We keep as little as Outwork needs to work.

Who we are

Outwork is run from the United Kingdom, and we decide what happens to the data described here (we’re the “controller”). Write to hello@outwork.tech about anything on this page. The UK GDPR applies to us, and the EU GDPR does for people in the EU and EEA. Our EU representative is to be appointed before any area in the EU has seats updated live; until then, write to the address above.

If you look for a seat

Outwork runs in your browser at outwork.tech/app. There’s nothing to download, and looking needs no account.

Location. If you choose to share your location, your browser asks first. It goes to our server to find the areas near you, for that one answer. Our code doesn’t log it, and saves it in one case only.

That case is where Outwork has nothing near you. We round your location to about a kilometre, ask Photon (a map service) which town that is, and keep the rounded location with the town’s name and the date, so we don’t have to ask twice. Nothing kept with it says whose it was.

Railway, which hosts the site, keeps routine request logs for a limited time. Those can include the web addresses (URLs) your browser asks for, with the location in them.

Outwork badges on other websites. Some places show an Outwork badge on their own website, with their laptop hours as they are now. When you open such a page, your browser fetches the badge’s picture from our server. We draw it from the place and the language in its web address and keep nothing about the request; Railway’s request logs see it like any other. Following the badge brings you to the place’s page on Outwork, and that visit is counted like any other (see below), marked as coming from a badge.

On the search page we round your location to about 100 metres and put it in the page’s web address, so it also stays in your browser’s history, like any other page.

Postcodes and places. If you type a postcode or a place instead, it goes in the page’s web address the same way. We look first in what Outwork already holds: the cities, areas and places on it. If it isn’t there, we ask postcodes.io where a UK postcode is, and Photon (run by komoot, on OpenStreetMap data) where anything else is.

Suggestions as you type. The search box suggests places while you type. What you’ve typed so far goes to our server, which answers from what it already holds and asks Photon for more: Photon hears from our server, never from your browser. Choosing a suggestion puts its location, rounded to about 100 metres, and its name in the page’s web address.

What we keep of a search. So we don’t have to ask about the same place twice, we keep the answers from Photon and postcodes.io in our database. A kept answer holds:

• the text that was searched for (lower-cased and tidied, at most 80 characters);
• the country, and the city on Outwork, that the search favoured;
• a language;
• the answer itself;
• the date it was fetched and a count of how often it has been reused.

When we ask which town a location is in, the kept answer is the rounded location and the town.

Nothing about who typed it is kept with it: no IP address (the number that identifies your internet connection), no account, no session, and no time beyond that date. An answer is refreshed after 90 days and deleted after 365; “nothing found” is kept for up to 2 days.

A search is only kept if it is made of letters, digits and the punctuation that addresses use. Anything else, an email address for example, is never kept. Our code doesn’t log what you type; Railway’s request logs can include it, as with a location.

Your country, roughly. Before you’ve said where you are, we show the city we cover in your country, and we put matches in your country first when you search. We guess the country from your browser’s time zone (Europe/Zagreb means Croatia) or, failing that, its language setting. Your browser sends the time zone in the page’s web address or with the search. We use it for that one answer and don’t store it, and we don’t use your IP address to find you.

If you send a seat update

An account. To tell other people how busy a place is, you sign in with your email address. We email you a link; there’s no password. We store the email address, when the account was made and when it was last used. We don’t ask for anything else.

Sign-in links and sessions. A sign-in link lasts 20 minutes. We keep a scrambled copy of it, which can’t be turned back into the link, and the email address it was sent to. Signing in sets one cookie that keeps you signed in on that browser. It lasts 90 days from when you last used Outwork. We keep a scrambled copy of that too, never the value itself.

Seat updates. When you send one, we store the place, what you chose (seats, and noise, plugs and wifi speed if you add them), the time, and a key that stands for your account. Other people see the update, not who sent it. The key lets us limit how often one account sends updates and give less weight to updates that turn out wrong. Your updates do show us which places you sent them from, and when.

The wifi test. If you choose to test the wifi, your browser downloads a 5 MB file from Cloudflare and times it. Cloudflare sees your IP address, as any site you visit does. We send it no cookies and nothing about you or the place.

Location when you send an update. If your browser shares your location with an update, we use it to check you’re near the place. We store only the distance between you and the place, never the location itself. So the only record of where you’ve been is the list of places you sent updates from.

Deleting your account. In the app, open Account and delete it. We erase your email address, sign you out everywhere and remove your sign-in links. Your past updates and votes stay, because they make the “usually frees up around 14:00” patterns, but with the email gone nothing in them points to you. Sign in with the same address later and you get a new, separate account. You can also email hello@outwork.tech and we’ll do it.

If you vote on a place or add your city

Laptop votes. The app asks “Are laptops fine here?”. Answering needs an account or the Outwork card on a place’s table. Your answer is stored with the place, the time and the key that stands for your account, so each person counts once per place and can change their mind. If you answer from a card, a scrambled copy of the code printed on it stands in for the key. If a location comes with the vote, we use it only to check you’re near the place, and don’t store it.

Adding a city. When you tap “Add this city to Outwork”, we round your location to about a kilometre, ask Photon which town that is, and add the town so we can look for its places. We keep the town and nothing about you: not the location, not your account, not your IP address. You don’t need an account.

Counting interest in a place

When a place is shown in a list, opened, or someone taps Directions, we add one to that place’s count for the day. That’s all: a number per place per day, with nothing about who. We use the totals to tell owners that people are looking for them.

How we count visits

We count page views ourselves, on our own server. Nothing is loaded from an analytics company or sent to one. Counting sets no cookies and stores nothing in your browser.

What we keep. When a page opens, your browser tells our server which page it was. We keep the kind of page (and, for a place’s page, which place), the time to the minute, the name of the site that linked you here if there was one (“google.com”, never the page on it), campaign tags on the link you followed (utm_source, utm_medium, utm_campaign, ref), whether it was a phone, a tablet or a computer, and the browser family, like Safari or Chrome. In the web app we also count four steps: opening “Say how busy it is”, sending an update, asking for a sign-in link and signing in. Each is the step’s name and nothing else: not what you sent, and not your account.

What we don’t. We never keep the page’s full address, so a sign-in link, a search or a location in it isn’t stored with the visit. We don’t keep your IP address or your browser’s full description, and we don’t look up where you are from them.

Counting people, not just pages. To tell ten visits by one person from ten people, we scramble your IP address and your browser’s description together with a random key, and keep only the result. The key changes every day and we delete the old one, so the result is different tomorrow: nobody, including us, can follow you from one day to the next or work back to you.

Opting out. If your browser sends Do Not Track or Global Privacy Control, we don’t count you at all. We delete visit counts after 400 days, about 13 months.

Where places come from

Most places start as public listings from OpenStreetMap (© OpenStreetMap contributors): the business’s name, address, opening hours, website and tags like “wifi”. We use them to guess whether laptops are welcome, and say so in the app. These are listings of businesses, not people.

Run one of them? Open it on Outwork and tap Run this place?, or go to outwork.tech/venue/claim/ followed by the place’s code. You can claim it and set your own laptop hours, or remove it from Outwork straight away. For removals we keep your email, your reason if you give one, and when you asked, so it stays off. You can also just email hello@outwork.tech.

If you scan the Outwork card on a table

The card opens a page in your browser. You can say how busy the place is without an account. Answering sends only the seats answer you tap and the code printed on the card. No location, no account, no cookies. Opening the page is counted like any other (see How we count visits).

If you test the iPhone app

There’s an iPhone app that isn’t released. If you use a test build, it sends updates without an account. Each one is signed with a key made on your phone by App Attest, an Apple service. The key isn’t linked to you or your Apple ID. If you turn on the lock-screen display, your phone gives us a push token, which is an address for sending notifications to that phone. We delete it once the display has ended. To delete what we hold, open Settings in the app and tap Delete my data, as on Android.

If you use the Android app

The Android app sends updates without an account. It makes a random key when you first open it and sends that key with each update, so we can apply the same limits as for anyone else. The key isn’t linked to you or your Google account. Your location is used as on the web: the app asks first, uses it to find places near you, and with an update we keep only your distance from the place, never the location. If you type a place instead, it stays on your phone. Your visit, your answers and the place you typed are kept on your phone only, and are left out of phone backups. Notifications (where you are, and a nudge before laptop hours end) are made on your phone; we don’t send them and don’t hold a push address. “Walk there” opens Google Maps, which has its own privacy policy. To delete what we hold, open Settings in the app and tap Delete my data: we drop the key, and your updates and answers stay with nothing in them that points to you.

If you suggest a place

We keep the place’s name, the area and your note, so we can go and ask them. Your email only if you give it, and only to tell you when that place is on Outwork. To stop spam we also keep a scrambled copy of your IP address, never the address itself.

If you say something’s wrong with a place

We keep the place, what you said was wrong, your note if you add one, and the time, so someone at Outwork can look. With it goes the key that stands for your account or phone, or, without either, a scrambled copy of your IP address, never the address itself. That lets us count each person once and stop spam. If you delete your account or your data in the app, nothing in the report points to you any more.

If you run a place

You give us an email address so we can send you sign-in links, and the details you choose to publish: the place’s name, address, laptop hours and your rule for laptop workers. Those details are public on Outwork. Signing in sets one cookie that keeps you signed in on that browser. If you add a place we don’t have, we look up its address with postcodes.io (UK postcodes) or Photon, falling back to Geoapify if Photon can’t answer. The address box suggests addresses as you type, through our server in the same way as the search box, with what was typed and Photon’s answer kept in the same way, and the form starts on the country your browser’s time zone or language points to.

We don’t send venues marketing emails. If we think you’d like Outwork, one of us comes in, or leaves a flyer.

Stopping abuse

We limit how often sign-in links, setup, removals, votes, suggestions and the interest counts can be used. For that we note your IP address against the request for up to a day, then delete it. Suggestions as you type are limited too: those are counted in memory for a minute, against a scrambled copy of the address, and never written down.

Why we’re allowed to

• Seat updates, the keys on them, votes, interest counts, visit counts, rate limits and public listings: our legitimate interest in running a useful, honest map of where to work, weighed against yours.
• Your account email, sign-in links and sessions: to provide the account you asked for (a contract).
• Owner emails and listings: to provide the service you signed up for (a contract).
• Location: only when you turn it on in your browser.

How long we keep things

• Your account email: until you delete your account. Then it’s erased.
• Sign-in links: usable once, for 20 minutes. We delete them a day after they’re used or expire. Sessions: 90 days from when you last used Outwork. Both go when you delete your account.
• Seat updates: kept, because they make the “usually frees up around 14:00” patterns. Each one holds the place, what you said, the time, the distance and a key. While you have an account, the key links them to it. After you delete it, nothing in them points to you.
• Owner emails: for as long as the listing is yours. Ask and we’ll delete it.
• Laptop votes: kept while they’re useful; they hold a key or a scrambled copy, never a name.
• Interest counts: kept. They’re numbers per place per day.
• Visit counts: 400 days. The key that scrambles them lasts a day.
• Place searches: the text searched for and the map service’s answer, up to 365 days, with nothing about who searched.
• Removal requests: kept, so a removed listing stays removed.

Who else handles it

• Railway, which hosts the servers and database in its EU region.
• Resend, which sends sign-in links to people with accounts, and sign-in, print-file and removal emails to owners.
• postcodes.io, which turns a UK postcode into a place on the map.
• Cloudflare, only if you run the wifi test: your browser fetches its speed test file.
• Apple, for App Attest and push notifications, only for the iPhone test app.
• Google, only in the Android app: its built-in location and address lookup (Android’s geocoder) turns your location into a place name and the place you type into a point on the map.
• Photon, run by komoot on OpenStreetMap data, which turns other places and addresses into points on the map, suggests places as you type, and turns points into town names. Geoapify, only when Photon can’t answer.

Resend, Cloudflare, Apple and Google are based in the United States, so what they handle for us leaves the UK and EU under their data processing terms.

We don’t sell data, show ads, or use advertising trackers or anyone else’s analytics anywhere on Outwork. We count visits ourselves, as described above.

Your rights

You can ask what we hold about you, ask us to correct it, or ask us to delete it. If you have an account, you can delete it yourself under Account, or ask us to. Without an account, the updates and votes we keep can’t be traced back to you. You can also object to what we do on legitimate interests, and ask us to restrict it. If you’re not happy with how we handle something, you can complain to the Information Commissioner’s Office at ico.org.uk, or, in the EU and EEA, to the data protection authority where you live.