Privacy policy

• Phạm Huy Hoàng
• Thôn Bằng Gia, Tân Việt
• Bình Giang, Hải Dương
• Vietnam
• partners@deckloud.com

Further provider details are in the imprint. For all privacy requests, email partners@deckloud.com.

Deckloud is a client for Nextcloud Deck. When you connect your own Nextcloud server, the apps send boards, cards, comments, attachments, labels, assignees and dates directly to that server. Deckloud does not receive this content. The operator of your Nextcloud server is responsible for it.

For a server on a private network, you can use http:// instead of https://. An HTTP connection is not encrypted in transit. Use HTTPS for encrypted transport.

The apps keep a local copy on your device for offline use and store your Nextcloud app password in the system credential store (Keychain on Apple devices, Android Keystore, Windows Credential Manager, Secret Service on Linux). Signing out removes the account's credential and its local copy.

To suggest a team license, the app counts on your device how many people share your boards. This count is not sent to Deckloud. If you choose to send a Send to IT link, the link contains the suggested number of seats, and deckloud.com receives it when someone opens the link.

The camera opens when you scan a desktop activation code, take a photo for a card, or read text from a photo in Smart Capture. On Android, Google ML Kit reads activation codes and Latin-script text on the device. ML Kit sends Google performance and usage metrics, but not the image or recognized text. Smart Capture requests microphone access only when you choose dictation. Dictation uses on-device speech recognition on supported devices; Deckloud does not send audio to a server or save recordings. Photo and voice drafts stay on the device until you create cards. Photos and files you attach go only to your Nextcloud server or your Cloud workspace. Reminders and Focus timers are local notifications; Deckloud uses no push service. If you turn on Apple Reminders for a card in the iPhone, iPad or Mac app, the app copies the card title, its due date and a link that opens the card into Apple's Reminders app, which syncs them through your iCloud account under Apple's terms. If your organization manages the device, the app reads its managed configuration on the device.

Deckloud Calendar is a calendar and task app that connects to calendar servers you choose through CalDAV, for example Nextcloud, iCloud, Fastmail or Google Calendar. It reads and writes your events and tasks directly between your device and that server. Deckloud does not receive your events, tasks, invitations or calendar names. The provider of each server is responsible for the data stored there.

The app keeps a local copy of your calendars and tasks on the device for offline use, together with changes that have not reached the server yet. A calendar or task list you create on the device without an account stays on the device. Passwords, app passwords and sign-in tokens are stored in the system credential store (Keychain on Apple devices, Android Keystore, Windows Credential Manager, Secret Service on Linux). Before you remove an account that still has unsent changes, the app asks you; removing the account then deletes its credentials and its local copy. Deleting the app deletes data that exists only on the device; on iPhone and iPad, saved sign-ins can stay in the Keychain after you delete the app.

Reminders are local notifications scheduled on your device. Deckloud uses no push service. The current test versions of Deckloud Calendar send no analytics or diagnostics.

If you connect a Google account, the app asks Google for access to your Google Calendar (https://www.googleapis.com/auth/calendar) and your account's email address (openid, email). It uses this access only to show, create, change and delete events in the calendars of that account, directly between your device and Google's CalDAV interface, and the email address only to name the account in the app. The sign-in tokens stay in the system credential store on your device. Deckloud has no server that receives your Google data; it does not sell or share this data, does not use it for advertising, and does not use it to train AI models. Deckloud Calendar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time at myaccount.google.com/permissions; removing the account in the app also deletes the tokens on the device.

Cloudflare, Inc. hosts deckloud.com and processes the data of each request, including the IP address, the requested address, date and time, and the browser identification, to deliver the site and protect it against attacks. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is a secure and working website.

For website analytics, the site sends events to PostHog (us.i.posthog.com): a random session ID kept in your browser's session storage until you close the tab, the page path without query parameters, the page title, the language, campaign parameters (utm), the source tag (src) that links from the Deckloud apps add, the referring host, clicked buttons, scroll depth, and on the license management page the result of each step (for example whether a verification or key activation succeeded, and its error code). The site sets no cookies, disables location lookup and creates no person profiles. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is understanding which pages help visitors.

Pages that show prices or handle licenses request data from api.deckloud.com. These requests contain no personal data except the technical request data.

When you subscribe, we store your email address, the site language and the time of your request in Cloudflare Workers KV and send a confirmation email to that address through Cloudflare Email Sending. Only after you confirm with the link in that email do we add you as a subscriber and store the time of confirmation; an unconfirmed request is deleted after 7 days. We use the address only to send Deckloud product updates. Legal basis: your consent, Art. 6 (1) (a) GDPR. To limit abuse, the form keeps a SHA-256 hash of your IP address for up to one hour and a SHA-256 hash of your email address for one day, so that an address gets at most one confirmation email a day; legal basis: Art. 6 (1) (f) GDPR.

To unsubscribe and delete your entry, email partners@deckloud.com. We keep the entry until you unsubscribe.

deckloud.com previously offered a form for organizations interested in managed deployments. Submitted entries (email address, organization, number of users, procurement route, a free-text description, language and time of consent) remain stored in Cloudflare Workers KV. Legal basis: your consent, Art. 6 (1) (a) GDPR. We keep an entry until you ask us to delete it.

Release builds of the apps send product analytics and error diagnostics to PostHog (us.i.posthog.com) to find defects, measure reliability and improve the apps:

• a random installation ID and session ID;
• app version, build, operating system and its version, device type, manufacturer and model, screen size, time zone, language and region setting, the store country, currency and price that the Pro offer shows, and Pro status and its source, whether the signed-in account is in the Nextcloud admin group, whether an organization manages the device (MDM), and the Nextcloud and Deck versions of the connected server;
• screen names with identifiers removed, feature outcomes, and hashed identifiers of account, server, board, card and purchase;
• performance measurements: how long launch, sync, opening a board, search, server requests, local database writes, local edits and their confirmation by the server take, and how long the app could not respond. About every five minutes, the app sends for each kind of measurement the number of measurements, their counts per duration range, their total and longest duration in milliseconds, and the length of that period, without board or card content or identifiers;
• error diagnostics: the error type, a message and the code locations in the app where it happened, with URLs, email addresses, tokens and credentials removed before sending, and native crash reports: in the mobile apps with the code locations, app version and device model, and in the Mac app from Deckloud's macOS crash reports, with the crash type, the process name and path (without your user name), the top code locations, the macOS version and the Mac model.

Board content, credentials, full server URLs, email addresses and advertising identifiers are not sent. Person profiles and session replay are off. The apps and the website disable location lookup in PostHog. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is a reliable product. PostHog keeps the data for 12 months. Deckloud uses no separate crash reporting service.

You can turn analytics off in the app settings. Your organization can turn it off for its Nextcloud server or its managed devices; the app then shows the setting as managed.

On iPhone and iPad, Deckloud Pro is sold through the App Store. In the Android app, it is sold through Google Play. Apple or Google processes the payment. RevenueCat, Inc. validates and restores purchases with an anonymous app user ID, the product, the entitlement status, the purchase history, the App Store receipt or Google Play purchase token, and technical request data including the IP address. Deckloud sends RevenueCat no name or email address. Legal basis: Art. 6 (1) (b) GDPR.

To activate Pro in the desktop app from a mobile purchase, api.deckloud.com gives the phone a random purchase user ID and a secret, stores the ID with a hash of the secret, and the phone signs in to RevenueCat with that ID. The desktop app shows a one-time code that expires after 10 minutes. The link stores a hash of the code and the random device and installation IDs of the computer; it is deleted 10 minutes after it expires, or 24 hours after it expires once approved. When you approve, api.deckloud.com checks the purchase with RevenueCat and stores the desktop license: the store transaction ID, the purchase user ID and the product, linked to the device and installation IDs of the computer. We keep the purchase user ID and the license for as long as the license can be used or restored, and longer where the law requires it. Legal basis: Art. 6 (1) (b) GDPR.

Desktop purchases and organization licenses are sold by Polar Software, Inc. as merchant of record. Polar processes your payment, billing details and invoices under its own privacy policy. From Polar, api.deckloud.com receives and stores the order ID, the Polar customer ID, the product, the subscription status and period, and for desktop purchases the buyer email address together with a random device ID and installation ID created on your computer. We use this data to issue and restore licenses. Legal basis: Art. 6 (1) (b) GDPR. We keep it for as long as the license can be used or restored, and longer where the law requires it.

To find the license of a Nextcloud server, every Deckloud app sends api.deckloud.com the SHA-256 hash of the server address: at most once a day for a server without a license, and at each license check for a licensed server. For a licensed server, the app also sends the server address, a seat hash (SHA-256 of the license ID and the Nextcloud user ID, for provider licenses also of the server address) that reports usage, and the platform (iOS, Android, macOS, Windows or Linux). The apps send no user names, email addresses, Nextcloud user IDs or group memberships.

For each seat, api.deckloud.com stores the seat hash with the first and the last time it was seen; the last-seen time is updated at most once per UTC day. Seats are kept while they are in use and deleted 60 days after their last use. The count of reported seats is shown to the license admin and is not used to limit Pro. Legal basis for license lookups and the seat report: Art. 6 (1) (f) GDPR; our legitimate interest is providing the organization license your organization bought and showing your organization how many users its license covers. api.deckloud.com also stores the license (plan, status, seats, paid period, organization name from Polar or entered for a trial, Polar customer, subscription and order IDs, a SHA-256 hash of the license key, the email address the key was sent to), the bound server addresses, the Nextcloud group ID and the analytics policy an admin chose, and for provider licenses the daily peak of bound servers.

When an admin verifies a server to manage or buy its license, api.deckloud.com receives the server address and runs Nextcloud Login Flow v2 against it. It uses the temporary app password once to read the account's groups from /ocs/v2.php/cloud/user, then requests its deletion on the server. It creates no admin session unless Nextcloud confirms deletion. Until Nextcloud confirms the deletion, api.deckloud.com keeps the app password encrypted and uses it only for this check and its deletion; if it cannot store this copy, it skips the check and requests the deletion at once. If deletion fails, it retries for up to 30 days and erases its copy once Nextcloud confirms the deletion or the 30 days end. Encrypted backups of the api.deckloud.com database, kept as 7 daily, 4 weekly and 6 monthly copies, can still hold this copy and its key until they expire. The admin can also revoke the app password in Nextcloud Settings > Security. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is making sure that only an administrator of the server can see its license or buy one bound to it.

After checkout, api.deckloud.com sends the license key by email to the purchase email address from Polar, through Cloudflare Email Sending from partners@deckloud.com; the website does not show license keys. Legal basis: Art. 6 (1) (b) GDPR where the recipient bought the license; otherwise Art. 6 (1) (f) GDPR, our legitimate interest in delivering the license an organization bought to the address it gave at checkout. See security and data.

Organization trials ended on 8 November 2026. For trials started before then, api.deckloud.com keeps the contact email an admin entered with the license and a log of the trial emails it sent from partners@deckloud.com through Cloudflare Email Sending. Deckloud no longer sends these emails. To have an address deleted, email partners@deckloud.com. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is keeping a record of the notices sent about a trial the admin started for their organization.

To recover a license key, you enter the order email address and order ID. We use them to verify the order and send a new key to the purchase email address. Legal basis: Art. 6 (1) (b) GDPR.

To limit abuse, the service stores SHA-256 hashes of the requesting IP address and of the other limited values, such as the license key or the email address entered for key recovery, and deletes them after at most 2 days. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is protecting the service.

Deckloud Cloud is an optional managed workspace in the mobile and desktop apps. When you use it, we create an account without email or name and store: a random account ID and the matching Nextcloud user and group IDs, an encrypted generated password, your quota and status; for each device, a hash of its random installation token, the platform, an encrypted app password and timestamps; and the boards, comments and files you store in the workspace. Legal basis: Art. 6 (1) (b) GDPR.

The workspace runs on Nextcloud with PostgreSQL behind Cloudflare. Connections use TLS. Backups are encrypted before upload to Cloudflare R2 and kept as 7 daily, 4 weekly and 6 monthly copies. The data is not end-to-end encrypted; the operator can access it to run the service. For rate limits, we store a keyed hash of the IP address and delete it after 2 days.

Deleting the Cloud account in the app removes the Nextcloud user, group and account records. Encrypted backups expire under the schedule above.

The mobile app checks Expo's update service (u.expo.dev) for compatible signed updates. Expo receives the app version, runtime version, platform, a random ID the app creates once per installation (EAS-Client-ID), after an error that stopped the app at launch up to 1,024 characters of that error message, and the technical request data, including the IP address. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is delivering fixes.

The desktop app asks GitHub for new versions and downloads its updates from GitHub, and the desktop download links on deckloud.com lead to GitHub too. GitHub, Inc. receives the technical request data of these requests, including the IP address. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is delivering the app and its fixes.

When you email us, we process your address and the content of your message to answer it. Legal basis: Art. 6 (1) (b) GDPR for questions about a contract, otherwise Art. 6 (1) (f) GDPR. We delete the correspondence when it is no longer needed, unless the law requires us to keep it.

Where these providers process data in the United States, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses. We do not sell personal data and do not use it for advertising.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3)).

Right to object: where we process data on the basis of Art. 6 (1) (f) GDPR, you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). Turning analytics off in the app stops future analytics from that installation.

To exercise a right, email partners@deckloud.com. For app analytics, include the Support code from Settings > Diagnostics so we can find the data. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. You are not obliged to provide personal data; without it, some functions such as purchases, Deckloud Cloud or the newsletter are not available. We update this policy when data processing changes and show the date at the top.