Privacy

Deskly is a virtual office, so most of what it stores is about where people were and what they were working on. Specifically:

• Account details: name, email address, a hashed password, and an avatar colour.
• Presence: which room you were in, your status, which device, and when - written by the server as a ledger.
• Content you create: whiteboard notes, chat messages and their attachments, and uploaded files.
• Recordings of meetings, where a workspace has recording enabled.
• Work attribution: which task you said you were on, and the hours derived from it.
• Mirrored issues from a connected tracker, and the mapping between a person and their tracker account.

We do not sell any of this, and we do not use it to train models.

Presence and attribution exist so a workspace can answer where the day went. Content exists because you wrote it. Account details exist so you can sign in. We hold nothing because it might be useful later.

Credentials for third-party services - a Jira or Azure DevOps token, calendar access - are encrypted before they are stored and are never shown back to a browser, not even to the admin who entered them.

Inside a workspace, visibility follows the same rule everywhere: you see yourself, a team lead sees the floor they lead, and a workspace admin sees the workspace. Task time is treated as more personal than presence time, not less.

Nothing crosses between workspaces. A guest pass is scoped to one room and enforced by the server rather than by the interface.

For the hosted product, data is held on our infrastructure in a single PostgreSQL database, with recordings and uploads on attached storage. If you self-host, none of it reaches us at all - the software runs on your hardware and we see nothing.

Presence history is kept for the window your plan includes - seven days on Free, up to ten years on Enterprise. Content and recordings are kept until you delete them or close the workspace.

Closing a workspace deletes its data. Ask us and we will confirm when it is done.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us and we will act within thirty days.

Self-serve export and account deletion are not built yet. Until they are, these requests are handled by a person - which means they work, but they are not instant.

Deskly sets a session cookie so you stay signed in, a locale cookie so the interface opens in the right language and direction, and a theme cookie. There is no advertising or third-party analytics cookie.