Desklet
Start 14-day trial

Privacy Policy

Last updated

Who we are

Desklet is run by Alexander Kovalev, Porajowska 14/2, 54-106 Wrocław, Poland (“we”, “us”). We are the controller of the personal data described here. Write to us at [email protected].

When you use Desklet for a business or an organization and your content holds personal data about other people, you are the controller of that data and we are your processor. Our Data Processing Agreement applies to it.

What we collect

  • Your account: your email address, the dates of your trial and subscription and their status.
  • Your devices: each device’s name and platform, taken from its browser; when it signed in, when it was last seen and whether it is online.
  • Your content: notes, files, images, links and text you put on Desklet, with their titles, file names, sizes, types, versions, side notes, pins, colors and Done marks; your desk names; the activity feed of your desks.
  • Agent connections: each agent’s name, the desks and mode you gave it, when it was last used, the status text it sets and the handoffs you create for it. Agent access keys are stored only as hashes.
  • Agent conversations: the messages you and your agents write in an Agent region, the items of the desk attached to them, who wrote each one, when an agent received it, and which of your agents’ messages you have read.
  • Share codes and AI links: stored only as hashes, with their expiry and download counts.
  • Billing: Paddle’s customer and subscription ids, your plan, price, status and dates. Paddle holds your payment details; we never see them.
  • Business early access list: your work email, when you join the list on our Business page.
  • Our emails to you: which email we sent, to which address, when, and whether sending succeeded.
  • Technical data: your IP address, used for rate limits and security, and request logs: the method, the address requested (with your search words when you search), the IP address, the browser type, the referring page, the response status, its size and duration. The logs hold no other request content.

We use no analytics and no advertising trackers.

Why we use it

What Why Legal basis (GDPR and UK GDPR)
Your account, devices, content, agent connections and conversations, share codes and AI links To run Desklet for you: store your content, show it on your devices, give your agents the access you chose, sort your items automatically Our contract with you (Art. 6(1)(b))
Our emails to you Sign-in links and codes, your trial, payments, the deletion warning and notices about changes to our terms or prices Our contract with you (Art. 6(1)(b))
Business early access list, and the email confirming you joined it To tell you when your space is ready Steps at your request before a contract (Art. 6(1)(b))
Technical data: IP addresses, request logs, the IP address of someone who uses a share code Security, abuse prevention and rate limits Our legitimate interests in keeping Desklet safe (Art. 6(1)(f))
Billing records Payments, invoices, tax and our accounting, through Paddle Our contract with you (Art. 6(1)(b)) and a legal obligation (Art. 6(1)(c))

We never sell your data, and we never use your content to train AI models.

Automatic sorting

When you save an item, Desklet sends details about it to Jev (TypeSafe AI, Inc.), which groups the item and suggests a next step. For each item Jev receives:

  • its kind (note, file, image, link or text) and its title, or a file’s name;
  • the first 2,000 characters of its text;
  • a link’s URL;
  • a file’s type and size, and an image’s width and height;
  • who added it: the name of your device, or the name of the agent that added it;
  • the name of its desk and the names of the groups on that desk;
  • the names of your other desks and of your connected agents;
  • on a desk with a layout, the titles and hints of the regions the item fits.

Jev never receives the file or image itself. It returns a category, a group and a suggestion, and on a desk with a layout a region. The item is placed in that region right away, and you can move it; nothing else is moved until you accept a suggestion. Jev keeps request data for as long as it reasonably needs it to run its service, and does not use it to train AI models.

We do not make decisions about you by automated means that have legal or similarly significant effects. Sorting only suggests where an item goes.

Agents

An agent you connect can use only the desks you choose, in the mode you choose: Read, or Read & add. An agent can never delete or change your items. You can disconnect an agent in Settings at any time, and it loses access at once.

An Agent region on a desk is a conversation with one agent. An agent receives the messages addressed to it on the desks you gave it. It reads the full history only of the conversations it is bound to, and elsewhere only the messages it sent or received. A Read agent can talk only to you.

What an agent reads leaves Desklet for the agent’s provider (such as Anthropic, OpenAI or Cursor). The provider’s privacy policy applies to that data, not ours.

An AI link is a secret address of one desk: anyone who has it can read that desk until you revoke the link or it expires.

Sharing

People who receive a share code see only what you shared with it. We use their IP address to limit wrong attempts, and it appears in our request logs (see Retention).

Subprocessors

These providers process data on our behalf, under a contract that binds them to our instructions.

Provider Purpose Data Location Safeguard
Cloudflare, Inc. DNS, proxy and TLS; R2 file storage all traffic, including IP addresses; your files and image thumbnails Chosen by Cloudflare, may be outside the EU DPA, SCCs, DPF
Jev (TypeSafe AI, Inc.) automatic sorting the item details listed in Automatic sorting United States SCCs
Resend email delivery your email address and the content of our emails United States DPA, SCCs, DPF
Hetzner Online GmbH servers, database and backups all account data and note text Germany DPA

DPA: data processing agreement. SCCs: the EU Standard Contractual Clauses. DPF: the EU–US Data Privacy Framework.

Before a new subprocessor receives personal data, we add it to this table. Business customers who want an email about it at least 30 days earlier can subscribe by writing to [email protected]. The Data Processing Agreement describes their right to object.

Paddle

Paddle.com is our reseller and the Merchant of Record for all our orders. For payments, invoices and tax, Paddle is an independent controller of your data under its own privacy policy.

Who else may receive data

We may share data with professional advisers, such as lawyers, accountants and auditors, who are bound to keep it confidential, and with authorities when the law requires it.

International transfers

Some providers process data outside your country. When data leaves the EU, the UK or Switzerland, we rely on the EU Standard Contractual Clauses, with the UK Addendum for transfers from the UK, and on the EU–US Data Privacy Framework, with its UK and Swiss extensions, where a provider is certified under it. You can ask [email protected] for a copy of the safeguards.

Retention

Data Kept
Items and files while your plan is active; 60 days after your trial or subscription ends without payment (later if our warning email 7 days before goes out late); removed at once when you delete your account
Items in the Trash 7 days after you delete them, then deleted for good within about an hour; at once when you delete them forever, empty the Trash, delete their desk or your account
Account until you delete it
Desks until you delete them or your account; their names stay after your items are deleted
AI links until you revoke them, they expire or you delete your account
Devices as a history of your devices until you delete your account; a sign-in lasts 30 days
Agent connections until you delete your account, disconnected ones included
Handoffs until your items are deleted after your plan ends, or until you delete your account
Agent conversations the newest 1000 messages of each; the messages are deleted with your items after your plan ends; a message an agent has not received yet is deleted 7 days after you remove that agent from the region and pick no other; a conversation is deleted 7 days after you remove its region, or with its desk or your account
Sign-in links and codes valid 15 minutes, deleted on use or within about two hours after expiry
Pairing words valid 5 minutes, deleted within about two hours
Share codes 24 hours, deleted within about two hours after
Business early access list up to 12 months, or earlier when you ask [email protected]
Email records 30 days; the content is removed once the email is sent or fails
Request replay records 7 days
Activity feed while your account exists; deleted with your items after your plan ends
Request logs overwritten by newer logs, with no fixed period
Backups 35 days
Billing records our records of your payments (Paddle ids, amounts, tax, dates) and founder price are kept for accounting after you delete your account, no longer linked to it; Paddle keeps its own as the law requires

We email you 7 days before we delete items and files after your plan ends.

Security

  • Every connection to Desklet uses TLS.
  • Files live in a storage bucket that is not public. Download links work for 10 minutes. The links the app uses to show your images and files are reused for up to 6 hours 10 minutes, and your browser may keep them and the file in its cache for that time. Signing out in that browser clears the cached links; a browser signed out from another device, or whose sign-in expired, keeps them until that time ends. File links from an AI link work for 1 hour, and file links in an export for 24 hours.
  • Sign-in links, codes, pairing words and agent access keys are stored only as hashes. The copy inside an outgoing sign-in email is removed once the email is sent, fails or expires.
  • Every agent request is checked against the desks you gave that agent.

Your rights

You may ask us to give you access to your data, correct it, delete it, restrict or object to its use, or hand it to you in a portable form.

  • Export: export your data at any time in Settings.
  • Deletion: delete your account in Settings.
  • Anything else: ask at [email protected]. We answer within one month.

If your request is about personal data in the content of a business customer, we pass it on to that customer.

You may also complain to a data protection supervisory authority.

Cookies and browser storage

Desklet uses only storage that it needs to work, so it asks for no consent. The landing pages set no cookies. Paddle’s checkout may set its own cookies under Paddle’s privacy policy.

Name Kind Purpose Lifetime
JWT cookie, HttpOnly keeps you signed in on this device 30 days; until the browser closes on a temporary device
XSRF-TOKEN cookie protects your requests from other sites as the sign-in cookie
signIn sessionStorage remembers your email address while you enter the code until the tab closes
dk-preload-reload sessionStorage avoids a reload loop after an app update until the tab closes
dk-paywall-shown sessionStorage shows the plans page once per tab until the tab closes
dk-theme localStorage the theme you picked, in the app and on these pages until changed
dk-code-theme localStorage the code colors you picked until changed
dk-focus-type localStorage the Focus text settings you picked until changed
deskPrefs localStorage the last open desk, each desk’s view and the item you were last on until cleared
dk-agent-tab localStorage the last agent tab in Connect agent until cleared
desklet-share IndexedDB hands a file from the phone share sheet to the app removed when the app takes it; leftovers older than 1 hour at the next share
app files service worker cache loads the app faster until the next version

Children

Desklet is not for anyone under 16.

Changes

We email you at least 14 days before a material change to this policy takes effect, and we move the “Last updated” date at the top of this page.

Contact

Email [email protected] or write to Porajowska 14/2, 54-106 Wrocław, Poland.