Privacy Policy

Decktly is a local-first application. Your documents are opened, edited, and presented on your own device. This policy describes the only personal data we collect - the account details needed to sign you in - and states plainly what our website and applications do and do not send over the network.

The data controller responsible for the processing described here is Hannes Krieg, Plochinger Straße 152, 73730 Esslingen am Neckar, Germany (contact details in section 13).

We collect your email address and the authentication data required to sign you in and to determine your access entitlement. This is the only personal data we collect through your account. The legal basis is Art. 6(1)(b) GDPR (performance of our contract with you).

This data is stored with Supabase, which provides our authentication and database infrastructure and processes it solely to operate the service on our behalf.

If you contact us for support, we process the information you choose to include in your message so that we can reply (Art. 6(1)(b) and (f) GDPR).

Our website is hosted by Lovable, our website hosting and infrastructure provider. When you visit any page, the hosting infrastructure processes the technical data your browser sends - in particular your IP address - in server logs, as is necessary to deliver the site and keep it secure. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in providing a working, secure website).

The fonts on this site are served from our own domain. No request is made to Google or any other font service when you visit.

The website contains no analytics, no advertising, and no third-party tracking of any kind.

We do not use cookies or similar technologies that require consent, which is why this site shows no cookie banner.

When you sign in, your session token is kept in your browser's local storage so that you stay signed in. If you start a password reset, the email address you entered is kept in local storage briefly so the confirmation page can display it. Both are strictly necessary for a service you have explicitly requested (§ 25(2) TDDDG); neither is used for tracking, and nothing is shared with third parties.

The desktop application makes exactly two kinds of outbound connection:

• signing in and validating your session (to our authentication provider, Supabase)
• checking for and downloading application updates (from downloads.decktly.com, served via Cloudflare)

There is no other outbound traffic from the application itself. The application sends no telemetry, no crash reports, no usage analytics, and no machine identifier. The optional AI assistants are an exception you control: launching one starts a separate program on your machine that connects to your own AI provider (see section 7).

The browser version at app.decktly.com is served via Cloudflare and behaves the same way: it reads and writes your files directly on your own disk using your browser's File System Access feature, and its only outbound traffic is sign-in. Serving the page necessarily involves Cloudflare processing your IP address (Art. 6(1)(f) GDPR).

We send only the emails needed to operate your account - sign-in and verification emails, password resets, and notices about your access. These are delivered through Resend, our email delivery provider, which processes your email address on our behalf for that purpose only. We do not send marketing email, and every non-essential notice contains an unsubscribe link that we honour.

Documents you open or edit in Decktly are read from and written back to your own disk. Their contents, file names, and file paths are never transmitted to us or to anyone else.

Comments and instructions are stored inside the document file itself, so they stay on your machine and travel with the file only when you choose to share it.

There is one exception, and it is entirely in your hands: the optional built-in AI assistants (Claude and Codex). If you choose to launch one, it runs as a separate program on your machine under your own account with the AI provider (Anthropic or OpenAI). To do its work it reads your open deck and sends its content directly from your machine to that provider, where it is processed under your own agreement with them and their privacy terms. Nothing passes through us: Decktly never receives your deck content and never sees or stores your AI credentials or API keys. If you never launch an assistant, nothing is ever sent.

We do not sell personal data, and we never use your documents for analytics, advertising, or AI training.

Because Decktly is local-first, you are responsible for saving, securing, and backing up your own files. Decktly does not provide cloud storage, backup, or file syncing, and is not responsible for files lost, deleted, or corrupted on your device.

We keep your account email address and authentication data for as long as your account remains active. If you ask us to delete your account, we remove this data within 30 days, except where we are required to retain it to comply with a legal obligation.

The providers named above - Supabase (authentication and database), Lovable (website hosting), Cloudflare (content delivery for app.decktly.com and downloads.decktly.com), and Resend (email delivery) - act as processors on our behalf under data processing agreements. Where a provider processes personal data outside the European Economic Area, in particular in the United States, the transfer is safeguarded by the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

You have the right to access, correct, delete, and receive a copy of your personal data, to restrict or object to its processing, and to withdraw any consent at any time (Art. 15-21 GDPR).

To exercise any of these rights, including deletion of your account and the data associated with it, email support@decktly.com from the address associated with your account. We will confirm once the request has been carried out.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) - either the authority of your habitual residence or the authority responsible for us, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

If we change this policy, we will update the "Last updated" date at the top of this page.

For privacy-related questions, contact the controller: