Privacy

What DeckSpace stores, and who else sees it

Last updated 18 August 2026

Written to describe what the software actually does, not to cover every eventuality. If something here is unclear or looks wrong, tell me and I'll fix the page or the behaviour.

DeckSpace is operated by Dr. Li, an individual, not a company. For anything in this policy — including a request to see or delete your data — write to hello@deckspace.org.

What is collected

• Your account — email address, display name, and a password stored only as a scrypt hash. The plain password is never written down anywhere.
• What you make — your decks (the HTML itself), their titles, the spaces you organise them into, comments, and the conversation history for decks built with AI.
• Your AI API key, if you add one. It is encrypted at rest with AES-256-GCM and is used only to make your own requests. It is never sent anywhere except to the AI provider you chose.
• Tokens — the random token in each share link, and your publish token for connecting an AI client.
• Ordinary server logs, kept by the hosting provider: IP address, timestamp, path, user agent. Those are the host's, not mine — I do not read them for analytics, and they are not the source of the counters below.
• Ten counters. A row is written when the homepage is opened, an account is created, someone signs in, a share link is turned on, a share page is opened, a deck is served, or a deck is published. Each row is an event name, a timestamp, and a one-way tag derived from your IP address — never the address itself. The tag is salted with the server's secret and the day, so it cannot be turned back into an address, cannot be matched against anything else, and becomes a different value tomorrow. It exists for one purpose: counting how many people opened a page rather than how many times it was opened. No user agent, no cookie, no account is attached, and nothing links a visit to you across days.
• Error counts. When something fails — an AI generation, a publish — a row records which part failed, a short reason from a fixed list (“no API key”, “rate-limited”, “timed out”), and the time. Never the error message itself: that text comes from the AI provider and can repeat back whatever was sent to it. No account, no deck, nothing you wrote. Kept 90 days, then deleted.
• Token counts. When an AI request finishes, a row records how many tokens it used, which part of the app made it (“create”, “chat”, “edit”), and which provider answered. Nothing about the request itself: not your prompt, not the reply, not the deck, not your account. It exists to answer “where does the compute go”, and it cannot be traced to a person — there is no column that would allow it. Kept 90 days, then deleted.

What is not collected

No third-party analytics. No tracking pixels, no advertising networks, no third-party scripts of any kind on this site or in the app — the counters described above run on this server, send nothing anywhere, and store no name, address, account, or any value that outlives the day it was written. Nothing about you is sold or shared for marketing, because there is no marketing apparatus to share it with.

Cookies: exactly one. od_session keeps you signed in — HttpOnly, SameSite=Lax, thirty days. It is strictly necessary to operate the service, which is why there is no cookie banner asking you to consent to things that don't exist here.

Where it lives, and who else can see it

• Fly.io hosts the application and stores uploaded deck files, in the United States (primary region San Jose).
• Neon provides the Postgres database holding accounts, deck records and comments.
• Anthropic or OpenAI receive the content of your prompts and decks — but only when you have supplied your own API key and you run a generation. Their handling of that content is governed by your agreement with them, not by this policy.

Nobody else. There is no data broker, no CRM, no email marketing platform in the path.

Sharing is a decision you make

A deck is private until you turn sharing on. When you do, its link contains a long random token and anyone holding that link can read the deck without signing in — that is what makes it useful, and it is worth being explicit about. Turning sharing off makes the link stop working. Rotating your publish token invalidates every AI client that was using the old one.

Keeping and deleting

Your content is kept until you delete it. Deleting a deck removes the deck, its stored HTML and its comments. Server logs are retained by the host on their own schedule, typically a matter of days.

The counters are kept as individual rows for 90 days, then collapsed into permanent daily totals — a date, an event name, a number. Because a row never held anything about a visitor, there is nothing in either form to delete on request and nothing to hand over: the totals are not about anyone.

There is no self-serve "delete my account" button yet — that is a gap, and until it exists, email hello@deckspace.org and I will delete the account and everything in it, and confirm when it's done.

You can ask for a copy of your data, a correction, or deletion, at any time and for any reason. If you are in the UK, EU or California, you have those rights under law; you have them here regardless of where you are.

Children

DeckSpace is not intended for anyone under 16, and accounts are not knowingly created for them.

Changes

If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and — for anything material — you get an email. Questions: hello@deckspace.org.