DeckSpace
Menu
Templates Data stories Pricing Sign in

Privacy

What DeckSpace stores, and who else sees it

Last updated 26 September 2026

Written to describe what the software actually does, not to cover every eventuality. If something here is unclear or looks wrong, tell me and I'll fix the page or the behaviour.

DeckSpace is operated by Dr. Li, an individual, not a company. For anything in this policy — including a request to see or delete your data — write to hello@deckspace.org.

What is collected

  • Your account — email address, display name, and a password stored only as a scrypt hash. The plain password is never written down anywhere.
  • What you make — your decks (the HTML itself), their titles, the spaces you organise them into, comments, and the conversation history for decks built with AI.
  • Your AI API key, if you add one. It is encrypted at rest with AES-256-GCM and is used only to make your own requests. It is never sent anywhere except to the AI provider you chose.
  • Tokens — the random token in each share link, and your publish token for connecting an AI client.
  • Ordinary server logs, kept by the hosting provider: IP address, timestamp, path, user agent. Those are the host's, not mine — I do not read them for analytics, and they are not the source of the counters below.
  • Counters. A row is written when the homepage is opened, an account is created, someone signs in, a share link is turned on, a share page is opened, a deck is served, published, edited by an AI client or downloaded, a comment is posted, an AI build starts, or an AI build or edit produces a change. The homepage adds a few of its own: that a way to start was chosen (create or bring), a look was picked, the connection guide was opened, an upload was started, a sign-up link was followed (and whether it was the header, the hero, the closing section, the editor's invitation, a link in an email, or the in-app sign-up sheet and the action that opened it), the registration page was shown (and, on it, that someone moved or typed, began the form, or pressed to create the account), or a workspace's account sheet was opened or declined — never the words you typed, the file, or which look. Each row is an event name, a timestamp, for an action taken while signed in whether the account is in its first week (only that label — never the account or its signup date), and a one-way tag derived from your IP address — never the address itself. The tag is salted with the server's secret and the day, so it cannot be turned back into an address, cannot be matched against anything else, and becomes a different value tomorrow. It exists for one purpose: counting how many people opened a page rather than how many times it was opened. No user agent, no cookie, no account is attached, and nothing links a visit to you across days.
  • Time on page. When you leave the homepage, a shared deck or the app, the number of seconds the page was on screen is recorded with the page's name, a timestamp and, if you are signed in, whether your account is in its first week — no tag, no address, no account, nothing that links it to you or to any other visit. Kept 90 days, then deleted.
  • Error counts. When something fails — an AI generation, a publish — a row records which part failed, a short reason from a fixed list (“no API key”, “rate-limited”, “timed out”), and the time. Never the error message itself: that text comes from the AI provider and can repeat back whatever was sent to it. No account, no deck, nothing you wrote. Kept 90 days, then deleted.
  • Token counts. When an AI request finishes, a row records how many tokens it used, which part of the app made it (“create”, “chat”, “edit”), and which provider answered. Nothing about the request itself: not your prompt, not the reply, not the deck, not your account. It exists to answer “where does the compute go”, and it cannot be traced to a person — there is no column that would allow it. Kept 90 days, then deleted.
  • Model routing. When a build chooses its AI model by the brief’s complexity, a row records the complexity score, which tier it picked, the token counts, and a coarse plan band. Never your account, your deck, or your prompt. Like the token counts, it answers “is the routing sane” and cannot be traced to a person. Kept 90 days, then deleted.

What is not collected

No third-party analytics. No tracking pixels, no advertising networks, no third-party scripts of any kind on this site or in the app — the counters described above run on this server, send nothing anywhere, and store no name, address, account, or any value that outlives the day it was written. Nothing about you is sold or shared for marketing, because there is no marketing apparatus to share it with.

Cookies: exactly one. od_session keeps you signed in — HttpOnly, SameSite=Lax, thirty days. It is strictly necessary to operate the service, which is why there is no cookie banner asking you to consent to things that don't exist here.

Where it lives, and who else can see it

  • Fly.io hosts the application and stores uploaded deck files, in the United States (primary region San Jose).
  • Neon provides the Postgres database holding accounts, deck records and comments.
  • Anthropic (or OpenAI) receives the content of your prompts and decks when you run a generation. With your own API key the request goes on your key, and their handling is governed by your agreement with them — nothing is proxied through us. On DeckSpace's own model (when you generate without a key), the request goes on our key: those prompts are not retained after generation and never used for training, and the credit meter records only token counts and the derived cost — never your content.
  • Stripe processes payments if you buy credits or subscribe. Your card details go straight to Stripe and never touch DeckSpace; we keep only your plan, a Stripe customer reference, and your credit balance.

Nobody else — no data broker, no CRM, no ad network, no email marketing platform in the path.

Sharing is a decision you make

A deck is private until you turn sharing on. When you do, its link contains a long random token and anyone holding that link can read the deck without signing in — that is what makes it useful, and it is worth being explicit about. Turning sharing off makes the link stop working. Rotating your publish token invalidates every AI client that was using the old one.

Keeping and deleting

Your content is kept until you delete it. Deleting a deck removes the deck, its stored HTML and its comments. Server logs are retained by the host on their own schedule, typically a matter of days.

Before you sign up, what you bring or start here stops being reachable 24 hours after your last change and is then deleted — the deck and its history go with it. Signing up keeps everything as it is.

The counters are kept as individual rows for 90 days, then collapsed into permanent daily totals — a date, an event name, a number. Because a row never held anything about a visitor, there is nothing in either form to delete on request and nothing to hand over: the totals are not about anyone.

There is no self-serve "delete my account" button yet — that is a gap, and until it exists, email hello@deckspace.org and I will delete the account and everything in it, and confirm when it's done.

You can ask for a copy of your data, a correction, or deletion, at any time and for any reason. If you are in the UK, EU or California, you have those rights under law; you have them here regardless of where you are.

Children

DeckSpace is not intended for anyone under 16, and accounts are not knowingly created for them.

Changes

If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and — for anything material — you get an email. Questions: hello@deckspace.org.