Privacy Policy

1. Who We Are

WebDesks (webdesks.app) is a free, browser-based productivity suite offering over 25 tools including a daily planner, calendar, chore organizer, bill tracker, Pomodoro timer, PDF merger, screen recorder, audio mixer, kanban board, and more. WebDesks is operated as an independent project. For questions about this policy, contact us at [email protected].

2. Information We Collect

2.1 Information You Provide

You never need an account to use WebDesks tools, and we do not collect personal information (name, email address, etc.) simply to use them. We actively collect personal information only when you:

• Create an optional account: your email address, a password (stored only as a salted hash by our authentication provider — we never see it), an optional display name and avatar, and the Desk data you choose to sync. Details in Section 2.5.
• Contact form: We collect your name, email address, and message content solely to respond to your inquiry. This data is not used for marketing.

2.2 Information Collected Automatically

When you visit WebDesks, certain information is collected automatically by our hosting provider and third-party services:

• IP address — collected by our hosting infrastructure for security and abuse prevention purposes. Stored for up to 90 days.
• Browser type and version — used to identify and fix compatibility issues across browsers.
• Referring URL — the page you visited before arriving at WebDesks, used to understand traffic sources.
• Pages visited and time spent — used in aggregate to understand which tools are most useful to our users.
• Device type — desktop, tablet, or mobile, for responsive design improvements.
• Country-level location — derived from IP address for regional usage statistics. Precise location is not collected.

2.3 LocalStorage Data (On-Device)

WebDesks stores your preferences and tool data (tasks, calendar events, chores, bills, pages, mood check-ins, kanban board, scratchpad notes, timer settings, Focus Town progress, audio mixer presets and UI themes) in your browser's localStorage. If you don't sign in, this data never leaves your device, is not accessible to us, and is deleted when you clear your browser's site data for webdesks.app.

To work offline, WebDesks also keeps a copy of its own pages and scripts (not your data) in your browser's cache through a service worker, and counts visits on this device (wd-visits) so it only suggests "Add to Home Screen" on a return visit. Neither is sent anywhere.

If you sign in, the same data is also synced to your account as described in Section 2.5, and your sign-in session token is kept in localStorage so you stay signed in. Signing out removes the session token and your Desk data from that browser.

2.4 Files Processed by Tools

Files you process with WebDesks tools — PDFs you merge, videos you convert, screens you record — are handled entirely within your browser's memory. These files are never transmitted to our servers. We have no technical access to the content of files you process.

2.5 Accounts and Desk Sync (Optional)

Creating an account lets you open the same Desk on any device. If you never create one, nothing in this section applies to you.

What we store for an account:

• Account details: email address; a salted password hash (if you use a password); sign-in method; account creation and last sign-in times. If you sign in with Google or another provider, we receive the name, email address and profile picture URL that provider shares with us.
• Profile: the optional display name and avatar emoji you choose.
• Your Desk: the WebDesks data in your browser — tasks, calendar events, chores, bills (names, amounts and due dates), pages and journal entries, mood and energy check-ins, kanban board, scratchpad, timer stats, Focus Town progress and settings. Files you process with tools (PDFs, recordings, conversions) are never included.
• Daily shutdown log: if you press “Shut down day” while signed in, one row per day with your focus minutes, Pomodoro count, number of tasks done and rolled over, and the standup summary text it copied.
• Security logs: our authentication provider records sign-in events, IP address and browser user agent to protect accounts from abuse.

Sensitive information you choose to enter. Mood check-ins, journal pages and bill amounts can reveal information about your health or finances. We store them only so you can access your own Desk; we never analyse, profile, advertise on, sell or share them, and we never use them to train AI models. If you'd rather keep them off our servers, use WebDesks without an account — everything still works on your device.

Why (legal basis): to provide the sync service you asked for (performance of a contract); for sign-in security and abuse prevention (legitimate interest); and, for any special-category data you choose to enter, your explicit choice to store it in your synced Desk (consent, which you can withdraw at any time by deleting the data or your account).

Who processes it: accounts and Desk data are hosted by Supabase, Inc., which acts as our data processor (authentication and database) and runs on Amazon Web Services infrastructure. Transactional emails (account confirmation, sign-in links, password resets) are sent through Supabase or our email delivery provider. Account data is never shared with our advertising partners.

How it's protected: data is encrypted in transit (HTTPS/TLS) and at rest by our provider; database row-level security means each signed-in account can only read and change its own profile and Desk. Desk data is not end-to-end encrypted, so it is technically accessible to our database administrators; we access it only when needed to operate the service, to help you at your request, or where required by law.

Your controls: from the account menu in the app you can edit your profile, Download my data (a complete JSON copy of your Desk and profile), Sign out (which also clears your Desk from that browser), and Delete account, which immediately and permanently deletes your account, profile and cloud Desk. You can also email [email protected] to exercise any right in Section 9.

Public Desk (optional, off by default): if you choose a username and switch on Make my Desk public, anyone with the link webdesks.app/u/<username> can see your display name, avatar, the month you joined and a small summary we publish from your Desk: your Focus Town's name, level, population and building count, your focus streak, Pomodoro count, total focus time and your most-played Sounds preset. Nothing else from your Desk (tasks, notes, calendar, bills, journal) is ever shown. Switch it off in the account menu at any time and the page stops working immediately.

Desk Sponsor: the dashboard may show one sponsor or affiliate card to guests. It is a plain link (marked rel="sponsored", with UTM tags so the sponsor knows the visit came from WebDesks); no third-party ad script runs on the app. We count daily views and clicks per sponsor without storing any user, device or IP identifier.

Ad-free for members: when you're signed in, WebDesks does not load Google AdSense or AADS at all on any page, so those networks receive no request from your visit.

Calendar agenda (.ics link): if you paste a calendar feed link into the dashboard's Calendar Agenda, the link is saved with your Desk (in your browser, and in your account if you sync). To show your agenda, our server fetches that feed on your behalf because calendar providers block browsers from reading it directly. The feed passes straight through to your browser and is not logged or stored on our server; a copy is cached only in your own browser. Remove the link at any time from the widget.

2.6 Survey Says Games

If you host a game (signed in): we store the game name, its questions, its close time, your board edits and all the answers it receives, linked to your account. Only you can see them. Deleting the game, or your account, permanently deletes all of it.

If you answer a survey: we store your answers (up to 80 characters each) and a random identifier created in your browser so the same device can't answer twice. We do not ask for your name, email or account, and the host sees answers without any identifier. Your answers may be shown on screen to the host's audience during the game, so please don't include personal information in them. Answers are kept until the host deletes the game.

Emails: we only send emails you trigger (confirming your address, sign-in links, password resets). We do not send marketing email.

3. Cookies

Cookies are small text files placed on your device by websites you visit. We use cookies in the following ways:

3.1 Essential Cookies

These cookies are necessary for the website to function and cannot be switched off. They are set in response to your actions such as setting your privacy preferences or navigating between pages. They do not store personally identifiable information.

If you sign in, your session is kept in your browser's localStorage (not a cookie) under the key sb-webdesks-auth. It is strictly necessary to keep you signed in, is never used for advertising or tracking, and is removed when you sign out.

3.2 Analytics Cookies

We may use analytics services to understand how visitors interact with WebDesks in aggregate. These cookies collect anonymised information (e.g., page views, popular tools, session duration) and do not identify individual users. Where we use such services, we configure them in a privacy-preserving manner and do not allow them to build user profiles linked to personal identity.

3.3 Advertising Cookies — Google AdSense and DoubleClick

WebDesks uses Google AdSense to display advertisements. Google AdSense uses the DoubleClick cookie to serve ads based on your prior visits to WebDesks and other websites across the internet.

The DoubleClick cookie enables Google and its partners to serve ads to you based on your visit to WebDesks and/or other sites on the internet. Google uses this cookie to improve ad relevance and measure ad performance.

Specifically, Google AdSense may:

• Use the DoubleClick cookie to track ad impressions and clicks on WebDesks.
• Combine data from your visit with data from other websites you have visited to show interest-based advertising.
• Share aggregated, non-personal statistics about ad performance with advertisers.

You can opt out of personalised advertising by visiting Google Ads Settings. You can also opt out via aboutads.info.

For more information about how Google uses data when you visit sites using Google services, see Google's Privacy & Terms.

3.4 AADS Advertising Cookies

WebDesks also uses AADS (a-ads.com), an alternative advertising network. AADS advertisements are served via iframe and may use cookies or similar technologies as described in the AADS Privacy Policy. AADS is designed to be a more privacy-friendly advertising option.

4. Third-Party Services

WebDesks integrates the following third-party services, each with their own privacy policies:

• Google AdSense — advertising platform. Google Privacy Policy
• AADS (a-ads.com) — alternative advertising network. AADS Privacy Policy
• Google Fonts — font delivery via Google's CDN. Google may log font request metadata including IP address.
• open-meteo.com — weather data for the Dashboard widget. Requests include your approximate IP; no personal data is stored by WebDesks from this service.
• Quotable API (api.quotable.io) — inspirational quotes for the Dashboard widget. No personal data is shared.
• Tailwind CSS CDN / unpkg.com — CSS and JavaScript library delivery. These CDNs may log IP addresses as part of standard request logging.
• pdf-lib (via CDN) — PDF processing library that runs entirely in your browser. No document data is transmitted.
• FFmpeg.wasm — media conversion library that runs entirely in your browser. No media data is transmitted.
• Marked.js / Highlight.js — Markdown and code rendering libraries delivered via CDN. No content data is transmitted.
• jsDelivr CDN — delivers FullCalendar (Calendar), Editor.js (Pages), canvas-confetti, chrono (smart dates), Fuse.js (search), SortableJS (drag & drop), simplex-noise (Focus Town terrain), Tone.js (the WebDesks Lo-fi music engine), howler.js (radio playback) and the Supabase sign-in library. These run in your browser; jsDelivr may log IP addresses as part of standard request logging. No content data is transmitted.
• SomaFM (only if you play a Radio station on the Sounds tab) — ad-free, listener-supported internet radio. Your browser streams audio directly from SomaFM's servers and asks them for the current song title, so SomaFM receives your IP address and standard request data. SomaFM Privacy Policy. WebDesks Lo-fi stations and every ambience sound are generated in your browser and make no network requests.
• Supabase (only if you create an account) — authentication and database hosting for accounts and Desk sync, acting as our processor. Supabase Privacy Policy
• Google Sign-In (only if you choose "Continue with Google") — Google shares your name, email and profile picture with us to create your account. Google Privacy Policy
• Cloudflare — hosts the WebDesks website (Cloudflare Pages), serves Public Desk pages and fetches calendar feeds you add to the agenda, and processes standard request logs. Cloudflare Privacy Policy
• Browser notifications (only if you turn on Reminders) — reminders are generated in your browser from your own tasks, events, bills and chores and shown by your operating system. Nothing is sent to us or to a push service.

5. Advertising Networks — Summary

WebDesks is free to use because it is supported by advertising. Here is a plain-language summary of how advertising works on our site:

• We display ads from Google AdSense and AADS on our pages and blog.
• These ad networks may use cookies and similar technologies to serve you relevant ads.
• We do not control which specific ads are shown to you — ad selection is handled by the ad networks.
• We do not share your name, email, or any directly identifying information with ad networks. What is shared is cookie/browser data as described above.
• Advertising revenue funds free access to all WebDesks tools with no subscription or paywall.

If you prefer not to receive personalised ads, use the opt-out links in Section 3.3 above. You may also use a browser with built-in ad tracking protection (such as Firefox or Brave) or an ad blocker. Note that blocking all ads may impact the long-term viability of free access to WebDesks.

6. How We Use Your Information

The limited information collected is used to:

• Operate and maintain the WebDesks website and ensure reliable delivery of tools.
• If you create an account: sign you in, keep your account secure, sync your Desk between your devices, and send the emails you trigger (confirmation, sign-in links, password resets).
• Understand aggregate usage patterns to improve our tools and prioritise new features.
• Serve advertisements through Google AdSense and AADS to fund free access to WebDesks.
• Respond to your contact form submissions and support requests.
• Prevent and investigate abuse, security incidents, and technical problems.
• Comply with legal obligations.

We do not use your data for automated decision-making, profiling, or training machine learning models. We do not use your data for email marketing (we only have your email if you contact us or create an account, and account emails are strictly transactional). The contents of your Desk are never used for advertising.

7. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information in the following limited circumstances:

• With advertising partners — Google AdSense and AADS receive cookie and usage data as described in Sections 3.3 and 3.4. This is not a sale of personal information.
• With our hosting provider — standard server logs (IP address, request data) are processed by our hosting infrastructure.
• With Supabase — if you create an account, Supabase stores your account and Desk data on our behalf under a data processing agreement. Supabase may only process it to provide the service to us.
• For legal compliance — if required by law, court order, or governmental authority, we may disclose information we hold.
• To protect rights — if necessary to protect the rights, property, or safety of WebDesks, our users, or the public.
• Business transfer — in the unlikely event of a merger, acquisition, or asset sale, user data may be transferred as part of that transaction. We will notify users via a prominent notice on this page.

8. Data Retention

• Server access logs: Retained for up to 90 days for security and debugging purposes, then automatically deleted.
• Contact form submissions: Retained for up to 12 months, then deleted.
• Advertising analytics: Data shared with Google AdSense and AADS is subject to their respective retention policies.
• LocalStorage data: Remains on your device until you clear your browser's site data for webdesks.app or sign out. We have no access to this data in your browser.
• Survey Says games and answers: Kept until the host deletes the game or their account.
• Account and cloud Desk data: Kept for as long as you have an account. When you delete your account in the app, your account, profile and cloud Desk are deleted from our live database immediately; copies in our provider's encrypted backups are overwritten within their backup cycle (up to 30 days). Authentication security logs are kept by Supabase for a limited period for abuse prevention. Accounts with no sign-in for 24 months may be deleted after an email notice.
• File processing data: Files you process with WebDesks tools (PDFs, videos, recordings) are handled in-browser and are never retained by us — not even temporarily on our servers.

9. Your Rights (GDPR and General)

Depending on your location, you may have the following rights regarding your personal data. We aim to honour these rights for all users regardless of jurisdiction:

• Access — request a copy of the personal data we hold about you. If you have an account, use Download my data in the account menu for an instant copy; otherwise this will be minimal (contact form data, if applicable).
• Deletion (Right to be Forgotten) — request that we delete your personal data. Account holders can do this instantly with Delete account in the account menu; email requests are fulfilled within 30 days, subject to legal retention obligations.
• Correction — request correction of inaccurate or incomplete personal data we hold.
• Portability — request your personal data in a structured, machine-readable format. Download my data exports your Desk as JSON, and Pages export to Markdown.
• Objection — object to our processing of your personal data where we rely on legitimate interest as our legal basis.
• Restriction — request that we restrict processing of your personal data in certain circumstances.
• Opt-out of personalised advertising — opt out of personalised ads via Google Ads Settings.
• Do Not Track — we honour Do Not Track browser signals where technically feasible.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or as required by applicable law). You may also have the right to lodge a complaint with your local data protection supervisory authority.

For EEA/UK users (GDPR): Our legal basis for processing the limited data we collect is legitimate interest (operating and improving WebDesks), our contractual obligation to respond to your contact requests and, if you create an account, performance of our contract with you to provide sign-in and Desk sync (see Section 2.5). For advertising-related processing, Google's and AADS's legal bases are governed by their own policies. You can withdraw consent for personalised ads at any time using the opt-out links above.

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights:

Categories of Personal Information Collected

In the past 12 months, we may have collected the following categories of personal information:

• Identifiers — IP address (automatically), name and email address (only if you contact us via the contact form or create an account).
• Account and customer records — if you create an account: email, display name, sign-in method, and the Desk content you choose to sync (which may include information you enter about bills, mood or other personal matters).
• Internet or Network Activity — pages visited, referring URLs, browser type, device type.
• Inferences — country-level location derived from IP address.

We have not collected: Social Security numbers, bank or card account numbers, biometric data, geolocation data beyond country-level, or the content of files you process with our tools. We do not ask for financial or health information; if you have an account and choose to record bills or mood entries in your Desk, we store that content only to provide it back to you and never use it to infer characteristics about you.

Your California Rights

• Right to Know: You may request details about the personal information we have collected about you and how it is used and shared.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions (e.g., security logs required by law).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: WebDesks does not sell personal information. We do share limited data with Google AdSense and AADS for advertising purposes, which may be considered "sharing" under CPRA. You may opt out via Google Ads Settings.
• Right to Limit Use of Sensitive Personal Information: We do not request sensitive personal information as defined by CPRA. Account passwords are handled only as hashes by our authentication provider, and anything sensitive you choose to write in your Desk (such as mood entries) is used solely to provide it back to you — a permitted purpose — and never to infer characteristics about you.
• Right to Non-Discrimination: We will not deny you service, charge different prices, or provide different service quality if you exercise your CCPA/CPRA rights. All WebDesks tools remain free to use.

To exercise California privacy rights, contact us at [email protected] with the subject line "California Privacy Rights Request." We will respond within 45 days as required by CCPA. Requests can be made up to twice per 12-month period at no charge.

11. Children's Privacy

WebDesks is not directed to children under the age of 13. You must be at least 13 to create an account (or older where your country requires — for example, 16 in some EU countries unless a parent or guardian consents). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at [email protected] and we will take steps to delete that information promptly.

If you are between 13 and 16 years old and located in California, you have the right to opt-out of the "sharing" of your personal information for targeted advertising. Contact us at the email above to exercise this right.

12. International Users

WebDesks is operated from infrastructure that may be located in various countries. If you are accessing WebDesks from outside the United States, please be aware that information collected by our hosting provider may be processed in the US, where privacy laws may differ from your jurisdiction. Account and Desk data is stored in the region of our Supabase project; where it is transferred out of the EEA or UK, it is protected by the European Commission's Standard Contractual Clauses included in Supabase's data processing agreement.

For users in the European Economic Area (EEA) and the United Kingdom: We collect minimal personal data. Without an account, all tool data (files, notes, tasks) stays on your device and is never processed by us. If you create an account, Supabase processes your account and Desk data as our processor under a data processing agreement, and you have full data subject rights over it, as well as over the limited server log data we hold, as described in Section 9.

For users in Canada (PIPEDA): We collect only the minimum personal data necessary for legitimate operational purposes and do not use it beyond those purposes. You may request access to or correction of your personal data at any time.

For users in Australia (Privacy Act): We comply with the Australian Privacy Principles. You have the right to access and correct personal information we hold about you and to make a privacy complaint to the Office of the Australian Information Commissioner.

13. Security

We implement industry-standard security measures to protect the WebDesks website and any personal data we hold, including encrypted connections (HTTPS), access controls, and regular security reviews.

Without an account, your tool data (files, notes, tasks, recordings) is stored entirely in your browser's localStorage and memory and is never transmitted to us, so its security rests with your device, browser, and operating system. We recommend keeping your browser updated and using trusted devices.

If you create an account, your Desk is sent over HTTPS and stored encrypted at rest by Supabase. Database row-level security restricts every account to its own data, passwords are stored only as salted hashes by Supabase Auth, and the sign-in page cannot be embedded in other sites. Use a unique password, and sign out on shared computers — signing out also removes your Desk from that browser.

If you discover a security vulnerability in WebDesks, please report it responsibly to [email protected]. We take all security reports seriously and will respond within 72 hours.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, tools, or legal requirements. We will indicate the date of the most recent revision at the top of this page and add a changelog note. For significant changes, we will also publish a note on the WebDesks blog.

Continued use of WebDesks after changes are posted constitutes your acceptance of the revised policy. If you do not agree to the revised policy, please discontinue use of WebDesks.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

• Email (general privacy): [email protected]
• Email (CCPA/legal requests): [email protected]
• Contact form: webdesks.app/contact

We aim to respond to all privacy requests within 30 days.