Privacy

1The app

Sundeck is local-first. The database is on your device, the app opens and works with no connection at all, and syncing is something it does afterwards. If you're signed in, an encrypted copy of what you've written goes to the server so your other devices can catch up.

What the server can't read

These are encrypted on your devices before they sync. The server stores ciphertext:

• Task titles.
• Subtask titles.
• Every note body — task notes, day notes, project notes.
• Project names.

I run that server and I cannot read any of it. There is no support tool, no admin view, and no second key on my side that opens it. That also means I can never search your notes for you, fix a corrupted one, or put their contents in a notification.

Why I don't just write “end-to-end encrypted” and stop

Because the phrase on its own promises more than this design delivers, and the caveats matter more than the badge. The exact claim is narrower: your task text is encrypted on your devices, and neither the server nor the network in between can read it. It is not a claim about a stolen unlocked device, and it is not disk encryption. Here is everything that qualifies it:

• Your own devices hold plaintext. The local database on each device is unencrypted, by design — that's what lets the app open instantly and work offline. Someone holding your unlocked phone has your tasks.
• The iPhone capture queue holds plaintext titles at rest. A task captured from the lock screen sits in a shared app file, unencrypted, until the app picks it up.
• The export is a full unencrypted copy of your account, on purpose — the point of it is that you can read it, keep it, and leave. The app says so where you create one.
• Web and desktop keep the key in browser storage. That is weaker custody than the phone's, so the plain marketing phrase isn't used for those at all until it's hardened. The encryption works there; the claim waits.
• Your encryption password protects the key. I never see it. When you set one, the app derives a second key from it on your device — slowly and deliberately, using Argon2id — and stores your encryption key wrapped under that, on the server. What the server holds is a salt, three cost numbers and a ciphertext it cannot open. The password itself never leaves your device: not when you set it, not when you use it, not in a log. It is not a sign-in password — signing in is still the emailed code — and its only job is to open your key on a new device when no existing device is awake to approve one.
• The honest cost of that: because the wrapped key sits on the server, anyone who got hold of that database could guess at your password offline, without going through me. That is why the app insists on at least eight characters and why deriving the key deliberately takes from about half a second to a few seconds, depending on the device. Pick something that isn't a word.
• I cannot reset your encryption password, and there is no recovery code. If you forget it, set a new one from any device that still has the key — no old password needed, because that device already holds it. If no device is left and you don't have the password, the data on the server can never be opened again: no copy on my side, no support path, which also means I cannot be compelled to produce one. The export is the safety net, and the app says this at the moment it matters rather than burying it here.
• I can see your device list, and what you call it. How many devices hold your key, what platforms they run, when each was added, and the name you gave it — «iPhone του Γιώργου» is a string you typed, sitting on a server that cannot read a single one of your tasks. I can also see that a device was linked and when, though not the key that moved between them.
• Removing a device stops it receiving new data. It does not rotate the key. That device still holds a copy of the key and a plaintext copy of everything it ever downloaded, and nothing I can do reaches either. Removing it from the list and revoking its sign-in is the whole of what this version offers; re-encrypting your entire account under a new key is not in it.

What I can see

Not everything can be encrypted without breaking the app, and I would rather list what's in the clear than let you assume otherwise:

• Label names. A label's synced identifier is derived from the name itself, so encrypting the column while the key is the name would be theatre.
• Deferral and assignment metadata — which day a task was assigned to, how many times you moved it forward, and how it ended.
• Timestamps, day keys, settings and counts.
• When the app was opened, and by which device. Each signed-in device syncs a timestamped app-open record carrying a per-device identifier — the beta's “is anyone actually using this” heartbeat. Those records delete themselves after 90 days, on the server and on the device alike; if this heartbeat ever grows beyond that, this page changes first.
• Your devices' names, platforms and public keys. The list above is stored as ordinary rows: a name, a platform, a date, and the public half of a key. It has to be readable by the server, because it is how one device finds out another one exists. Nothing in it opens anything.

Put plainly: I can see when you plan, how much, and what you call your labels — but not what the work is, or what you wrote.

Where it all lives

• Guest mode syncs nothing. There's no account and no server side to it: everything stays on the device, and on the web that means your own browser's storage. Clear the browser and it's gone — including from me, who never had it.
• With an account, sync and sign-in run on Supabase, which provides the database and authentication infrastructure behind the app. It holds the encrypted content and the plaintext metadata listed above, on my behalf, in Supabase's Ireland region — inside the EU.

Signing in, and the security around the edges

• There is no sign-in password. You sign in with a six-digit code sent to your email address, so there is no Sundeck login password to reuse, leak, or crack. The email address is the account: it's what identifies you, and it's where the codes go. A transactional email service delivers those messages on my behalf; it sees your address and the code, nothing more. The encryption password described above is a different thing entirely — it never reaches the server and it is not what gets you in.
• Everything moves over TLS — between the app and the server, and between your browser and this site. The server database is additionally encrypted at rest by the infrastructure, underneath the field-level encryption described above. Supabase also keeps its own standard authentication logs — the IP address and browser that asked for a sign-in code — on its side, for security.
• Accounts are invite-only during the beta, which is itself a privacy property: no one can create an account with your address and no stranger's data lands next to yours while the locks are still being tested.
• Found a security hole? Write to hello@getsundeck.com. It reaches the person who wrote the code, and reports are answered, not queued.

2This website

getsundeck.com is a static site hosted on Cloudflare Pages. It sets no cookies, loads nothing from any other domain, and runs no third-party analytics and no tracking pixels. What it records, it records itself, into one small database table — and this is all of it.

Your email address

The waitlist form and the pre-order button store the address you type, trimmed and lowercased so that the same person doesn't get counted twice. No name, no company, no enrichment is attached to it — though like every row in this table, it carries the user-agent and pseudonymised IP described below. I use it to write to you about Sundeck, by hand. No list rental, no drip campaign.

The demo's numbers

The demo page records five things as they happen, with no account and no name against them:

• the demo page was opened;
• the demo was completed — together with the three numbers you typed: tasks planned last week, tasks finished, tasks carried forward more than twice;
• the pricing section was scrolled into view;
• the link through to the app was clicked;
• the pre-order confirmation page was reached.

The three numbers are kept for one reason and it's an honest one: after a few hundred strangers they are the only real evidence of what an ordinary week actually looks like, which is the thing the whole product is an argument about. They're stored without your email address attached. One honest caveat: every row carries the same pseudonymised IP described below, so the two could in principle be joined back together. Nothing does that — but a page that lists everything should list that too.

What every row carries

Alongside each of the events above, one row records your browser's user-agent string (browser, version, platform) and a pseudonymised IP address — a truncated SHA-256 hash of your IP with a fixed prefix. Your actual IP address is never written down. The hash exists so that automated submissions can't flood the counts and so I can filter them out afterwards. A hashed IP address is still personal data and is treated as such here: it is not anonymous merely because it isn't readable.

How long any of it is kept

At most 90 days, enforced by a scheduled job. It runs daily: rows older than 90 days are deleted outright, and a waitlist row keeps its email address but loses the user-agent and pseudonymised IP that arrived with it. Addresses themselves stay until you ask me to remove yours, or until there's nothing left to write to you about.

The hidden field in the forms

Both forms carry a field that is positioned off-screen and marked to be ignored by assistive technology, so no person ever sees or fills it in. If it arrives filled, the submission was automated: it is dropped, nothing is stored, and the form answers as though it had succeeded.

Where it's stored

With Cloudflare, in a D1 database inside the same account that serves this site. The code that writes to it runs on the same origin as the page you're reading — nothing is posted to a third party.

3Payments

Today, nothing is charged and no card details are collected anywhere on this site. The pre-order button records your email address and the fact that you said you'd pay $39 a year. That is the entire transaction.

When card pre-orders open, Stripe processes them. Stripe receives your card details and handles the payment; I never see the card number. What reaches me is that a payment happened, and the email address attached to it.

The promise attached to that money, in the same words it appears in everywhere else: Pre-orders are refunded without being asked if Plus isn't ready by 30 November 2026.

4Who touches the data, and where it lives

No advertising networks, no analytics companies, no data brokers, no “partners.” Here is everyone that processes anything on Sundeck's behalf, and each one exists to run the product, not to learn about you:

• Supabase — the app's database and sign-in. Holds the encrypted content and plaintext metadata described in section 1, in its Ireland region, inside the EU, for as long as your account exists — ask (section 7) and it's deleted.
• Cloudflare — hosts this website with its small events table (section 2), and the web app at sundeck.day. One side door worth naming: the sign-in emails embed a logo image served from sundeck.day, so opening one fetches that image from Cloudflare the way any web image loads. Cloudflare is a US company operating a global network, so treat the site's data as potentially processed outside the EU.
• Stripe — will process card payments when pre-orders open, as section 3 describes. Stripe is a US company; your card details go to Stripe, not to me.
• Resend — the transactional email service that delivers sign-in codes and the occasional account email. It sees your email address and the message content, nothing else.
• Expo — the phone apps check Expo's update service at launch to fetch over-the-air app updates. Expo (a US company) sees the device's IP address, platform, app version and update channel — never your content. And the stores that deliver the app — Google Play and Apple's TestFlight today, the App Store proper later — see standard install and crash data as with any app. The stores are the one entry here that isn't a processor working for me: they answer to their own policies, which is why they're named rather than folded into the promise below.

Where a provider processes data outside the EU, the transfer rests on the safeguards European law provides for exactly this: Cloudflare and Stripe participate in the EU–US Data Privacy Framework and carry standard contractual clauses in their terms; where a provider is not in that framework, the standard contractual clauses apply. Write to hello@getsundeck.com and I'll point you at the copy of whichever covers the provider you're asking about. Nothing is transferred so that anyone can market to you or profile you; the data goes where it goes because that's where the infrastructure runs.

None of the processors above may use your data for their own purposes beyond what their role requires — with the caveats their own terms reserve: payment processors and networks run their own fraud-prevention and security processing, and hosts keep the short-lived operational logs any host keeps. The app stores, as said, sit outside this promise because they were never inside my contracts. None of it is ever sold, rented, or traded — not for money, not for services, not for “insights.”

5Your rights

Sundeck is run from Greece, so European data-protection law (the GDPR) applies to everything on this page — not as a courtesy, but because it has to. Under it you can:

• Ask what's held about you and get a copy (access, portability).
• Have anything inaccurate corrected.
• Have it deleted (section 7 says how — it's one email).
• Object to, or restrict, any of the processing described here.
• Complain to a supervisory authority. The one responsible for Sundeck is the Hellenic Data Protection Authority (dpa.gr); if you live elsewhere in the EU you can go to your own instead.

Two things worth saying plainly. First, these rights are honored for everyone, wherever you live — a US visitor gets the same one-email deletion as an EU one, because running two tiers of respect would be more work than doing the right thing once. Second, the legal bases, since the GDPR wants them named: running the app and this site for you is contract; the website's bot-filtering and demo counts are legitimate interest; the waitlist emails are consent, which you withdraw by replying “stop” to any of them — they're written and sent by hand, so a stop is read by the same person who would have hit send, and your address comes out before the next one goes out; and holding a pre-order place is a step toward a contract — the lawyers' phrase for “you asked to buy, so I may write to you about that purchase.”

One honest limit: for content that's end-to-end encrypted, I can hand you the ciphertext and delete it, but I cannot read it, correct it, or search it for you — the whole point of section 1 is that only you can. The app's own export is the readable answer to that, and it runs on your device, where the key is.

6Children, and changes to this page

• Sundeck is not for children. It's a weekly planner aimed at adults, and app accounts are invite-only. This website's forms are open to anyone, so the fuller statement is: no data is knowingly collected from a child anywhere — app or site — with “child” meaning under 15 where I am in Greece, and under 13 in the US. If a child's address has ended up in the database anyway, write to me and it comes out, account and rows alike.
• When this page changes, the change is visible. The date at the bottom moves with every edit that matters. If a change would genuinely alter the deal — new data collected, a new company in section 4, a weaker promise — account holders and the waitlist hear about it by email before it takes effect, not by stumbling on a reworded paragraph. Silent rewrites are the industry habit this page exists to not have.

7Contact and deletion

• Write to hello@getsundeck.com. That address reaches me, not a helpdesk.
• Ask and it's deleted. Say the word and your email address, and any rows on this site tied to it, come out of the database. You don't have to give a reason, and it costs you nothing else. You can also ask for a copy of what's there first — it's a short list, and this page already describes every field in it.
• Your app data is yours to take. The app produces a plaintext export — a complete, readable copy of your account — whenever you ask it to. To have a synced account and its rows deleted, write to the address above.
• Who's responsible. Sundeck is built and run by one person — gnstampoulis, its founder — from Greece, and in the GDPR's terms that person is the data controller. There is no company behind it. A postal address comes with the first reply to any email, and on request. If any of this changes, this page changes with it.

Last updated 7 September 2026. If anything above changes in a way that matters, the date changes with it — and section 6 says what else happens.