Privacy policy

Who we are

This policy explains how Deskspace handles your personal information. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Questions or concerns: email help@deskspace.au.

The short version

• We collect what Deskspace needs to work, and nothing to sell. We never sell your data.
• No advertising, and no advertising or social-media trackers.
• Your work is private to you. Uploads are never shared with other students.
• Your name and email are never sent to the AI.
• You can download all your data or delete your account at any time, in Settings.

What we collect, and why

• Account details — your name, email and password (stored hashed), to sign you in. Date of birth, to know whether you're under 18 (which changes how Deskspace works for you), and, if an under-18 adds one, a parent or guardian's email, so they can pay or be contacted.
• Study details — school or uni, year level, state, subjects or units, exam dates and your preferences, so tools are pitched at your level.
• Your work — what you type into tools, files you upload, what Deskspace makes for you (notes, flashcards, exams, feedback), chats, assignments and plans, flashcard reviews and quiz and exam results. This is the content of the service: we keep it so you can come back to it.
• AI use records — which tool you used, when, and for which subject and assignment, with the amount of AI processing it took. These power your AI use log, your daily limits and our costs.
• Payments — handled by Stripe. We keep your plan and its status; we never see or store card numbers.
• Study groups (only if you join) — your posts and the groups you're in. Other members see your first name and last initial only.
• Anonymous usage counts — which pages and features are used, kept in our own database without any name, account, IP address, device ID or cookie, so it can't be linked to you. If your browser sends “Do Not Track” or Global Privacy Control, we don't even count page views. We also log technical errors (without personal details) to fix bugs.

How we collect it

Almost everything comes straight from you — when you sign up, set up your subjects, use a tool or upload a file. Some is created as you use Deskspace (like your quiz results or AI use records). Stripe tells us whether a payment went through. We don't buy data about you, or collect it from social media or data brokers.

If we receive personal information we didn't ask for (for example, someone else's details in an upload), we only use it to provide the service you asked for, and we delete or de-identify it if we don't need it.

How we use it

• To run Deskspace for you: sign-in, your workspace, tools, planner and study groups.
• To pitch the AI at your year level, subjects and preferences.
• To manage your plan, payments, daily limits and storage.
• To keep students safe: checking for signs of distress, enforcing our terms, and preventing misuse and fraud.
• To fix problems and improve Deskspace, using reports you send and anonymous usage counts.
• To contact you about your account, such as sign-in emails and changes to our terms.
• To meet our legal obligations, like tax records and responding to lawful requests.

We don't use your work to train AI models, and we don't send marketing emails unless you've opted in. Any marketing email will have an unsubscribe link, as the Spam Act 2003 requires.

Automated decisions

Deskspace uses AI to make things for you — feedback, predicted marks, study plans, suggested next steps. These are suggestions to help you study; they don't decide anything with legal or similarly significant effects for you, and nobody else (your school included) sees them unless you share them. Our automatic safety checks may limit a response or show support information; if you think one got it wrong, press Report and a person will look at it.

Cookies and browser storage

We use only what the service needs: a sign-in cookie, and storage in your browser for your theme, your study timer and work in progress (like a half-written answer), so nothing is lost if the page reloads. No advertising or tracking cookies.

Where your data is kept, and who processes it

• Supabase stores your account, work and files in Sydney, Australia.
• Anthropic (USA) provides the AI (Claude). When you use a tool, we send Anthropic what's needed to answer: your request, the tool's settings, your year level and subject, relevant excerpts from your uploads and, for chats, the conversation so far. Not your name, email or date of birth. Under Anthropic's commercial terms, this isn't used to train its models. See how Deskspace uses AI.
• Stripe (global, including the USA) processes payments.

Because Anthropic and Stripe are overseas, some of your information leaves Australia when you use those features. We choose providers with strong security and contractual privacy protections.

Other times we might share it

We only share personal information beyond the providers above:

• with your consent, or when you choose to (for example, posting in a study group or sharing your AI use log);
• with the parent or guardian on your account, about the account and its subscription — not your work;
• if the law requires it, such as a valid court order, or if we reasonably believe it's needed to prevent a serious threat to someone's life, health or safety;
• with professional advisers (like lawyers and accountants) who are bound to keep it confidential; and
• if Deskspace is sold or merged, with the new owner — who must keep protecting it as this policy says, and we'll tell you first.

Students under 18

• You can add a parent or guardian's email if you like, so they can pay for the subscription.
• There are no public profiles. Study groups are off unless you turn them on, group admins approve everyone who joins, and sexual or explicit content and contact details are blocked.
• Deskspace checks for signs of distress and points students to support services.
• We never use a student's information for advertising or profiling for commercial purposes.

The Australian Information Commissioner is developing a Children's Online Privacy Code. We'll follow it once it applies, and we already aim to act in the best interests of the young people who use Deskspace.

How long we keep it

Your account and work are kept while your account is open. Delete your account and everything goes, including uploads; backups are overwritten in the normal cycle. Anonymous usage counts are kept for 13 months, error logs for 90 days. Payment records Stripe must keep for tax law stay with Stripe.

Your rights

You can deal with us without giving your real name for general questions, but you need an account to use Deskspace. Here's what you can do:

• See it: download everything we hold about you from Settings → Your data.
• Correct it: edit your details in Settings, or ask us.
• Delete it: delete your account from Settings → Your data.
• Complain: email help@deskspace.au. We'll reply within 30 days. If you're not happy with our answer, contact the Office of the Australian Information Commissioner (oaic.gov.au).

For anything you can't do in Settings, email us. We may need to check it's really you (or that you're the student's parent or guardian) before acting. Requests are free, and we'll respond within 30 days. If we can't give you something, we'll explain why. We try to keep your information accurate and up to date, so please tell us if something's wrong.

Security

Data is encrypted in transit and at rest. Every table is protected so each student can only reach their own rows, and staff access is limited to what's needed to run Deskspace. If a breach is likely to cause serious harm, we'll tell you and the OAIC as the Notifiable Data Breaches scheme requires.

Outside Australia

Deskspace is made for students in Australia. If you use it from elsewhere, your information is handled under Australian law and stored in Australia as this policy describes.

Changes

If we change this policy in a way that matters, we'll tell you in Deskspace (and by email if it's significant) before it takes effect. The date at the top shows when it last changed.