Privacy policy

The controller under the EU General Data Protection Regulation (GDPR) is Ivan Duhov. For anything about your data, email [email protected].

When you join the waitlist we store your email address, the time you joined and that you joined from this website. We use it for one thing: to email you when Deskcast is available to order, with your founding-member discount code.

• Legal basis: your consent, GDPR Art. 6(1)(a).
• You can withdraw consent at any time by emailing [email protected] or using the unsubscribe link in our email. Withdrawing doesn’t affect anything we did before.
• We delete the list 6 months after the availability email goes out, or earlier if you ask.

If you create an account to manage a Deskcast, we store your email address, a hash of your password (never the password itself), your sign-in sessions, the devices paired to your account with their settings (ticker symbols, refresh rate, time zone, name), and when each device was last online and which firmware it runs.

• Legal basis: providing the service you asked for, GDPR Art. 6(1)(b).
• We keep this while your account exists. Email [email protected] to have your account and its data deleted.

A Deskcast fetches market prices directly from a third-party market data provider (Yahoo Finance). That provider sees the device’s internet address and the symbol it asks for, under its own privacy policy.

• No advertising, no tracking pixels, no third-party fonts.
• Google Analytics, only if you accept it in the cookie banner (GDPR Art. 6(1)(a), consent). It tells us which pages are visited, how people found the site, and the rough location, device and browser behind each visit. Google Ireland Ltd. processes this for us and may transfer it to the US under the EU-US Data Privacy Framework. We don’t use it for advertising, and it doesn’t store your IP address. Reports are kept for at most 14 months. You can withdraw at any time with “Cookie settings” at the bottom of every page.
• Traffic reaches us through Cloudflare, which protects the site and briefly processes your IP address to do so (GDPR Art. 6(1)(f), our legitimate interest in a secure site). Cloudflare acts as our processor and may process data in the US under the EU-US Data Privacy Framework and standard contractual clauses. Our own server does not log your IP address.

The site needs these to work, so they don’t ask for consent:

• theme (local storage) — remembers light or dark mode if you pick one.
• waitlist-nudge (session storage) — remembers during this visit that the waitlist pop-up was shown or that you joined, so it doesn’t appear again. Gone when you close the tab.
• XSRF-TOKEN (cookie) — protects forms against cross-site request forgery.
• dc_session (cookie) — keeps you signed in, only after you log in.
• analytics-consent (local storage) — remembers whether you accepted or declined analytics, so we don’t ask on every visit.

Only if you accept analytics:

• _ga and _ga_S2J16DRDR4 (cookies, up to 2 years) — Google Analytics, to tell one visit from the next. Declining later deletes them.

Nobody, beyond Cloudflare and, if you accept analytics, Google as described above, and the provider we will use to send the availability email, which will act as our processor. We never sell your data.

You can ask for access to your data, correction, deletion, restriction of processing and a copy to take elsewhere (portability), and you can object to processing based on legitimate interest. Email [email protected]; we answer within one month.

You can also complain to a data protection authority — where you live, or where we are established: the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria — cpdp.bg.

We don’t make automated decisions about you or build profiles.

Who runs this site is on the legal notice.