Privacy Policy

01What we collect

We collect three categories of data:

• Account data — your name, email, and workspace details, managed through our auth provider (Clerk).
• Deck & link data — files you upload, the tracked links you mint, and their access settings.
• Engagement data — when a recipient opens a link: timestamp, time-on-slide, loops, approximate location (city, derived from IP), and device/browser.

02How we use it

Engagement data powers your analytics — the heatmaps, attention reports, and notifications. Account data runs your workspace and billing. We use aggregate, de-identified data to improve the product. We do not use your decks or recipient data to train AI models.

03Recipient data & your role

When you share a deck, you are the data controller for your recipients and Deky is the processor. You're responsible for having a lawful basis to track them. We give you the tools — tracking disclosure, anonymous mode, and per-link revocation — to do this compliantly.

04Who we share with

We never sell personal data. We share only with the subprocessors above, under data-processing agreements.

05Retention

Engagement data is retained for the life of the deck plus 90 days, or until you delete it. Deleted workspaces are purged within 30 days. Billing records are kept as required by tax law.

06Your rights

Depending on your region (GDPR, CCPA), you can access, export, correct, or delete your data. Email privacy@deky.app — we respond within 30 days. Recipients can request deletion of their engagement data through the sender or directly.

07Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256). Data is stored in US regions. Originals are purged after processing; we render decks to per-slide images and keep only those.

To report a security vulnerability, see our Security & Disclosure policy or email security@deky.app.