Deckloud documents
where each mode stores data.
Last updated October 29, 2026. This policy covers the Deckloud apps for iPhone, iPad, Android, Mac, Windows and Linux, Deckloud Calendar, Deckloud Cloud, deckloud.com, and the optional desktop-purchase activation service.
Last verified
01
Operator and contact
Hoang Pham publishes and operates Deckloud. Privacy requests go to support@deckloud.com, as described below.
02
Who controls your workspace data
In self-hosted mode, Deckloud sends board, card, comment, attachment, label, assignee, and due-date data directly to your configured Nextcloud server. Its operator controls that copy and its retention. In optional Cloud mode, Deckloud creates a managed account and stores workspace content on shared Nextcloud infrastructure it manages. Users are separated logically, not by a physical server each.
03
Cloud security boundary
Cloud connections use TLS, and backups are encrypted before upload. Cloud data is not end-to-end encrypted or operator-blind: Deckloud's operator and infrastructure administrator can access it to run the service. The production Cloud path and encrypted backup restore are verified before release.
04
Data collected by Deckloud and its processors
Production analytics and diagnostics find release defects, measure feature reliability, and improve the product. Deckloud never uses them for advertising or for tracking across other companies' apps or websites.
| Service | Data | Purpose |
|---|---|---|
| PostHog | Random installation and session IDs; app, build, platform, language and region setting, route patterns, feature outcomes, pseudonymous hashes and entitlement state; the store country, currency and price that the Pro offer shows. Nextcloud and Deck server versions, and error or request diagnostics. Native crash reports; on iPhone and iPad also Apple's crash diagnostics of the app, its widgets and its share extension: crash type, code locations, app and iOS version and device model; on Mac from Deckloud's macOS crash reports: crash type, process name and path without the user name, top code locations, macOS version and Mac model. Also performance timings: launch, sync, opening a board, search, server requests and local database writes; local edits and their confirmation by the server; and time the app could not respond. Timings are sent about every five minutes, with the length of that period; each summary holds the number of measurements, counts per duration range, and total and longest duration per kind of measurement. | Product analytics, release health, sync reliability, and defect diagnosis. |
| RevenueCat, Apple, and Google Play | Anonymous purchase user ID, product and entitlement state, purchase and restore history, price locale, and store receipt data. Apple or Google processes payment details for its store. | Complete, validate, restore, and support the lifetime Pro purchase. |
| Deckloud billing-link API | Only when you activate the desktop app from your phone. It stores a random purchase user ID that the phone uses with RevenueCat, with a hash of its secret. A hash of the one-time code and the computer's random device and installation IDs, deleted 10 minutes after the code expires (24 hours once approved). On approval, the desktop license with the store transaction ID, purchase user ID and product; it is linked to those IDs and kept while the license can be used or restored. | Verify the same RevenueCat entitlement for optional desktop activation. |
| Deckloud Cloud | A random installation token, managed account and device records, and the board, comment, and file content you choose to store in the managed workspace. | Create, authenticate, sync, link, revoke, and delete the optional managed workspace. |
| deckloud.com | Random browser-session ID, page path and title, locale, campaign and referrer host, and the source tag (src) that links from the apps add. CTA clicks, scroll thresholds, and the result of each step on the license management page (success or an error code). If you subscribe to release notes: your email address, language and request time, and a confirmation email sent through Cloudflare Email Sending; you are subscribed only after you confirm, and an unconfirmed request is deleted after 7 days. Cloudflare also processes normal web request and security data. | Website operation, campaign attribution, and landing-page improvement. |
| Expo Updates | App version, runtime version, platform, and a random ID the app creates once per installation (EAS-Client-ID). Up to 1,024 characters of an error that stopped the app at launch. Normal network request data when the app checks for an eligible signed update. | Deliver compatible app updates. |
| GitHub | Normal network request data, including the IP address, when the desktop app checks for and downloads updates, or when you download it from deckloud.com. | Deliver the desktop app and its updates. |
| Deckloud organization license API | A SHA-256 hash of the Nextcloud server address, at most once a day, or at each license check for a licensed server. For a licensed server: its address and the platform; a seat hash of the license ID and Nextcloud user ID (for provider licenses also the server address). The license record: plan, status, seats, paid period, organization name, Polar customer, subscription and order IDs, and a hash of the license key; the email the key went to, the trial contact email, bound server addresses, the Nextcloud group ID and the analytics policy. When an admin verifies a server: its address and a temporary Nextcloud app password from Login Flow v2, used once to read the admin's groups. The app password is kept encrypted until Nextcloud confirms its deletion; a failed deletion is retried for up to 30 days. Encrypted backups of the API database (7 daily, 4 weekly and 6 monthly copies) can hold the copy and its key until they expire. | Apply an organization license, count used seats, and let only a server admin manage or buy its license. |
| Google ML Kit (Android) | Performance and usage metrics of on-device code scanning and Latin-script text recognition. Images and recognized text stay on the device. | Scan desktop activation codes and read photo text in Smart Capture on Android. |
05
Data intentionally excluded
Product events never include board titles, card fields, comments, attachment content, search text, Nextcloud credentials, full server URLs, email addresses, advertising identifiers, or precise location. Person profiles, ad tracking, geographic enrichment, session replay, surveys, and remote feature flags are off. Failure reports can include a shortened application or server error, after Deckloud filters credentials, URLs, email addresses, and common authentication fields. PostHog receives normal network metadata with each request. The team license suggestion counts on your device how many people share your boards and never sends that count. A Send to IT link you choose to send holds the suggested seat count, which deckloud.com receives when the link is opened.
06
Smart Capture photos and dictation
Smart Capture reads photo text on the device; Android bundles the Latin-script OCR model, so no download is needed. Dictation asks for the microphone only when you choose it, uses an on-device speech service on supported devices, and stops in the background. Deckloud keeps no recordings and sends no audio to a server. Photo and voice drafts stay on the device until you create cards, which then sync to your Nextcloud server or Cloud workspace.
07
Deckloud Calendar
Deckloud Calendar connects your device directly to the CalDAV servers you choose, such as Nextcloud, iCloud, Fastmail or Google Calendar; events, tasks and invitations never pass through Deckloud. Passwords, app passwords and Google sign-in tokens stay in protected device storage, and the app sends them only to the server you entered, another address of the same site over HTTPS, or the provider's own hosts; a server cannot redirect them anywhere else. Google access covers your Google Calendar and the account's email address, follows the Google API Services User Data Policy including Limited Use, and can be revoked at myaccount.google.com/permissions. Reminders are local notifications. The current test versions send no analytics or diagnostics.
08
Credentials and protected device data
In self-hosted mode, Nextcloud Login Flow gives Deckloud a device credential from your server, kept in protected device storage. Public Nextcloud servers require HTTPS. Android can also connect to a private LAN server over HTTP if you enter that address; HTTP sends that credential and workspace data unencrypted. In Cloud mode, the app creates a random installation token that identifies the installation for account functionality. It is not derived from hardware, device settings, IP address, location, advertising ID, or another fingerprint. A device-specific managed-server credential also stays in protected device storage. Reminder, notification, widget, and local workspace data stays on your device or in a platform service you choose. Deckloud never receives your Apple or Google account password or payment-card details.
09
Retention and deletion
Pseudonymous product analytics and diagnostics follow Deckloud's 12-month PostHog retention plan; aggregate reports without an installation identifier can remain longer. Deckloud-controlled operational logs are normally kept no more than 90 days, unless abuse investigation or a legal duty requires longer. Purchase and entitlement records remain while needed to validate and restore a lifetime purchase or meet accounting and legal duties. RevenueCat can delete a customer record on request, but restoring an active App Store or Google Play purchase can recreate it. Logging out removes that account's credential and its disposable offline cache, which a documented release reset can also replace. Device-global settings and free-allowance state remain until you delete the app. On iPhone and iPad, two random identifiers stay in the iOS Keychain after you delete the app and are reused on reinstall. They are the purchase user ID for desktop activation and the Deckloud Cloud installation token; erasing the device removes them. Self-hosted data must be deleted on that Nextcloud server. Deleting a Cloud account removes active managed workspace data; encrypted backups expire under the backup retention policy, not immediately.
010
Your choices and requests
Delete a Cloud account in Settings > Account > Delete Deckloud Cloud account before you remove local data, or without the app at https://deckloud.com/account-deletion/. Turn off usage analytics in Settings, or delete the app, to stop future analytics from that installation. For access, correction, or deletion of Deckloud-controlled analytics, diagnostics, or purchase-link data, email support@deckloud.com. Include the Support code from Settings > Diagnostics, the approximate request time, app version, and build, but no Nextcloud password, app password, card content, or attachment. Self-hosted Nextcloud data requests go to that server's operator; Apple and Google Play control their purchase histories. The full privacy policy, with legal bases and your rights, is at https://deckloud.com/privacy/.
011
Processors and international transfer
Deckloud uses PostHog, RevenueCat, Cloudflare (including Cloudflare Email Sending), Polar, Oracle Cloud Infrastructure, Apple, Google, Expo, and GitHub only for the purposes above. They can process data in the United States, Singapore, and other countries under their own security and data-processing terms. Deckloud does not sell collected data or share it for cross-company advertising. Material changes update the date on this page and, when required, the store disclosure.
FAQ
Practical questions
Does Deckloud host my Nextcloud Deck boards?
Only if you choose Deckloud Cloud. Self-hosted mode connects directly to your own Nextcloud server.
Do I need a Deckloud cloud account?
No. Connect your Nextcloud account, or tap Create a free workspace for an optional Cloud account without email registration.
Is Deckloud affiliated with Nextcloud GmbH?
No. Deckloud is an independent client for Nextcloud Deck.
Related
Your boards stay on your Nextcloud server.
Self-hosted Deckloud connects directly to your Nextcloud. Optional Deckloud Cloud provides a managed private workspace with no account setup.
OpenNextcloud Deck login on iPhone, and why sign-in fails.
Troubleshoot Nextcloud Deck login on iPhone with server URL, Login Flow v2, app passwords, and Deck app availability checks.
OpenTroubleshoot Nextcloud Deck, from server errors to stuck sync.
Fix Nextcloud Deck errors: maintenance mode (503), expired sign-in (401), permission denied (403), Deck app missing (404), certificate and sync problems.
Open