Privacy Policy

Last updated August 2026.

What we store

Your account details (email and display name), and the content you create in Workspace Deck: notebooks, notes, tasks, tags, and file attachments you upload. Notes and tasks can be created and used offline and sync when you reconnect.

Microsoft 365 (optional)

If you connect a Microsoft 365 account, we request only the access needed for the features you use, and we ask for consent before connecting:

• Calendar (read & write). We mirror your calendar events to build your agenda, and — when you create an event from within Workspace Deck — we add that event to your calendar. We do not modify or delete events you did not create here.
• Email (read only). We show a list of your recent inbox messages on your dashboard so you can turn one into a task or note. We do not send email from your mailbox, and we do not store message bodies.
• OneNote (read only). Used only when you choose to import notebooks.

Your Microsoft refresh token is encrypted at rest. You can disconnect any connected account at any time, which stops all further access.

Google (optional)

If you connect a Google account, we request only the access needed for the features you use:

• Google Calendar (read & write). Connected with your consent through Google sign-in. We mirror your events to build your agenda and add events you create in Workspace Deck. We do not modify or delete events you did not create here.
• Gmail (read only). Connected over IMAP with an app password you generate in your Google account and paste into Workspace Deck. We show a list of your recent inbox messages on your dashboard so you can turn one into a task or note. We do not send email from your mailbox, and we do not store message bodies.

Your Google sign-in token and Gmail app password are encrypted at rest. You can disconnect either at any time, which stops all further access.

AI features

Optional AI features (plan-my-day, note summaries, extracting tasks from a note) run on the operator's own self-hosted model. The relevant note text, meeting, and task details are sent to that self-hosted model to produce the result; they are not sent to any third-party AI provider and are not used to train models.

Voice notes & recordings

If you record a voice note, the audio is stored with your account and transcribed to text by a self-hosted speech-to-text model on the operator's own infrastructure — the audio is not sent to any third-party service. Meeting capture, when you choose it, records your microphone together with your computer's audio (the other participants) locally in your browser; nothing is captured until you start a recording and pick what to share. Transcripts may include automatically-generated speaker labels. You can delete a recording at any time. Please make sure you have consent from the other participants before recording a meeting; recording laws vary by location and are your responsibility.

Email we send

We send transactional email — address verification and password resets — to the address on your account. We do not send marketing email without your consent.

Data isolation & security

Every workspace's data is isolated at the database layer (row-level security), so one workspace can never read another's. Passwords are stored only as salted hashes; connected-account tokens and other secrets are encrypted at rest. We do not sell your data or use your notes for advertising.

Shared workspaces

If you create or join a shared workspace, its notes, tasks, and calendars are visible to the other members of that workspace. Content you keep in your personal workspace is visible only to you.

Your rights

You can export your data (notebooks, notes, and tasks) as a JSON file, and permanently delete your account, from your profile in the app. Deleting your account removes your personal workspaces and their content, and removes you from any shared workspaces; content owned by other members of a shared workspace is not deleted.

Retention

We keep your data for as long as your account is active. When you delete your account, its data is removed from our live systems; residual copies in encrypted backups age out on our normal backup rotation.

Contact

Questions or requests: privacy@workspacedeck.com.