Privacy Policy

Effective 13 October 2026

Sasha Slides is operated by Exponent GmbH, Switzerland ("Exponent", "we", "us"). Exponent is the controller of the personal data described here. This policy explains what we access, stores and shares when you use the website at sashaslides.com, the Sasha Slides connector for AI assistants, and the Sasha Slides add-on for Google Slides (together, the "Service").

Summary

You can sign in with Google, Apple, GitHub, an email address and password, or a passkey. Google is needed to work with your Google Slides.
Your slides and presentations stay in your own Google Drive.
On the free plan, we may use data about how you use the Service to improve it. On a paid plan, we do not use your data for that.
We do not sell your data, show ads, or use data from Google to train generalised AI models.
Everything we keep about you is encrypted with a key unique to your account. Delete your data at any time at sashaslides.com/account: we reset your key, so the old data can no longer be read.
You can revoke access at any time at myaccount.google.com/permissions.

What we access from your Google account

When you connect the Service, Google asks you to allow these permissions. Each is used only for the purpose shown.

Permission	Why we need it
`openid`	To confirm which Google account is signing in.
`email` (`https://www.googleapis.com/auth/userinfo.email`)	To show you which account is connected and to contact you about your account if needed.
`https://www.googleapis.com/auth/presentations`	To read the presentation you are working on and to insert the slide you choose into it.
`https://www.googleapis.com/auth/drive.file`	To create, read and update only the files the Service creates for you: candidate slides, their manifest and a session log, kept in a folder named Sasha Slides Inbox in your Drive. If you ask your assistant to answer a deck’s comments, also that one deck, once you choose it in Google’s file picker, to read its comments and post the replies. It does not give us access to your other Drive files.

The Google Slides add-on runs inside Google's Apps Script under your own account. It asks Google for access to your presentations and Drive so it can find the candidate slides in your Sasha Slides Inbox folder, show them in a sidebar and insert the one you pick. The add-on talks to Google's services directly and does not send your presentation content to our servers.

Signing in

You can sign in to your Sasha Slides account with Google, Apple, GitHub, or another sign-in provider we support, with an email address and password, or with a passkey. Whichever one you use, connecting your Google account is still required to read and change your Google Slides.

Google, Apple, GitHub and other providers. From the provider we receive only your account identifier and email address. If you sign in with Apple and choose to hide your email, we receive Apple's private relay address instead.
Email address and password. We store your email address and a one-way hash of your password, never the password itself. We send you emails to confirm your address and to reset your password, through Google's Gmail service.
Passkey. Your passkey's private key stays on your device or in your password manager. We store only its public key and a counter that helps detect a copied passkey.

To protect accounts from password guessing and our email from abuse, we count recent sign-in attempts and emails per internet address. These counts are kept in memory for at most a day and are not stored.

What we store

Our server stores:

The identifier and email address of each account you sign in with, the one-way hash of your password if you set one, and the public keys of your passkeys.
The access and refresh tokens Google issues for the permissions above.
A record of each AI assistant you connect (for example Claude or ChatGPT), and the sign-in tokens we issue to it. Tokens we issue are stored only as one-way hashes.
On the free plan, data about how you use the Service, as described under "Improving the Service".

All of this is encrypted with a data key that belongs to your account alone.

If you ask your assistant to answer the comments on a deck, you choose that deck once in Google’s file picker, which lets the Service reach that one file with the drive.file permission. We then read the comments on that deck with your own Google sign-in, only while a watch you started is active, pass them to your assistant, and post its replies in the thread as you, each starting with “Sasha:”. We do not read decks you have not chosen, and no shared Sasha account is involved.

The candidate slides, their manifest and the session log are saved in your own Google Drive, in the Sasha Slides Inbox folder, not on our server. You can view or delete them there at any time.

When you use the conversion tools on the website, the content you send is processed to produce the result and is not kept after the request finishes.

The website uses no analytics, advertising or tracking cookies.

How your data moves through AI assistants

You use the Service through an AI assistant that you choose and connect, such as Claude or ChatGPT. When the assistant calls a Sasha Slides tool, the result (for example, the list of your proposals or the comments on a slide) is returned to that assistant. The assistant's provider handles that information under its own privacy policy. We do not send your data to any AI provider ourselves.

Improving the Service

If you use the free plan, we may use data from your use of the Service to improve the quality of the Service. For example, we may look at which candidate slides people choose, the problems they mark on a slide, conversion errors, and how long each step takes. We use this to make Sasha Slides design better slides and convert them more faithfully.

If you are on a paid plan, we do not use your data to improve the Service. We use it only to provide the Service to you.

On every plan, data received through Google APIs is used only to provide and improve Sasha Slides' own features. It is never used to develop, improve or train generalised AI or machine learning models, and it is never sold.

How we use and share data

We use Google user data to provide the features you request (designing candidate slides, showing them to you, and inserting the slide you choose) and, on the free plan, to improve those features as described above.
We do not sell Google user data, and we do not use or transfer it for advertising, credit decisions, or to train or improve general AI or machine learning models.
We do not allow people to read your data, except with your explicit permission, when needed for security (for example, investigating abuse), to comply with the law, or when the data has been aggregated and anonymised for internal operations.
We share data with service providers only as needed to run the Service, such as the company that hosts our server and Google, which delivers the emails we send you, and with authorities when the law requires it.

Sasha Slides' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting your data

We keep your account data while your account exists.
Delete your data yourself at sashaslides.com/account. Sign in, then choose "Reset my key and delete my data". We revoke our access to your Google account, delete your records, and reset your account's encryption key. Because every copy of your data, including copies in backups, was encrypted with the old key, none of it can be read again. You can keep using Sasha Slides afterwards; you start with a new key and no history.
To disconnect without deleting, remove Sasha Slides at myaccount.google.com/permissions and remove the connector from your AI assistant. Revoked tokens stop working immediately.
You can also email us at the address below to delete your data. We do it within 30 days.
Files in your Sasha Slides Inbox folder are yours. Delete them in Google Drive whenever you like.

Security

All traffic to the Service uses HTTPS. Data about you is stored on a server we operate, encrypted with your account's own key, and the account keys are themselves encrypted with a master key that is kept separately. Tokens we issue to AI assistants are stored only as hashes. No system is perfectly secure, and we will tell affected users promptly if we learn of a breach that affects their data.

Children

The Service is not intended for children under 16, and we do not knowingly collect their data.

Your rights

Depending on where you live, for example under the Swiss Federal Act on Data Protection or the EU General Data Protection Regulation, you may have the right to access, correct, export or delete your personal data, or to object to how it is used. Email us to exercise any of these rights.

Changes to this policy

We may change this policy at any time. When we do, we will post the updated policy on this page and change the date at the top. Changes take effect when they are posted. If you continue to use the Service after a change takes effect, you accept and agree to the updated policy. If you do not agree, stop using the Service and revoke its access as described above.

If a change would let us use data we already hold in a materially different way, we will ask for your consent first where the law or Google's API Services User Data Policy requires it.

Contact

Questions or requests about privacy: sasha.slides@exponent.company. Postal address:

Exponent GmbH
Sihleggstrasse 23
8832 Wollerau
Switzerland
Company number CHE-257.333.635