Privacy

1The app

Sundeck is local-first. The database is on your device, the app opens and works with no connection at all, and syncing is something it does afterwards. If you're signed in, an encrypted copy of what you've written goes to the server so your other devices can catch up.

What the server can't read

These are encrypted on your devices before they sync. The server stores ciphertext:

• Task titles.
• Subtask titles.
• Every note body — task notes, day notes, project notes.
• Project names.

I run that server and I cannot read any of it. There is no support tool, no admin view, and no second key on my side that opens it. That also means I can never search your notes for you, fix a corrupted one, or put their contents in a notification.

Why I don't just write “end-to-end encrypted” and stop

Because the phrase on its own promises more than this design delivers, and the caveats matter more than the badge. The exact claim is narrower: your task text is encrypted on your devices, and neither the server nor the network in between can read it. It is not a claim about a stolen unlocked device, and it is not disk encryption. Here is everything that qualifies it:

• Your own devices hold plaintext. The local database on each device is unencrypted, by design — that's what lets the app open instantly and work offline. Someone holding your unlocked phone has your tasks.
• The iPhone capture queue holds plaintext titles at rest. A task captured from the lock screen sits in a shared app file, unencrypted, until the app picks it up.
• The export is a full unencrypted copy of your account, on purpose — the point of it is that you can read it, keep it, and leave. The app says so where you create one.
• Web and desktop keep the key in browser storage. That is weaker custody than the phone's, so the plain marketing phrase isn't used for those at all until it's hardened. The encryption works there; the claim waits.
• Lose both your passphrase and your recovery code and the data is gone. There is no back door and I cannot build you one after the fact. That's the trade you're making, and it's stated when you set encryption up, not buried here.
• A stolen device is answered by re-wrapping your keys and revoking that device's sessions. The master key itself is not rotated in this version.

What I can see

Not everything can be encrypted without breaking the app, and I would rather list what's in the clear than let you assume otherwise:

• Label names. A label's synced identifier is derived from the name itself, so encrypting the column while the key is the name would be theatre.
• Deferral and assignment metadata — which day a task was assigned to, how many times you moved it forward, and how it ended.
• Timestamps, day keys, settings and counts.

Put plainly: I can see when you plan, how much, and what you call your labels — but not what the work is, or what you wrote.

Where it all lives

• Guest mode syncs nothing. There's no account and no server side to it: everything stays on the device, and on the web that means your own browser's storage. Clear the browser and it's gone — including from me, who never had it.
• With an account, sync and sign-in run on Supabase, which provides the database and authentication infrastructure behind the app. It holds the encrypted content and the plaintext metadata listed above, on my behalf.

2This website

getsundeck.com is a static site hosted on Cloudflare Pages. It sets no cookies, loads nothing from any other domain, and runs no third-party analytics and no tracking pixels. What it records, it records itself, into one small database table — and this is all of it.

Your email address

The waitlist form and the pre-order button store the address you type, trimmed and lowercased so that the same person doesn't get counted twice. Nothing else is attached to it — no name, no company, no enrichment. I use it to write to you about Sundeck, by hand. No list rental, no drip campaign.

The demo's numbers

The demo page records five things as they happen, with no account and no name against them:

• the demo page was opened;
• the demo was completed — together with the three numbers you typed: tasks planned last week, tasks finished, tasks carried forward more than twice;
• the pricing section was scrolled into view;
• the link through to the app was clicked;
• the pre-order confirmation page was reached.

The three numbers are kept for one reason and it's an honest one: after a few hundred strangers they are the only real evidence of what an ordinary week actually looks like, which is the thing the whole product is an argument about. They're stored on their own, not tied to your email address.

What every row carries

Alongside each of the events above, one row records your browser's user-agent string (browser, version, platform) and a pseudonymised IP address — a truncated SHA-256 hash of your IP with a fixed prefix. Your actual IP address is never written down. The hash exists so that automated submissions can't flood the counts and so I can filter them out afterwards. A hashed IP address is still personal data and is treated as such here: it is not anonymous merely because it isn't readable.

How long any of it is kept

At most 90 days. After that, rows are either aggregated into plain counts or deleted outright. Email addresses on the waitlist stay until you ask me to remove yours, or until there's nothing left to write to you about.

The hidden field in the forms

Both forms carry a field that is positioned off-screen and marked to be ignored by assistive technology, so no person ever sees or fills it in. If it arrives filled, the submission was automated: it is dropped, nothing is stored, and the form answers as though it had succeeded.

Where it's stored

With Cloudflare, in a D1 database inside the same account that serves this site. The code that writes to it runs on the same origin as the page you're reading — nothing is posted to a third party.

3Payments

Today, nothing is charged and no card details are collected anywhere on this site. The pre-order button records your email address and the fact that you said you'd pay $39 a year. That is the entire transaction.

When card pre-orders open, Stripe processes them. Stripe receives your card details and handles the payment; I never see the card number. What reaches me is that a payment happened, and the email address attached to it.

The promise attached to that money, in the same words it appears in everywhere else: Pre-orders are refunded without being asked if Plus isn't ready by 30 November 2026.

4Contact and deletion

• Write to hello@getsundeck.com. That address reaches me, not a helpdesk.
• Ask and it's deleted. Say the word and your email address, and any rows on this site tied to it, come out of the database. You don't have to give a reason, and it costs you nothing else. You can also ask for a copy of what's there first — it's a short list, and this page already describes every field in it.
• Your app data is yours to take. The app produces a plaintext export — a complete, readable copy of your account — whenever you ask it to. To have a synced account and its rows deleted, write to the address above.
• Who's responsible. Sundeck is built and run by one person — me, its founder — from Greece. There is no company behind it. If that changes, this page changes with it.

Last updated 27 August 2026. If anything above changes in a way that matters, the date changes with it.