Privacy policy

Deskthaw is run by Anton. This page says what the website collects, who touches it, and how to get it removed. Questions go to [email protected].

What the website collects

When you join the waitlist, reserve a preorder, or leave your email beside the beta download, the form sends the following, and the server stores it with the dates and flags it keeps itself:

• your email address;
• which form you used: waitlist, reserve for the preorder form, or beta for the one beside the download;
• whether you ticked "I'd buy this for my team" and the team size you typed, if any (the waitlist form has these, and the other forms do not);
• the moves you asked for first, if any (the waitlist form has these);
• on the preorder form, when the site has no checkout link yet, a note saying so, so that the payment link is sent to you by email instead;
• your browser's platform string (for example "MacIntel"), and the campaign tag in the link you arrived through, if there was one, so we know which channels bring people in. If there was none it is recorded as "direct". The form beside the beta download records "beta" instead, with the channel or campaign tag after a slash when there is one; on a record that already exists, that tag is added beside the original rather than replacing it. The page does not read the referring website.
• the time you first signed up, the time you were last seen, whether and when you confirmed the address, which emails the forms you used promised you, and whether each email has been sent yet, so a repeat submit does not send you the same email twice.

That record is stored in Cloudflare Workers KV, a key-value store on Cloudflare's network. It is used to send you the confirmation email, the two-question email if you ticked the team box, and launch and progress updates. Every one of those carries an unsubscribe link. A preorder receipt does not: it is a record of a purchase you made, not a mailing you can leave.

Before any of that, a new address gets one email: a link to confirm the address is yours, which works for seven days. Until the link is used, the forms send that address nothing else; a preorder receipt from a checkout you complete still arrives, because it is the purchase, not a mailing. An address that unsubscribed goes through the same step to sign up again. That email has no unsubscribe link, because it is the one kind of email the forms send an unconfirmed address; a form submitted again after the link has expired sends a fresh link. The preorder form's checkout does not wait for it.

An email left beside the beta download goes on the same list, under the same record, with the same unsubscribe and the same retention as the waitlist; it adds a short confirmation and mail about the beta changing or ending. Nothing else is linked to it. In particular it is never joined to the beta app's install id or to the counts the app may send, which carry no email address.

Your IP address

When you submit a form, your IP address is used for two things and is not part of the signup record. It is sent to Cloudflare so Turnstile can check the submission is not a bot, and it is counted against a short-lived rate limit, stored in the same Cloudflare KV store under a key that contains the address (for an IPv6 address, its first half, the network part) and expires within minutes. It is not used to identify you, is not attached to your signup, and is not shared with anyone else.

Bot check, analytics and cookies

The forms and the beta download button run Cloudflare Turnstile, a bot check that replaces a captcha. Turnstile is provided by Cloudflare under its own privacy policy. Beta downloads are counted per channel and day, with the app version and nothing about the person: no IP address, no browser details, no id.

The site counts visits with Cloudflare Web Analytics. It sets no cookies and does not fingerprint visitors, but it does read how long the page took to load from your browser. You can turn it off for this browser here, and it is already off if your browser sends Global Privacy Control or Do Not Track, or blocks site storage. Visitors whose browser is set to an EU or EEA time zone are not counted at all; the page reads that time zone inside your browser, and nothing about it leaves your browser. This page is never counted, so turning it off here takes effect at once.

Deskthaw sets no cookies of its own and runs no advertising trackers. Two services the site depends on can set their own, for security or payment and nothing else. Cloudflare may set a short-lived security cookie, such as __cf_bm or cf_clearance, when it checks traffic for abuse, and the Turnstile check runs in a Cloudflare frame that can keep its own storage. If you preorder, Stripe's checkout page, which is Stripe's site and not this one, sets its own cookies for payment and fraud prevention.

Email

Emails are sent from [email protected] through Resend, an email delivery service. Replies to any of them, the team questions included, reach Anton directly.

Payments

Preorders run through Stripe Managed Payments, where Stripe is the merchant of record for the transaction. Stripe handles the checkout page, card details, receipts, sales tax, refunds and disputes under its own privacy policy, as its own data controller rather than as a service acting for Deskthaw. Receipts are delivered through Link, Stripe's payment and receipt service, so the sender and the statement line may both read Link. Deskthaw never sees your card number. The preorder form opens Stripe's checkout with the email you typed already filled in, so it reaches Stripe from the page as well.

What Deskthaw does receive from Stripe, and store in Cloudflare KV, is your email address, the Stripe session and payment references, the amount and currency, the time of the order, its payment status, and, if you are refunded, the refunded amount and when. These are kept as their own records, separate from any waitlist record you may also have; a preorder placed without JavaScript may have no waitlist record at all. To have data held by Stripe removed, ask Stripe: a deletion by Deskthaw cannot reach it.

The app

Deskthaw the Mac app has not been released. A beta build is being handed out while it is tested. It runs on your Mac: no account, nothing that checks in with a server to keep it running, and it works with the network switched off. It asks for no camera, microphone, screen recording, accessibility, calendar or focus permission. If you switch on "Open Deskthaw at login", macOS shows you its own notice about that; nothing else is registered anywhere. One thing can use the network, and it stays off unless you choose to share beta counts, at first run or later from the menu. It is described next.

The app also keeps a short log on your Mac, in Library/Logs/Deskthaw in your home folder: when it started and quit, when it was waiting and why, for example a call or you being away, and whether each move reached the screen. It names no app and no window. It is never sent anywhere, and "Remove local data and quit" deletes it. If you write in about a problem, you may be asked to look at it and send it yourself.

Beta app: the counts you can choose to share

The third screen you see at first run asks one question, with two buttons of equal weight and neither preselected: "Share beta counts" or "Don't share". Until you press one, nothing at all leaves your Mac. If you choose not to share, nothing does unless you later switch sharing on. You can change the answer in the menu at any time; switching it off throws away anything not yet sent, and switching it on starts counting at the next UTC midnight, so a day never holds two separate runs of numbers.

If you do share, a first message goes out straight away, each time you switch sharing on, with the id, the version and no days in it. After that it goes out normally once a day, for days that are over and no others: today's counts are never sent, because a day that is still being counted could change. A send that fails is tried again a few hours later. This is the whole message, and there is nothing else in it:

{"id": "a random id made on your Mac at first launch",
 "v": "the app version",
 "days": [{"d": "2026-10-03", "shown": 4, "done": 3, "skipped": 1}]}

That is the identifier, the version, and for each day you used it how many moves were shown, how many you did and how many you skipped. The id is random, made on your machine, and is not derived from anything about you or your Mac. This page does not call it private or unidentifiable: it is one identifier that stays the same, which is what lets a day be counted once instead of twice, and an identifier that stays the same is by definition a way to tell one install from another. There is no name, no email address, no hostname, no list of your apps, no move names, and no time finer than the day.

A finished day on which no move was shown produces no request at all.

The server adds one thing your Mac did not send: the date your id first arrived. It keeps one record for your install, holding that date, the app version, and the three counts under each date your app reported. The record is deleted automatically ninety days after the last report.

Like any web request, this one reaches the server through Cloudflare and carries your IP address. The server keeps it in exactly one form and no other: a scrambled one, a keyed hash, which cannot be turned back into the address, so that a daily limit can exist without a daily record of who asked. That expires within a day. Your address is not written into your record, and the site's code never writes it into its logs either; a refused request is logged as a reason and that same scrambled form. Cloudflare's own security and traffic logs may record IP addresses, under Cloudflare's privacy policy.

To have the server's records deleted, email your install id to [email protected]. The menu has "Copy my install id", and "Remove local data and quit" shows it to you before it deletes anything, because the id is the one handle on those records. Removing the app from your Mac does not delete them; the email does, and they expire on their own after ninety days either way. When you email to have them deleted, the server keeps a one-way hash of the install id and nothing else for a year, so that the id cannot start a new record.

The beta stops working forty-five days after you first launch it, and in any case on a date fixed when the build was made. It works that out on your Mac; it does not ask the network for permission to keep running.

Retention

Waitlist records are kept until Deskthaw ships and for twelve months after, then deleted. If Deskthaw stops without shipping, the blog says so, and waitlist records are deleted within thirty days after that post. A record whose address is never confirmed is deleted automatically eight days after the form was last submitted. Unsubscribing stops every mailing at once: the launch and progress updates, and the team questions. It does not stop the handful of messages about a preorder you actually placed, because those are the purchase, not a mailing: the receipt, a change to the delivery date, and the download link and licence when it ships. If you want the preorder itself to stop, ask for a refund and it ends with it. A preorder record has two parts, kept for different times. Who bought, your email address and licence, is kept for as long as you are owed updates: as long as Deskthaw is sold for the first five hundred preorders, and the paid year of updates for a later purchase. The payment details, Stripe's session and payment references, the amount and any refund, are deleted once the refund window has closed, thirty days after the app ships, or, if you asked for a refund in that time, once the refund is complete. A refunded order keeps no licence, so its whole record is deleted once the refund is complete. Stripe keeps its own record of the payment as the merchant of record; Deskthaw's tax records are Stripe's payout reports and bank statements, not these records. A beta app's record is deleted automatically ninety days after its last report, whatever else happens, and can be deleted sooner by emailing the install id. An address that unsubscribes stays on a do-not-mail list, stored under the address with the time it unsubscribed, so that it is not mailed again; a deletion request removes that entry too.

Your rights

Email [email protected] to see what is stored about you, correct it, or have it deleted. You can also ask for its use to be restricted, object to any use that rests on legitimate interest (listed in the next section), or get a copy in a common, machine-readable format. Where something rests on your consent, you can withdraw it at any time; that does not affect what was done with it before you withdrew. A waitlist record is deleted within a week of asking. Some things survive that: a preorder's email address and licence, for as long as you are owed updates; its payment details, until the refund window has closed or a refund you asked for in that time is complete; and anything Stripe holds as the merchant of record, which Stripe alone can delete. If your order was refunded, its whole record is deleted once the refund is complete. Copies outside the records go their own way: Resend's log of the mail it sent you ages out on Resend's schedule, and any email you sent to [email protected] is deleted from that mailbox when you ask. Deskthaw will say which of these applies to you rather than claim a deletion it cannot perform. Deskthaw does not sell personal data. It is shared with these companies: Cloudflare, which hosts the site and stores the records (its Turnstile bot check also runs under Cloudflare's own privacy policy), and Resend, which sends the emails, both on Deskthaw's behalf; Stripe, which is the merchant of record and handles your payment under its own policies rather than on Deskthaw's behalf; and Apple, whose iCloud mail holds the [email protected] mailbox, so your replies and requests to that address are stored there. The site is not directed at children under sixteen.

Why we are allowed to hold it

If you are somewhere the law asks for a basis, here it is, purpose by purpose. A waitlist record, and the beta-update emails for an address left beside the download, rest on your consent, given when you sent the form and confirmed the address. You withdraw it with the unsubscribe link in any of those emails or by emailing [email protected], and a waitlist record is deleted within a week of asking. A preorder record is held to perform the contract you entered when you paid: the email address and licence for the updates you are owed, and the payment details for the refund window. It is not held for tax purposes. Your IP address is checked and rate-limited because a public form without that protection gets abused, which is a legitimate interest and not something you are asked to consent to. Beta counts are sent with your consent, given in the app's sharing question (at first run, or when you switch sharing on from the menu), and never without it; you can switch it off in the menu at any time. The do-not-mail entry kept after you unsubscribe, the visit counts from Cloudflare Web Analytics, and reading and answering a reply you send rest on legitimate interest: honouring your opt-out, seeing how the site is used, and answering mail you chose to send. None of it is used to profile you, and no decision about you is made automatically.

Where it is held

Cloudflare, Resend and Stripe are United States companies and your data is processed there, whichever country you are in; Cloudflare and Stripe may also process it in other countries through their own networks and subprocessors. Cloudflare and Resend receive it under the EU-US Data Privacy Framework and its UK Extension, backed by the Standard Contractual Clauses in their data processing agreements; Stripe handles it under its own terms as the merchant of record. To ask which safeguards cover a transfer of your data, or for a copy of them, email [email protected]. If you are in the United Kingdom, the European Economic Area, or anywhere else with its own data-protection authority, you can complain to that authority about how Deskthaw handles your data, and you do not have to raise it with us first, though the fastest fix is usually an email.

Changes

Changes to this page carry a new date at the top. Material changes to what is collected are announced by email to the waitlist before they take effect.