Headroom is run by Kaleidoscope LLC, a California company. If you want anything on this page acted on — a copy of your data, a correction, or deletion — there is a form further down this page and a person on the other end of it. Under data protection law that makes Kaleidoscope LLC the “controller” of the information described below.
If you sign up for a free sample class
The form asks for your first name and your email address. They go into a private spreadsheet, and they are used for one thing: emailing you about Headroom classes. No one else gets that list, it is not sold, rented, or swapped, and there is no third-party mailing service in the middle of it.
The legal basis is your consent, given by submitting the form. You can withdraw it at any time by replying to any email, or through the form below, and your details are deleted. Withdrawing does not undo emails already sent. Otherwise the list is kept until you ask to come off it or until Headroom stops running, whichever comes first.
If you just read the site
Visits are counted with Fathom Analytics, which is here specifically because it does not set cookies, does not build a profile of you, and cannot follow you to other sites. What it produces is a count: how many people read a page, roughly where in the world they were, and which link they arrived from. None of that identifies you, and the legal basis is a legitimate interest in knowing whether anything on this site is being read.
The site is hosted by GitHub Pages and the videos are served by Cloudflare. Like every web server, theirs record the IP address and browser of anything that connects, which is a technical necessity of delivering a page to you rather than a choice made here.
If you arrived from an ad
Headroom advertises inside ChatGPT, and OpenAI's measurement pixel runs on these pages so that a signup can be traced back to the ad that paid for it. In practice:
- It only runs if you came from one of those ads. Clicking one adds a reference code to the web address, and that code — or a cookie left by it on an earlier visit — is what switches the pixel on. Arrive from a search engine, a link, or anywhere else, and none of the rest of this happens: nothing is loaded, nothing is stored, nothing is sent.
-
When it does run, it stores two cookies on this domain: the reference
code itself, as
__oppref, for thirty days; and__obref, a random number identifying your browser to OpenAI, for a year. Neither contains your name or your email address. -
If you then sign up, the pixel tells OpenAI that a signup happened, and
sends your email address and first name scrambled —
passed through a one-way function so OpenAI receives something like
a3f9c2…and never the address itself. OpenAI compares that against the same scramble of people who saw the ad. It is a way of matching two records without either side handing over the actual details. - What comes back is a number: how many signups an ad produced. Not who.
This is the only part of the site that involves an advertising company, and those two cookies are the only ones it sets. Nothing else here stores anything on your machine at all. The legal basis is consent where the law requires it.
To switch it off: not arriving from an ad is enough, and
is the usual case. Otherwise, block advertising scripts in your browser
or use any ad blocker — the pixel is loaded from
bzrcdn.openai.com, and blocking it stops all of the above.
Nothing else on this site changes if you do; the signup form works
exactly the same. You can also delete both cookies from your browser
settings at any time.
Where your information goes
The companies above — Google, which holds the signup spreadsheet; OpenAI; Fathom; GitHub; Cloudflare — are all based in the United States, so signing up means your name and email are stored there. If you are in the UK, the EEA, or Switzerland, that is an international transfer, and it is covered by the standard contractual clauses those providers publish.
Your rights
Wherever you live, you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted, and you can object to any of it. In the UK, the EEA, and Switzerland those are legal rights under the GDPR, along with the right to receive your data in a portable form and the right to withdraw consent at any time. In California they are legal rights under the CCPA. Everywhere else, the answer is the same anyway.
The form below is how you exercise any of them. It goes to a person, not a ticketing system, and the reply comes from a real address so you can simply continue the conversation from there. Expect an answer within thirty days, and usually within a few. There is no verification hoop beyond replying to that email, which confirms the address is yours.
If you are in the UK, the EEA, or Switzerland and you think this has been handled badly, you have the right to complain to your national data protection authority. You are welcome to try the form first.
Ask for something
Your email address is the only thing needed, because it is both the thing the request is about and the way to answer it. It is used for that and nothing else — asking to be deleted does not put you on a mailing list, which would be a remarkable way to run one.
Children
This site is not aimed at children and does not knowingly collect anything from anyone under 16. If you believe a child has signed up, say so through the form and it will be deleted.
Changes
If what the site collects changes, this page changes with it, and the date below moves. There is no mailing list for privacy policy updates and there is not going to be one.
Last updated 22 August 2026.