Privacy Policy

1. Scope and controller

This policy applies to information handled by DeskDays through the Service. DeskDays Inc. is the controller of personal information described in this policy. Apple, Google, RevenueCat, Supabase, and other providers may also process information under their own terms and privacy policies when you use their services.

If you use DeskDays for work, your employer does not receive your DeskDays information from us unless you independently choose to export and share it. DeskDays is not operated on behalf of your employer.

2. Information we handle

Account and profile information

If you create an account, we process your account identifier, email address, full name if provided, authentication status, and session information. You may sign in with email and password, Google, or Apple. We do not receive your Google or Apple password. Email passwords are handled by Supabase Auth and are not available to DeskDays in plaintext.

Work schedule, PTO, and settings

We process the information you enter or import to operate DeskDays, including:

• office and PTO dates, hours, entry source, and timestamps;
• optional PTO type and note, including labels such as vacation, sick, or mental health;
• monthly office-day target, PTO allowance, whether PTO and holidays count toward your target, onboarding status, and theme preferences; and
• custom holidays and related names and dates.

Precise location and optional health-related PTO labels or notes may be considered sensitive personal information under some laws. We use them to provide the feature you requested, secure the Service, and comply with law. We do not use this information for advertising or to infer unrelated characteristics about you.

Location information

Location access is optional and is used for the Pro auto-log feature. If you enable it, DeskDays uses foreground and background system geofencing to detect entry into the office location you set. DeskDays does not maintain a continuous location history.

When a signed-in user's office day is automatically logged after a geofence entry, the saved record may include a current or recent device latitude and longitude, accuracy, timestamp, and the configured geofence center and radius. This information is linked to that office-day record and stored with the user's DeskDays account. If an office day already exists for that date, DeskDays skips the auto-log and does not create a second location record.

Calendar, reminders, and notifications

If you enable calendar sync, DeskDays reads calendar event titles and dates within the sync period on your device to identify entries containing terms such as WFH, OOO, PTO, or vacation. The original event title, description, attendees, and calendar contents are not uploaded to DeskDays. For signed-in users, only the resulting DeskDays date, status, source, and timestamp are synced to the account. DeskDays may also create and remove all-day "DeskDays" events in a writable calendar you select.

Some iOS builds may request Reminders permission when calendar sync is enabled. The current Service does not upload reminder content to DeskDays. If you allow notifications, DeskDays schedules pacing and office-arrival notifications locally on your device. The current Service does not register or transmit a remote-push device token to DeskDays.

Subscription and purchase information

If you purchase or restore DeskDays Pro, RevenueCat and the applicable app store process information such as the DeskDays account identifier, product selected, purchase status, entitlement status, and expiration date. Apple or Google processes your payment method; DeskDays does not receive or store full payment-card details.

Website and technical information

When you visit deskdays.app or connect to the Service, hosting, network, authentication, and font providers may automatically receive ordinary request information such as IP address, browser or device type, operating system, requested page, and date and time. The current DeskDays website does not use advertising or analytics cookies.

Support communications

If you contact us, we receive your email address and the contents of your message, along with any files or diagnostic details you choose to provide. Please do not send sensitive information that is not necessary to resolve your request.

3. On-device processing and storage

DeskDays is designed to keep several categories of information on your device:

• Guest mode: schedule records, PTO information, targets, holidays, name, and preferences are stored locally. If you later create or sign in to an account, the app may migrate this information to that account.
• Calendar analysis: source calendar events are read and analyzed locally; only derived DeskDays entries are synced for signed-in users.
• Reports: report content and its integrity hash are generated locally. DeskDays does not automatically send reports to us or your employer.
• Notifications and widgets: pacing calculations, local notification state, widget data, calendar identifiers, and certain preferences are stored locally.

Information stored only on your device may still be included in device backups controlled by you, Apple, Google, or your device platform.

4. How we use information

We use information to:

• create and secure accounts and authenticate users;
• track office days, PTO, holidays, targets, and progress;
• sync data across supported devices and with calendars when enabled;
• provide location-based auto-logging and local notifications when enabled;
• create user-directed reports and maintain widget and quick-action functionality;
• verify purchases, restore subscriptions, and provide Pro features;
• respond to support requests and communicate about the Service;
• maintain security, prevent abuse, troubleshoot failures, and enforce our terms; and
• comply with applicable law and protect users, DeskDays, and others.

DeskDays does not use automated decision-making that produces legal or similarly significant effects. Progress calculations and pacing notifications are informational and remain under your control.

5. Legal bases for processing

Where the European Economic Area, United Kingdom, or similar laws apply, our legal bases depend on the information and purpose:

• Contract: to create your account and provide the DeskDays features, synchronization, support, and subscription benefits you request.
• Consent: for optional device permissions such as location, calendars, reminders, and notifications, and where consent is otherwise required. You may withdraw device permission at any time.
• Legitimate interests: to secure and maintain the Service, prevent abuse, troubleshoot problems, and improve reliability, provided those interests are not overridden by your rights.
• Legal obligation: when processing is necessary to comply with law, lawful requests, accounting duties, or the protection of legal rights.

You are not required by law to provide personal information to DeskDays. Account information is necessary to use account-based synchronization, while location and calendar permissions are optional. You can use core manual tracking in guest mode without creating an account.

6. How we disclose information

We disclose only the information reasonably necessary for the following purposes:

• Supabase: authentication, database hosting, account data storage, and server-side functions.
• RevenueCat: subscription purchase management and entitlement verification.
• Apple and Google: sign-in when selected, app distribution, purchases, restores, and platform services.
• Hosting and infrastructure providers: delivery, security, and operation of the website and Service.
• Professional advisers and authorities: when reasonably necessary to comply with law, respond to lawful process, protect rights or safety, or establish or defend legal claims.
• Business transfers: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections and notice where required.
• At your direction: when you export, save, or share a report or other information with another person or service.

Service providers that process personal information on our behalf are required to use it only to provide their services to DeskDays and to protect it consistently with applicable law and this policy.

7. No sale, advertising, or cross-service tracking

DeskDays does not sell personal information for money or other valuable consideration. We do not share personal information for cross-context behavioral advertising, display third-party advertising, or use third-party advertising trackers. We also do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

For the preceding 12 months, the categories of personal information collected and disclosed for business purposes are those described in Sections 2 and 6. We have not sold or shared those categories for cross-context behavioral advertising.

8. Retention and deletion

We retain account, schedule, PTO, settings, holiday, and entitlement information while your account is active and as needed to provide the Service. We retain support communications and limited security or transaction records only as long as reasonably necessary to resolve requests, maintain security, meet legal obligations, and establish or defend legal claims.

You can permanently delete your account from Settings > Account > Delete Account. Account deletion removes the account and associated DeskDays records from active systems and, where applicable, revokes the stored Apple sign-in refresh token. Residual copies may remain temporarily in restricted backups or logs until they are overwritten under provider retention cycles. Apple, Google, and other independent providers may retain purchase or account records under their own policies and legal obligations.

Guest data remains on your device until you clear app data, delete the app, reset the guest experience, or migrate it to an account. Deleting the app may not remove copies contained in a device or cloud backup that you control.

9. Your choices and controls

• Location: do not enable auto-log, clear the saved office location in DeskDays, or revoke location access in device settings. Manual office-day entry remains available.
• Calendar and reminders: do not enable sync or revoke access in device settings. You may also remove the dedicated DeskDays calendar through your calendar application.
• Notifications: change notification permission in device settings.
• Account information: update supported profile information in the app or contact us.
• Account deletion: use the in-app deletion control or email us if you cannot access your account.

Revoking a permission stops future access but does not automatically delete information already saved to your account. You may delete individual entries in the app or delete the account.

10. Security and international transfers

We use reasonable technical and organizational safeguards designed to protect personal information, including authenticated access, encrypted network connections, and database access controls that restrict users to their own records. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

DeskDays and its service providers may process information in the United States and other countries where privacy laws may differ from those where you live. When applicable law requires transfer safeguards, we use lawful transfer mechanisms and contractual or other protections appropriate to the transfer.

11. Regional privacy rights

Depending on where you live and subject to applicable exceptions, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; to restrict or object to processing; and to withdraw consent. You may also have the right to appeal a denied request and to complain to your local data protection or supervisory authority.

EEA and United Kingdom

You may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Withdrawing consent does not affect processing already performed lawfully. You may lodge a complaint with the supervisory authority where you live or work, although we encourage you to contact us first so we can try to resolve the issue.

California and other U.S. states

To the extent applicable law covers DeskDays, you may have rights to know the categories, sources, purposes, recipients, and specific pieces of personal information we process; to request deletion or correction; to obtain a portable copy; and to receive equal service without unlawful discrimination for exercising a privacy right. DeskDays does not sell or share personal information for cross-context behavioral advertising, so no sale or sharing opt-out is necessary.

Submitting a request

Email support@deskdays.app with the subject "Privacy Request." Describe the right you wish to exercise and the account email involved. We may need to verify your identity before completing a request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity. We will respond within the period required by applicable law.

12. Children's privacy

DeskDays is intended for adults and workforce users and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to DeskDays, contact us so we can investigate and delete it as required. Users must also meet any higher minimum age applicable where they live or use the Service with valid parent or guardian authorization.

13. Changes to this policy

We may update this policy as the Service, our providers, or applicable requirements change. We will post the revised policy here and update the "Last updated" date. If a change materially affects how we use previously collected personal information, we will provide additional notice or obtain consent where required.

14. Contact us

DeskDays Inc. is responsible for this policy. For privacy questions, requests, or complaints, contact:

DeskDays Privacy
Email: support@deskdays.app