Writeroom subprocessors
Version 1.4, effective October 31, 2026.
A subprocessor is a company that processes personal information on Writeroom's behalf so that we can run the Service. This page lists every one, what it does, what personal information it handles, where, and the safeguards in place. It is the list referred to in our Privacy Policy and in Annex 3 of the Student Data Protection Addendum.
Writeroom stores student work and writing-process records in Canada (Toronto). The items below marked "United States" or "global" are the only processing of personal information outside Canada.
How we choose and oversee subprocessors
- We use a subprocessor only where it is needed to provide the Service, and we send it the minimum information the task needs.
- Each subprocessor we contract with directly (Google, OpenRouter) is bound by written terms that require it to protect the information and use it only to provide its service to us. The AI model vendors are reached only through OpenRouter; Writeroom has no direct contract with them, so the protection is the routing settings described below, which allow only endpoints the vendor has designated as zero data retention and no training, together with OpenRouter's agreements with those vendors.
- Writeroom stays responsible to Schools for its subprocessors as if their actions were its own.
- Writeroom uses no email delivery service. The only emails the Service sends are Firebase Authentication's own account emails (see the Google row below). Invitations are not emailed: a School administrator copies an invitation link and shares it. Alerts and contact-form messages appear inside the Service only. If Writeroom later uses an email delivery service, it will be added to this list with the usual notice.
Current subprocessors
| Subprocessor | Purpose | Personal information handled | Location of processing | Safeguards |
|---|---|---|---|---|
| Google LLC and Google Cloud Canada Corporation (Google Cloud and Firebase) | Hosting and running the Writeroom app (Cloud Run), the database (Firestore), file storage (Cloud Storage), secrets (Secret Manager), logging and monitoring (Cloud Logging and Monitoring), backups | All Customer Data: accounts, documents, writing-process records, screen clips, Integrity Signals, audit logs, security logs | Canada (Toronto, northamerica-northeast2) | Google Cloud terms and Data Processing Addendum; encryption at rest and in transit by default; data location set to Toronto; direct client access to the database and files denied; least-privilege service account |
| Google LLC (Firebase Authentication) | Sign-in with Google or email and password, and account emails such as email verification, password reset and sign-in emails | Name, email address, Google account identifier (Google sign-in) or hashed password (email sign-in), sign-in timestamps; account emails contain the recipient's email address, a link and the Writeroom name | United States | Google Cloud terms and Data Processing Addendum; Firebase Authentication is a global service and does not offer a Canadian region |
| Google LLC (Google Identity Services) | The "Sign in with Google" button on the sign-in page | The fact of the visit to the sign-in page; Google account details you choose to sign in with | Global (Google) | Google's privacy policy; Writeroom's use of Google account information adheres to the Google API Services User Data Policy, including the Limited Use requirements |
| Google LLC (Firebase Hosting) | Serving the public website writeroom.org | Visitor IP address, browser type, pages requested, time (standard server records held by Google); no Customer Data is on the website | Global content delivery network | Google Cloud terms; no analytics or tracking added by Writeroom |
| OpenRouter, Inc. | Routing requests for external AI features (AI marking, Translate, Dictionary, teacher assistant). Used only while external AI is on for the School (on when a School starts; a School administrator can turn it off). | The text described in the Privacy Policy section 6: assignment instructions and rubric, document text, selected text or words, the teacher's question and name and the facts the assistant needs; students referred to as "Student 1, Student 2"; Writeroom adds no student names, email addresses or user identifiers (a name a student typed into their own work may be in the text). OpenRouter stores request metadata (token counts, latency), not content | United States | OpenRouter terms and privacy policy; every request sent with data_collection: "deny" and zdr: true so that it can be routed only to endpoints that do not retain or train on the content; OpenRouter prompt logging not enabled; request fails rather than falls back if no compliant endpoint is available |
| Anthropic PBC (the Smart and Super smart levels; Smart is also used by the teacher assistant), served through a zero-retention endpoint chosen by OpenRouter, as of October 2026 Amazon Bedrock (Amazon Web Services) (engaged through OpenRouter; no direct contract with Writeroom) | Serves the AI model that answers an external AI request routed by OpenRouter. Used only while external AI is on for the School and a teacher or student uses the feature | Same text as the OpenRouter row | United States | Served only through OpenRouter endpoints designated zero data retention and no training; vendor API terms forbid training on customer data |
| OpenAI (the Fast level, the default for marking; a small model for Translate and Dictionary), served through a zero-retention endpoint chosen by OpenRouter, as of October 2026 Microsoft Azure | As above | As above | United States | As above |
Notes on the model vendors: Writeroom maintains an allowlist of models. For marking a teacher picks Fast, Smart or Super smart, and the School administrator sets the default; Translate and Dictionary use a small model; the teacher assistant uses Smart. Each of these was checked on October 27, 2026 with real requests sent with no data collection and zero data retention. The allowlist holds only models served by providers that do not train on API data and that support zero data retention through OpenRouter. This page is updated whenever the allowlist changes.
Services that are not subprocessors
- Hugging Face: Writeroom downloads the AI-detector model once at setup. No user data is sent to Hugging Face. The detector runs on Writeroom's own servers in Toronto.
- Google Classroom and Google Drive: the Chrome extension reads a Classroom assignment page and exports attached Google Docs in the teacher's own browser, using the teacher's own Google account. Writeroom's servers make no calls to Classroom or Drive and do not read rosters.
- Browser speech recognition: voice typing uses the speech recognition built into the student's browser. Writeroom receives and stores only the resulting words. In Google Chrome, the browser may send audio to Google's speech service under Google's terms; this is a browser function, not a Writeroom subprocessor.
- Third-party websites: when a user inserts an image by web address, each viewer's browser loads it from that site. Writeroom does not send personal information to that site.
Changes to this list
- We give Schools at least 30 days' notice by email to their administrators and the School Privacy Contact before a new subprocessor processes Customer Data, or before an existing subprocessor's role materially changes. The notice names the subprocessor, its purpose, the information involved and its location.
- Shorter notice is given only where a change is urgently needed to protect the security or availability of the Service, and we explain why.
- A School may object on reasonable data protection grounds within the notice period, as its Student Data Protection Addendum sets out.
- Removing a subprocessor, or narrowing what one receives, is posted here without advance notice.
- Earlier versions of this page are available on request through the contact form at writeroom.org/contact (topic: Privacy).
Last updated: October 27, 2026. Questions and objections: the contact form at writeroom.org/contact (topic: Privacy).