We process that material on its instructions and do not use it for our own purposes. If you were a guest on somebody's show, the organisation that ran it is the first place to ask — and the section on erasure below explains what we can do directly.

03What we collect

Account

Your email address, a display name, and an authentication credential. Passwords are handled by Amazon Cognito using SRP — the password itself is never transmitted to us or to Cognito. If you sign in with Google or Apple, or through your employer's identity provider, we receive the identifier and the claims that provider sends and do not receive your password at all.

Organisation

The organisation's name, its members and their roles, teams, and its billing details. Every record in our database is scoped to an organisation and isolated at the database level, not merely by a filter in application code.

Participants you invite

To invite somebody to a session we hold the name and, where you supply one, the email address you gave us for them, plus the state of their invitation. A guest who joins from a code or a QR link without an email address supplies only the display name they type.

Recordings and session material

Audio and video tracks, the programme mix, transcripts, chat, show notes, whiteboards, scripts and the edit decision list — everything the session produces. This belongs to the organisation that produced it. We do not use it to train models, we do not sell it, and we do not look at it except where you ask us to help with a specific problem.

Technical and diagnostic

Error reports and performance measurements, including connection quality statistics during a live session. This is designed so that it cannot carry personal information: the schema has no field capable of holding a name, error messages are scrubbed in the browser before they are sent and scrubbed again on receipt, and an organisation can switch it off entirely, after which its reports are discarded at ingest.

Logs

Ordinary server logs — request paths, timestamps, response codes and IP addresses — kept for security and debugging. Stream URLs and keys are redacted before anything is written down.

04How recordings actually work

Worth stating plainly, because it is unusual and it changes where your material is. Tablecast records each participant locally, on their own device, while the session runs. That file is written to the browser's private storage (or, on iOS, to the app's own container), hashed, and uploaded to your organisation's storage in parts that resume if the connection drops. It is verified against its hash server-side before the session is treated as complete.

Two consequences. First, a participant's own device holds a copy until it is uploaded and cleared — the browser page at /local-recordings shows anybody exactly what is staged on their own machine and lets them save or discard it, with no account needed. Second, we cannot recover a local file that was never uploaded, because it was never ours.

05Where it is kept

Tablecast runs in Amazon Web Services in Sydney, Australia (ap-southeast-2). The database, the API, the session coordinator and the default object storage are all in that region, chosen so that the media plane sits near the people using it rather than a hemisphere away.

Organisations on a plan that includes data residency may nominate a home region for their stored media, which may be served from Amazon S3 or Cloudflare R2. Where an organisation does not hold that entitlement, the deployment default applies, and the system reports which of the two happened rather than silently doing something else.

Live media in a session is carried over WebRTC and may be relayed through servers outside Australia when a participant's network requires a relay to connect at all. That is transient traffic, not storage.

06Who else touches it

We keep this list short on purpose, and it is complete. Each of these is a processor acting on our instructions or, where marked, a service you have chosen to connect.

Amazon Web Services

Hosting, database, object storage, email delivery, and Cognito for authentication. Sydney region.

LiveKit

Real-time audio and video transport for live sessions, and the server-side recording fallback.

Cloudflare

TURN relay servers, which carry live media for participants whose network blocks a direct connection, and R2 object storage where an organisation's residency choice uses it.

Stripe

Card payments and subscription metering for self-serve plans. Card numbers go to Stripe directly and are never held by us.

Google and Apple

Sign-in, if you choose it, and Apple's push notification service for the iOS app. We receive an identifier and basic profile claims, not a password.

Canva and Xero

Only when your organisation connects them. Canva for importing brand assets; Xero for invoicing organisations that are billed on account rather than by card.

We do not use advertising networks, and there are no third-party trackers on this site.

07Cookies and local storage

Tablecast sets no advertising or analytics cookies. What the browser stores is functional and short: your session credentials so you stay signed in, your light or dark theme choice, and — during a recording — the media segments described above, held in the browser's private storage until they are uploaded.

08How long we keep it

• Recordings and session material: for as long as the organisation keeps them. Deleting them in the app removes them from storage; backups age out on their own schedule, within 35 days.
• Account and organisation records: while the account is open, and for a short period afterwards so that a closure can be reversed if it was a mistake.
• Diagnostic reports: 90 days.
• Server logs: 90 days.
• Billing records: seven years, because Australian tax law requires it and we are not at liberty to delete them sooner.

09Getting it back, and getting rid of it

Under the Australian Privacy Act you may ask what we hold about you, ask for it in a portable form, ask for it to be corrected, and ask for it to be deleted. Write to privacy@tablecast.studio and we will respond within 30 days.

If you appeared as a guest on somebody's show, the recording belongs to the organisation that produced it, so ask them first — they can delete it directly and immediately. If they will not, or you cannot reach them, write to us and we will act on a valid request ourselves. Your own device's copy is yours already: /local-recordings will show and discard it without involving anyone.

If you are unhappy with how we have handled a privacy matter you may complain to the Office of the Australian Information Commissioner.

10Security

• Everything is encrypted in transit, and stored media and database contents are encrypted at rest.
• Each organisation's data is isolated at the database level by row-level security keyed to the organisation, so a bug in application code cannot return another tenant's rows.
• Recordings are verified against a hash computed on the recording device, so a file that changed in transit is detected rather than quietly accepted.
• Administrative access to production systems is limited, and support access to an organisation's workspace is recorded in an audit log that the person using it cannot alter or erase.

11Children

Tablecast is a tool for producing programmes and is not directed at children. We do not knowingly create accounts for anyone under 16. People under 16 do appear in recordings — as guests on other people's shows — and that material is the producing organisation's responsibility, including any consent it needs.

12Changes

We will update this page when the product changes, and the date at the top will move with it. Where a change materially affects what we do with personal information, we will tell account holders by email rather than relying on you to notice.