Your work is yours, and we keep very little.

This site is meant to know as little about you as it can while still letting a cohort learn together, so the rule it is built by is that your work stays in your own GitHub account and Human Shaped keeps only what a cohort needs in order to run. This page says exactly what that is, who can see each part, and when it goes away. It covers humanshaped.org (sign-in, cohorts, and live sessions) and the Human Shaped add-on for Google Meet.

Nothing here is sold, used for advertising, or used to train an AI model, and the site has no analytics, no tracking pixels, and no advertising cookies.

Signing in is done with your GitHub account. From GitHub, Human Shaped keeps your GitHub username, its number, your display name, and the address of your profile picture, and these are what other people in your cohort see. Supabase, the service that runs our sign-in and database, also keeps the email address GitHub gives it, which no page on this site shows to anyone.

GitHub also gives your browser a token so that pages like your cohort page can read and post to your cohort's discussions as you. That token is kept only in your browser, for as long as the tab is open (in what browsers call session storage), it is sent only to GitHub, the pages stop using it after seven and a half hours, and it is never saved in our database. You can take away the site's access to your GitHub account at any time in GitHub's settings, under Applications.

You can also sign in with your Google account, on this site and in the add-on for Google Meet, where Google asks that add-ons offer it. Google then shares your name, your email address, and your profile picture (the scopes called userinfo.profile and userinfo.email, with openid), and nothing else from your Google account. Human Shaped uses the email address to find or make your account and to know which cohorts you take part in or lead, and the name and picture to show who is signed in, to you and to the people in your cohort. They are kept with your account until you unlink Google on your account page or delete your account.

Human Shaped's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, never shared beyond what this page describes, and never used to develop, improve, or train any AI or machine-learning model.

Everything below is stored in a Supabase database in the United States, and the rules about who can read each part are enforced by the database itself rather than by the pages.

• Which cohorts you are in, your role, and, if you add them, your app's name, repository, and address. Everyone in the cohort can see these.
• Your group, and where your group is in its turns during a live session. Everyone in the cohort can see these.
• What you choose to share with a cohort (a bring-back, a link, a question, or a request for feedback), and the feedback people write on it. Everyone in the cohort can see these.
• An email address for calendar invitations, only if you give one, for one cohort. Only you and that cohort's teachers can see it.
• Your answers to a check for understanding during a live session. Only you and your leaders see them, a leader may show the room an anonymous count, and they are never graded.
• Notes your leaders send you. Only you and the cohort's teachers can read them, the leader who wrote one can correct its words (and you will see that it was edited), and you can remove any of them.
• The session's shared drawing board and its "show your work" queue, which everyone in the cohort can see.
• Whether you have been added to the cohort's private conversation on GitHub, which only you and your leaders can see.
• Your credential, if you earn one at the end of a cohort. Only you and your leaders can see its record here, and its public page shows it only to someone who has its link.
• A request to lead, if you make one, which only you and the people who decide on requests can read.
• Your own marks on the stages: the steps you marked done, whether you marked a stage ready or not yet, and any note you kept of what you would bring back. Only you can read them (and your own AI agent, if you connect one), and nothing counts or compares them. If you mark stages while signed out, the marks stay in that browser alone, and they move into your account the next time you sign in there.
• Your own app, if you add one on your account page for building outside any cohort: its repository, its name, where it runs, and whether you chose to show it. Until you show it, only you can read it. Once shown, the apps page shows those three things and never who you are, and the people who approve leaders can see that it is yours so they can keep it off the page if it is unsafe, which you would see on your account page with their reason. Taking it off Human Shaped, or deleting your account, removes it.
• How your leaders may reach you, only if you choose it on your account page: an address, whether your leaders may email you from their own email (then the leaders of cohorts you are in can see that address), and whether you would like a short email from meet@humanshaped.org when a leader writes you a note, someone answers what you shared, or a video comes in on an exchange you started or answers one of yours. That email says only that something is waiting, never the words, the videos, or who sent them. No AI agent can read the address, and you can turn either choice off or forget the address at any time.

Your app appears on the public apps page only if you switch it on yourself, and a leader can keep an app off that page without changing your choice. Your code, your commits, and your app are never copied here: pages read them live from GitHub while you look.

When a cohort is marked finished, its live-session queue, checks and answers, signals, drawing boards, and room turns are deleted. Notes from your leaders stay, because they are yours, until you remove them.

When you leave a cohort, what you shared there (and the feedback on it), your place in its queue, your answers, your group, your calendar email, and your app's details are deleted. Notes from your leaders stay on your account page until you remove them, and feedback you wrote on someone else's work stays with their work.

When you delete your account on your account page, everything Human Shaped holds about you is deleted with it, including your notes, your answers, what you shared, the feedback you wrote, and your credential's record. A drawing you added to a shared board stays on that board, without your name, until the cohort finishes.

Before a cohort forms, a leader may send you a link to a poll of weekly times. You can answer it without an account. It keeps the name you give, the times you mark, and, only if you add them, an email address and a note. Only the leader who made the poll (and the other leaders of its cohort) can see your name, email, and note; anyone else who answers sees only how many people can make each time. Your browser keeps a private key to your answer, so you can change it or take it back, and the leader can remove it. Deleting the poll deletes every answer.

If you choose to check your Google Calendar on that page, Google gives the page only the times you are busy over the cohort's first four weeks (never what your events are) and that account's email address, so the page can name each calendar you add. That check happens in your browser, the page lets go of Google's permission as soon as it has read them, and nothing from your calendar is saved or sent to anyone.

An exchange is a thread of short videos. When you add one, it is recorded in your browser and saved straight into your own Google Drive, in a folder called Human Shaped exchanges, and shared so that anyone with its link can watch it. This site asks Google only for permission to work with the files it makes for you, never the rest of your Drive, and the video never passes through humanshaped.org. Human Shaped keeps the video's Drive address, its length, any words you add, who posted it, and when.

An exchange inside a cohort can be seen only by that cohort, one for Human Shaped members only by members, and any other by anyone with its link. Adding a video needs an account, so you can find your exchanges again on your account page. You can take your video out of an exchange at any time, and so can the exchange's maker; the file stays in your Drive until you delete it there. Deleting an exchange removes it from Human Shaped, but not the videos in anyone's Drive.

When you react to a video, Human Shaped keeps which reaction you chose and when, and shows it beside the video with your name to everyone who can watch the exchange. Press the reaction again to take it back. Reactions in a live session are never kept; these are, so the person who posted the video sees them later.

You can connect your own Claude or Gemini to Human Shaped so that it can read your cohort's work with you. It asks for your permission on our consent page first, it can only read (it can never write, post, join, leave, or delete anything), and it sees only what you can see. What it reads then goes to the company that runs your agent, under your own account with them, so their privacy policy applies to that part.

Live sessions happen on Google Meet, and Google's own privacy policy covers the call. Beyond Google sign-in (above), the Human Shaped add-on for Meet asks Google for no permissions, and the only thing it reads from Meet is the call's meeting code, which it uses to find the cohort or group the call belongs to. It does not transcribe, measure who talks, or join the call as a participant, and it never reads your Google Drive, Calendar, Gmail, contacts, or files.

A session is recorded only when its leader opens Human Shaped's recorder from the add-on and starts it, after saying so out loud and in the chat, and everyone in the session sees that it is recording until it stops. The recording is saved on the leader's computer and in Human Shaped's Google Drive, shared so that anyone with its link can watch it, and that link appears only on the session's page, which only the cohort and its leaders can open. When a host sends calendar invitations, they go through Google Calendar from the host's account, to the email you gave for that purpose.

The site itself is served by GitHub Pages, Human Shaped runs on Supabase, sign-in and conversations use GitHub, and sessions use Google Meet. Pages load the Commissioner typeface from Google Fonts and a few open-source scripts from cdnjs and jsDelivr, which, like any website, see your browser's address when it asks for them. Each of these has its own privacy policy, and none of them receives anything from us beyond what this page describes.

Your browser also keeps a few things on your own device: your sign-in, your choice of light or dark, short-lived copies of what GitHub returned (so a page does not ask twice), and, for leaders, unsent drafts of follow-ups, which never leave the leader's browser.

If you have a question, or you want something removed that you cannot remove yourself, write to meet@humanshaped.org or ask in the discussions on GitHub. If this page changes, the change will be dated here and visible in the site's public history on GitHub.

Last changed October 3, 2026.