Help & Support
Privacy & Security
You are working with recordings of minors. This page says exactly what the app does with them, in enough detail that you can answer a parent, a coach, or a tournament director who asks. Where we do not do something, it says that too.
The short version
- The app never stores audio. Speech is transcribed and the text is kept; there is no audio file anywhere in your account.
- Student and school names are replaced with tokens before any transcript is sent to an AI model, and the encrypted names never leave our database.
- Only you can open your rounds. There is no sharing, no student login, and no tournament-director view.
- Deleting a round deletes everything attached to it, permanently and immediately.
- Speech audio does go to our transcription provider with real names still spoken in it. That is the one place where a name leaves us unmasked; we tell them not to train on it, and it is covered below.
Consent
You cannot start a round without ticking "I have permission to record this round". The button that starts the round stays greyed out until you do, and no round is created without it.
We never tick it for you. When a round's details come from your Tabroom assignment, the names arrive filled in and that box does not.
What gets stored with the round is the fact of consent, the date, and your account email as the person who recorded giving it. There is one tick box, and it covers recording, transcription and AI analysis together.
What the app cannot do is obtain that permission for you. Ask both teams out loud before the round. Something like:
"Both teams, do you consent to having this round recorded so I can judge it? The audio is not saved - it is turned into text and the recording is gone."
If either team objects, do not record. You can judge the round without the app, or take notes in it without recording.
The audio
When you press Start, your browser records the speech. When you press Stop, that recording is sent to DebateFlow, and DebateFlow passes it to Deepgram, our transcription provider, which returns the text.
We never store the audio. There is no audio file in the database and no field to hold one - the column that used to exist was removed. The recording exists in your browser's memory and in the memory of the server handling that one request, and then it is gone. What is kept is the transcript.
One exception worth knowing: if a transcription fails, your browser holds onto that speech in memory so you can retry it. It is released when you retry or when you leave the page, and it is never written to disk or sent anywhere else.
Names are spoken in the audio
Debaters say each other's names out loud, and the audio goes to Deepgram exactly as recorded. We deliberately do not use Deepgram's automatic redaction, because it strips the countries, organisations and events that debate rounds are about and leaves the transcript unusable.
So Deepgram is the one place a real name leaves us unmasked. What we can control there, we do: every request tells Deepgram not to use the audio to train its models, which under their terms limits how long they keep it to the life of the request. That is a setting we send on each call, not a promise about their infrastructure - the rest is governed by their privacy policy. If that matters to your tournament, it is the fact to give them.
Names, and what the AI model sees
Every round gets a set of identity tokens: one per team, one per speaker, one for the tournament. The real name is encrypted with AES-256-GCM and stored; the token is a short random string like TEAM_A_x9k2m.
Before a transcript, your notes, or any analysis is sent to Anthropic's Claude, every name in it is swapped for its token. The model reads "SPEAKER_A1_k9x2m argued that TEAM_A_x9k2m has the better case". On the way back, the tokens are swapped for real names so that you see the round you actually judged.
Two details matter more than they sound:
It fails closed. If a name in a round has no token behind it, the analysis stops with an error rather than sending the name. An earlier version passed the untokenized name through, which is exactly the thing the token system exists to prevent. You may occasionally see an analysis fail for this reason. That is the safe direction.
Editing a name keeps its token. If you correct a spelling after the round has started, the tokens are brought back in line before anything is sent - in the same operation as the edit, and again before each analysis run. The role keeps the token it already had, so a token already written into stored analysis still resolves, now to the corrected name.
What is encrypted
Student and school names. AES-256-GCM, with a key held only on the server and a version recorded on each record so keys can be rotated. Decryption happens server-side only; the key never reaches your browser.
Your Tabroom password. Same algorithm, a separate key. It has to be reversible rather than hashed, because the app logs into Tabroom as you to fetch your assignments - which means your Tabroom password is sent to tabroom.com each time it does. If that is not a trade you want, do not connect Tabroom; every other part of the app works without it.
Everything in transit. HTTPS, to us and to every service we call.
We do not make claims here about database encryption at rest or about backups, because those are properties of our hosting providers rather than of anything in our code, and we would rather say nothing than say something we cannot show you.
Who can see a round
You. That is the whole list.
There is no sharing feature in DebateFlow: no share links, no public rounds, no team or school accounts, no student login, no tournament-director view. Every request for a round checks that you are signed in and that the round is yours, and a round belonging to someone else returns "not found" rather than "not allowed", so the app will not even confirm that it exists.
Other judges cannot see your rounds. Students cannot. Tournament directors see only what you put on a Tabroom ballot.
Signing in
DebateFlow does not handle a password of yours. Sign-in is either Google, or a sign-in link sent to your email address. Accounts are managed by Stack Auth, which holds your email address, your display name, and your session.
Tabroom
The Tabroom integration is one-directional: it reads.
It signs into Tabroom as you, fetches your judging assignments and the ballot details, and uses them to pre-fill a new round with the right team and speaker names. It never writes anything back to Tabroom.
When your ballot is ready, you press Preview for Tabroom and get copy buttons - the whole ballot, or the reason for decision and each team's feedback separately. You paste it into Tabroom yourself. Nothing is submitted on your behalf, which means nothing reaches a tournament until you decide it should.
Analytics and error reporting
Two services see activity in the app. We would rather describe them accurately than describe them flatteringly.
PostHog records which features you use, so we can tell what is working. Your account email address and display name are attached to your profile there, and a few events carry a team, school or tournament name - for example, which team's feedback you generated. Individual student names are not sent. Transcripts, notes, decisions, reasons for decision and feedback text are not sent.
Sentry records errors so we can fix them. It is configured to strip the things that would identify a round: your user id, request bodies, query strings, and named fields including transcripts and team names. It runs in production only.
If you would rather not be in the analytics at all, tell us through the contact form and we will talk about what is possible. There is not a switch in the app today.
Companies that handle your data
| Service | What it receives |
|---|---|
| Deepgram | Speech audio, for transcription, with real names spoken. Sent with model training opted out |
| Anthropic (Claude) | Transcripts, your notes and analysis, with names replaced by tokens |
| Stack Auth | Your email, name and session |
| Neon | The database: rounds, transcripts, notes, decisions, encrypted names |
| Vercel | Hosting, so all application traffic |
| Upstash | Rate-limiting counters, keyed by your user id |
| PostHog | Product analytics, as described above |
| Sentry | Error reports, redacted as described above |
| Resend | Email delivery, when you use the contact form or a beta invite |
| Gravatar | An MD5 hash of your email address, to fetch your avatar |
| Google reCAPTCHA | Contact-form submissions, for spam protection |
Each of these is a company with its own privacy policy, and none of them is a party to anything you agreed with us.
Deleting things
A round. Delete it from your dashboard. It is gone immediately and permanently - no archive, no soft delete, no recycle bin. Everything attached goes with it: the transcript, your notes, your reactions, the arguments you flagged, every piece of analysis, the decision, the feedback, and the encrypted name records for that round.
Your account. There is no self-serve account deletion in the app today. Ask us through the contact form and we will do it.
Getting your data out. You can download a single round's ballot as a text file from the ballot screen. There is no account-wide export. If you need one, ask.
What we do not have yet
This is an early product, and some things a mature privacy page would promise do not exist here yet: no account deletion button, no data export, no analytics opt-out switch, no published retention schedule. Rounds are kept until you delete them.
We would rather list the gaps than imply they are filled.
For tournament directors
Tournament directors cannot see judge notes, reactions, transcripts or draft feedback. There is no mechanism by which they could. They see what a judge submits on a Tabroom ballot, the same as for any other judge.
A tournament can encourage judges to use DebateFlow, but a judge should always be able to judge without it. What DebateFlow does during a round is written to be shown to an official who asks.
Questions, and reporting a problem
Use the contact form. If you have found a security problem, say so in the message and we will treat it as a priority. Please do not test it against another user's data, and give us a chance to fix it before you publish it.
If something on this page is unclear or looks wrong, that is worth telling us too. It is meant to be checkable.
What's next?
- What DebateFlow does during a round - the page to show a tournament official
- Recording Your Round - what is captured, speech by speech
- Settings - the Tabroom connection and the in-round analysis switch
- FAQ - common questions about data handling
Last updated: 20 September 2026