01Who we are
DeskTick is operated by LoudOwls, a company based in India ("we", "us"). This policy covers desktick.com and the DeskTick apps and command-line tool.
We offer DeskTick in India, the United Arab Emirates, Canada, the United States and Australia, and people elsewhere use it too. The same policy applies to everyone; where the law of your country gives you something more, the section "Where you live" says so.
For anything about your data, write to [email protected].
02Two kinds of data, and who is responsible for each
Your account and your developer profile are yours, and we decide how they are handled: for those we are the party responsible.
Work that happens inside a company's workspace — its projects, tasks, notes, boards, time records and reports — belongs to that company. The company decides what is collected there and is responsible for it; we handle it on their instructions. Questions about a workspace's data are best put to the company first.
03What we collect
Only what the product needs to work:
- Your account: name, email address, a password (stored hashed, never readable), and, if you use them, your Google sign-in, authenticator secret, backup codes and passkeys.
- Your profile: photo, headline, bio, skills, languages, city and country, time zone, work history, education, certifications, links, your CV if you upload one, and your preferences about work.
- Optional and private details: phone number, date of birth, addresses, an identity document and a bank account. These are asked for only when there is a reason, and the document and bank details are encrypted where they are stored.
- The record of your work: when an engagement with a company started and ended, hours and sessions tracked, and counts of commits and pull requests. These are recorded by the product and nobody can edit them, including us.
- Accounts you connect: for GitHub, Bitbucket, LinkedIn and LeetCode we keep proof that the account is yours and figures about your activity. We never read a repository, an organisation or an employer.
- Hiring: invitations, messages between you and a company, interview rounds, offer letters and signatures.
- Security records: when and from where your account was signed in to — IP address and browser — so we can warn you about a sign-in that was not you.
- Payments: if you pay for a workspace, our payment provider handles your card. We receive the plan, the amount and the status, not the card number.
We do not buy data about you from anyone, and we do not build an advertising profile.
04What we use it for
- To run your account and show your profile to the people you chose to show it to.
- To record work and produce reports for the workspace that work was done in.
- To let companies find and invite developers who have listed themselves.
- To keep accounts safe: verifying email addresses, checking unusual sign-ins, limiting abuse.
- To send email you need — verification, security notices, invitations, receipts. We do not send marketing email without asking.
- To take payment for workspace plans.
- To meet legal obligations, such as keeping billing records.
05Where AI is used
Some features use a language model: reading a CV you upload to fill in your profile, writing session reports, and the assistant on a whiteboard. For those, the text involved is sent to our AI provider to produce the result and is not used by us to train models.
Nothing is decided about you by a machine alone. A profile's figures and medals are computed by fixed rules from the recorded work, and you can see what each one is based on.
06Who sees what
- Your profile is unlisted to start with. It is public only if you list it, and you can be listed and not looking.
- Each engagement is yours to set: public, anonymous — the dates and hours without the company's name — or hidden. Public totals are counted only from what you publish.
- Your email address and phone number are not on your profile unless you switch each one on.
- Your identity document is never on your profile. Document and bank numbers are shown back masked, even to you.
- Phone, date of birth and addresses are released to a company only once it has hired you, for payroll and documents.
- A company whose workspace you belong to sees the work recorded there.
07Other companies that handle data for us
We use a small number of providers to run the service. Each handles data only to do its job for us:
- Hosting and databases: Amazon Web Services, Fly.io, Neon and Vercel.
- File storage: Cloudflare R2 (photos, CVs, documents, offer letters).
- Email: Resend.
- Payments: Stripe.
- AI features: Anthropic.
- Sign-in and connected accounts, when you choose them: Google, GitHub, Bitbucket, LinkedIn.
- Fonts: Google Fonts, which receives your IP address when a page loads them.
We do not sell personal data, and we do not share it for anyone else's marketing.
08Where it is kept
We are based in India and our providers run servers in other countries, including the United States. Wherever you use DeskTick from, your data is processed in those places, and may be reachable by courts and authorities there. If you are in the European Economic Area or the United Kingdom, the GDPR page says what that means for you.
09How long we keep it
For as long as you have an account, and no longer than we need after that.
If you ask to delete your account, nothing happens for 60 days — signing in during that time calls it off. Then your profile, documents, bank details, connected accounts, sign-in records and your email address are erased.
What stays is the record a company holds of work done with it: the hours on an engagement, the hiring conversation, and projects and tasks in its workspace. Those are the company's records too. They remain, attributed to a deleted account, with your name removed.
Billing records are kept for as long as tax law requires.
11Security
Connections are encrypted. Passwords are hashed. Identity documents, bank details and authenticator secrets are encrypted where they are stored. You can add two-step sign-in, and we email you about sign-ins that look unusual.
No system is perfectly secure. If something goes wrong that affects your data, we will tell you and the authorities as the law requires.
12Your choices
- See and correct what you have given us, from your profile.
- Hide an engagement, unlist your profile, or stop invitations, at any time.
- Disconnect a connected account or remove a document.
- Delete your account.
- Ask us for a copy of your data, or anything else about it, at [email protected].
The recorded figures on an engagement cannot be edited — by you, by a company or by us. That is what makes them a record. You control whether they are shown.
13Where you live
The choices above are yours wherever you are. On top of them, the law where you live gives you these:
- India (Digital Personal Data Protection Act, 2023): to know what we hold and how it is used, to have it corrected or erased, to withdraw consent, to name somebody to act for you if you cannot, and to have a grievance answered. Write to [email protected]; if you are not satisfied with our answer you can go to the Data Protection Board of India.
- United Arab Emirates (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data): to access, correct and erase your data, to restrict or stop its processing, to receive it in a portable form, and to object to automated processing. You can complain to the UAE Data Office.
- Canada (PIPEDA, and provincial laws such as Quebec's Law 25): to access and correct your personal information, to withdraw consent, and to know that it is processed outside Canada, where foreign authorities may be able to reach it. You can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.
- United States (state privacy laws, including California's CCPA): to know what we collect and why, to get a copy, to correct it and to have it deleted, and not to be treated differently for asking. We do not sell personal information and we do not share it for cross-context advertising, so there is nothing to opt out of. You may use an authorised agent to make a request.
- Australia (Privacy Act 1988 and the Australian Privacy Principles): to access and correct your personal information, and to complain to us and then to the Office of the Australian Information Commissioner. Your information is handled overseas, in the countries named under "Where it is kept".
- The European Economic Area, the United Kingdom and Switzerland: see the GDPR page.
To use any of these, write to [email protected] from the address on your account. We do not charge for it, and we answer within the time your law sets — within 30 days in any case.
14Children
DeskTick is for people who work. It is not meant for anyone under 18, and we do not knowingly collect data from them.
15Changes, and how to reach us
If this policy changes in a way that matters, we will say so on this page and, where it affects you, by email before it takes effect.
Questions and complaints: [email protected]. We answer complaints about how your data is handled from that address.