Privacy Policy
Last updated: July 31, 2026.
Who we are
Desk is operated by Miguel Rodriguez, trading as "Desk by Leroi". We are the data controller for the personal data described here — we decide why and how it is processed. Contact: support@party-meta.com.
What we collect and why
- Account data — email, password credentials, display name, pronouns, country/flag, headline, bio, skills, time zone, social links and profile photo. Used to create and secure your account and show you in the member directory. Legal basis: performance of our contract with you.
- Product data — tasks, habits, focus sessions, streaks, goals, room membership and chat messages. Used to provide the Service across your devices. Legal basis: contract. Chat messages in shared rooms are visible to others in that room.
- Technical and usage data — IP address, device/browser information, log and error data, and rate-limit records. Used for security, abuse prevention and improving the product. Legal basis: our legitimate interest in running a secure, reliable service.
- Support messages — anything you send us by email. Legal basis: legitimate interest in answering you.
- Marketing emails (if we send any) — only with your consent, withdrawable at any time.
Payments
Our order process is conducted by our online reseller Paddle.com, the Merchant of Record for all our orders. Paddle collects and processes your billing details, payment method and tax information as an independent controller for that purpose, and handles invoicing, subscription management, tax compliance and refunds. We receive only limited data from Paddle (such as your subscription status, plan and customer ID). See Paddle's privacy notice.
Who we share data with
- Hosting, database, storage and authentication providers who run our infrastructure (processors acting on our instructions).
- Paddle, as Merchant of Record, for the sale of subscriptions, payments, tax and invoicing.
- Professional advisers (legal, accounting) where necessary.
- Authorities where we are required by law.
We do not sell your personal data or use third-party advertising trackers. Some providers may process data outside your country; where that happens we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.
Retention
We keep account and product data for as long as your account is active. If you delete your account, profile, sessions and login data are removed immediately and backups age out within 30 days. Security and rate-limit logs are kept for up to 90 days. Records we must retain for legal, tax or accounting reasons (mostly held by Paddle) are kept for up to 7 years. Anything no longer needed is deleted or anonymised.
Your rights
You have the right to access a copy of your data, correct it, delete it, export it in a portable format, restrict or object to certain processing, and withdraw consent where we rely on it. You can edit your profile and export your history from within the app, and use "Delete my account" on your dashboard to permanently wipe your data. For anything else, email support@party-meta.com — we respond within one month. If you're in the UK or EEA you can also complain to your local data protection authority.
Security
We apply appropriate technical and organisational measures: encryption in transit (HTTPS) and at rest, hashed credentials, row-level access rules so members can only reach their own records, private storage with expiring signed links for uploaded images, rate limiting and server-side authorisation checks on sensitive actions. No system is perfectly secure, but we work to keep access tightly scoped.
Cookies & local storage
We use a small amount of essential local storage (auth session, theme, your chosen status). No advertising or third-party tracking cookies. See Cookies.
Children
Desk is not intended for anyone under 16, and we do not knowingly collect their data.
Contact
Miguel Rodriguez — support@party-meta.com