Privacy policy

What we store

• Your account: your name and email address, and your profile picture if you sign in with Google. If you sign up with email and a password, we store the password only as a one-way hash.
• What you put in Offdesk: tasks, docs, comments, images and other attachments, teams and the people you invite.
• Sessions: when you sign in we keep a session with the IP address and browser or app it came from, so you stay signed in and we can spot misuse.
• Connected agents and computers: the agents you authorize (for example Claude Code or Codex over MCP) and the Offdesk Dev computers you pair, with the access you granted them.
• Devices for notifications: if you allow notifications in the Android app, a push token for that device.

How we use it

• To run Offdesk: show your work to you and the teammates and agents you share it with, send the notifications and emails you ask for, and keep the service secure.
• We don’t sell your data, don’t show ads, and don’t use third-party analytics or advertising trackers on offdesk.so or in the apps.
• We don’t use your content to train AI models.

Who processes it for us

We use these providers to run Offdesk. They process data only to provide their service to us.

• Render (hosting) and Supabase (database): where Offdesk runs and your data is stored.
• Cloudflare: attachments and app downloads, DNS, and network protection.
• Google Cloud: the relay servers that connect paired Offdesk Dev computers. Terminal traffic passes through them; we don’t log its contents.
• Temporal: running scheduled background work, such as reminders.
• Firebase Cloud Messaging (Google): delivering push notifications to the Android app.
• Zalify: sending email from hello@offdesk.so (sign-in links, invitations, notifications).
• Anthropic, through Vercel’s AI Gateway: when you add a task from the new-task box, what you typed and the screenshots you attached are sent to Claude, with your team members’ names and time zones, so it can write the task’s title, details, assignee and due date.
• Google: if you choose Sign in with Google.

Cookies and local storage

• One session cookie keeps you signed in. The site remembers your light or dark theme in your browser. Nothing else, and no tracking cookies.

Your choices

• You can edit or delete your tasks, docs and comments at any time, and remove agents and computers you connected.
• To get a copy of your data or have your account and everything in it deleted, email hello@offdesk.so from your account’s address. We delete it within 30 days, apart from what we must keep by law.
• Content you shared with a team stays with that team when you leave it, like any shared workspace.

Security and storage

• Data is encrypted in transit, and credentials for connected computers are encrypted at rest. We keep your data while your account exists.
• Our providers may process data outside your country, including in the United States.

Children

• Offdesk isn’t meant for children under 16, and we don’t knowingly collect their data.

Changes

• If we change this policy we’ll update this page and its date, and tell you by email or in the app when the change matters.