StoDeskPrivacy policy
StoDesk is built to keep your things on your own device. There are no ads, and analytics only run if you say yes. If you choose to sign in, we store one copy of your setup so it can sync between your devices.
In short
- Without an account, everything you add stays in your browser. We never receive it.
- If you sign in with Google, we receive your name, email address and profile picture, and we store your StoDesk setup so it syncs.
- We don't sell, rent or share your data, and there are no ads. Anonymous usage analytics only run if you allow them, and never include your content.
- You can export your setup at any time, and ask us to delete your account and everything stored with it.
Who we are
StoDesk (stodesk.app) is run by Charles Kelly, an independent designer based in the United Kingdom ("StoDesk", "we", "us"). For this policy, we are the data controller for the personal data described below. You can contact us at hey@chvrleskelly.com.
What StoDesk stores, and where
When you use StoDesk without an account (guest mode)
Your workspaces, tabs, cards and everything in them (links, notes, photos in notes, to-dos, prompts, snippets, business details, colours, fonts, settings and recent copies) are saved in your browser's own storage on your device (IndexedDB and local storage). This data is not sent to us. Clearing your browser's site data for stodesk.app deletes it, so we recommend using Settings → General → Export setup to keep a backup.
When you sign in
Signing in is optional and only used to sync your setup between devices. If you sign in with Google:
- Account details: Google shares your name, email address and profile picture with us. We use these to create your account, show who's signed in, and contact you about your account if we need to.
- Your setup: a copy of your whole StoDesk setup (everything listed above) is stored with our database provider, Supabase, in their Ireland (EU) region, linked to your account. It's protected so that only you can read or change it when signed in.
- Sign-in session: a session token is stored in your browser so you stay signed in. Signing out removes it and keeps a copy of your setup on that device.
Please don't store passwords, bank or card details, or other highly sensitive information in StoDesk. The Info card is designed for everyday business details like company numbers and addresses.
Link titles and website icons
When you add a link, StoDesk looks up the page's title and icon so your links look tidy. To do this, the web address (or just its domain, for icons) is sent to our server, which fetches the page title from that website and the icon from Google's and DuckDuckGo's public icon services. We don't store the addresses you look up on our server; titles and icons are saved in your browser. Our hosting provider may keep short-lived technical logs of these requests (see below).
Fonts
Some clock styles and font previews load typefaces from Google Fonts. When they load, your browser connects to Google's servers, which can see your IP address and browser details. Google says it doesn't use Google Fonts requests to build advertising profiles. Wallpapers are served from our own site.
Usage analytics (only if you allow it)
When you first visit, StoDesk shows a cookie notice asking whether you accept analytics cookies. If you choose Accept, we use Google Analytics to understand things like how many people visit, which pages and features are used, and roughly where visitors come from (country or city, device and browser type). It sets cookies whose names start with _ga. We switch off Google's advertising features and signals, and Google Analytics doesn't store full IP addresses. Your links, notes and other content are never sent to analytics.
If you choose Reject, or don't choose, the analytics script isn't loaded and no analytics cookies are set. You can change your mind at any time in Settings → General → About → Usage analytics; turning it off removes the analytics cookies. Google keeps analytics data for 14 months.
Google Search Console
We use Google Search Console to see how StoDesk appears in Google search results (for example, which searches lead people to the site). It uses information from Google Search, not from your visits to StoDesk, and doesn't add anything to the site or set any cookies.
Technical logs
Like almost every website, our hosting provider (Vercel) automatically records basic request information such as IP address, time, page or address requested and browser type. These logs are used only to keep the service running, secure and free from abuse, and are kept for a short period in line with Vercel's standard retention.
Cookies and similar storage
We never use advertising cookies. StoDesk uses your browser's storage for things you'd expect: saving your setup, remembering the wallpaper so the page appears instantly, remembering your analytics choice, and (if you sign in) keeping you signed in. If you use Google's sign-in prompt, Google may set a small cookie to remember whether you dismissed it. These are strictly necessary for the features you choose to use.
The only optional cookies are the Google Analytics cookies described above, and they're only set if you allow analytics.
Why we use your data (lawful bases)
| What | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Account details and synced setup | To provide sign-in and sync, which you asked for | Contract |
| Link title and icon lookups | To show readable titles and icons for your links | Legitimate interests (a useful, expected feature, with minimal data) |
| Usage analytics | To understand how StoDesk is used and improve it | Consent (you can withdraw it at any time) |
| Technical logs | To keep StoDesk secure and working | Legitimate interests |
| Emails you send us | To reply and help you | Legitimate interests |
We don't use your data for automated decision-making or profiling, and we never use it to train AI models.
Who we share data with
We only use a small number of service providers ("processors") to run StoDesk. They may only use your data to provide their service to us:
| Provider | What they do | Location |
|---|---|---|
| Supabase | Account sign-in and storage of your synced setup | Data stored in Ireland, EU (Supabase is a US company) |
| Vercel | Hosting the website and the link title/icon lookup | Global network (US company) |
| Google sign-in, Google Fonts, website icons, and Google Analytics (only if you allow it) | Global (US company) | |
| DuckDuckGo | Backup source for website icons (receives domains only) | US |
Some of these providers may process data outside the UK. Where they do, they're covered by appropriate safeguards such as the UK International Data Transfer Addendum, standard contractual clauses or the UK–US data bridge. We'll only share personal data otherwise if the law requires it.
How long we keep it
- Guest data: stays in your browser until you delete it. We never have it.
- Account and synced setup: kept while your account exists. If you ask us to delete your account, we delete it and your synced setup within 30 days. Backups held by Supabase are cycled out within their standard backup window.
- Analytics: kept by Google Analytics for 14 months, then deleted automatically.
- Emails: kept for as long as needed to help you, then deleted.
Your rights
Under UK data protection law you can ask to access, correct, delete or receive a copy of your personal data, and you can object to or ask us to restrict how we use it. You can do a lot of this yourself: edit anything in StoDesk directly, and use Export setup for a full copy of your data in a portable JSON file. To delete your account or make any other request, email hey@chvrleskelly.com from the address you sign in with. We'll reply within one month.
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Security
StoDesk is served only over HTTPS. Synced data is encrypted in transit and at rest by Supabase, and database rules ensure each account can only access its own data. No system is perfectly secure, so please keep your Google account protected with a strong password and two-step verification.
Children
StoDesk isn't aimed at children. You must be 13 or older to create an account.
Changes to this policy
If we change how we handle your data, we'll update this page and the date at the top. If a change is significant, we'll also let signed-in users know before it takes effect.
Contact
Questions or requests: hey@chvrleskelly.com