Privacy Policy

1. Who is responsible

The controller responsible for processing your personal data within the meaning of the EU General Data Protection Regulation (GDPR) is:

PS New Media (owner: Paolo Schmidt)
Ulrich-Schreier-Straße 17, 5020 Salzburg, Austria
Email: hello@deskletics.app

Deskletics is a service operated by PS New Media. If you have any question about this policy or want to exercise your rights, contact us at the address above.

2. The short version

• You can read the website and use the guides without an account.
• We only ask for personal data when you choose to do something that needs it — create an account, turn on reminders, connect a calendar, or join a company team.
• We use no tracking without your consent and set no marketing cookies by default. The optional categories are our own anonymous, first-party usage statistics (see 3.10) and Google Ads conversion measurement (see 3.11) — both off until you opt in. See our Cookie & storage policy.
• Your activity data (which breaks you complete) stays tied to your own account. Company/team admins only ever see participation you opt in to, and only as aggregates for groups of five or more — never health, mood, or medical data, because we don’t collect any.
• Our servers and database are hosted in the EU (Germany).

3. What we process, why, and on what legal basis

3.1 Visiting the website

When you load Deskletics, our hosting provider’s servers automatically process technical connection data (such as your IP address, the requested page, date and time, referrer, and browser/operating-system information) in server log files. This is necessary to deliver the site securely and to detect and prevent abuse.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning website).

3.2 Creating and using an account

To save your settings across devices you can create an account. We store your email address and a securely hashed password (we never store your password in plain text). If you sign in with Google instead, we receive a Google account identifier and your email address from Google to create or match your account (see 3.7).
Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

3.3 Your preferences and exercise settings

To personalise your breaks we store the settings you choose — for example your break cadence, session length, goal/focus areas, time zone, and which exercises you favourite, hide or weight. Before you create an account these settings live only in your browser’s local storage; once you sign in they are synced to your account.
Legal basis: Art. 6(1)(b) GDPR.

3.4 Activity / completed sessions

When you complete a break we record that it happened — the time, duration, the target duration, and an optional one-tap “how it felt” tag that you choose (e.g. better / same). This lets us show your progress and gently adapt difficulty. This is self-reported preference data about the exercise experience; it is not health, fitness-tracking, biometric, or medical data, and we don’t infer any.
Legal basis: Art. 6(1)(b) GDPR.

3.5 Reminders and push notifications

If you enable break reminders, your browser creates a web-push subscription. We store the push endpoint your browser provides, the associated keys, a random device identifier, and your time zone, so we can send the reminder at the right local time. You can turn reminders off at any time in your browser or in the app, which removes the subscription.
Legal basis: Art. 6(1)(a) GDPR (your consent, given via the browser permission prompt), and Art. 6(1)(b) for delivering a feature you asked for.

3.6 Calendar awareness (optional)

So reminders avoid your meetings, you can optionally give us a private ICS link (the secret iCal address that Google Calendar, Outlook and Apple Calendar can expose). Our server fetches it periodically and keeps only your busy/free time windows for the next day; we don’t store event titles, attendees or notes. Disconnecting the feed in Settings deletes the link and the cached time windows immediately; deleting your account removes them as well.

Legal basis: Art. 6(1)(a) GDPR (your consent) and Art. 6(1)(b).

3.7 Sign in with Google

If you use Google sign-in, Google LLC / Google Ireland Limited processes data as part of providing that service. Google’s use of the data accessed via this feature is governed by the Google Privacy Policy. We only request the minimum scope needed (your basic identity for sign-in) and use Google user data solely to provide sign-in — never for advertising. You can revoke Deskletics’ access at any time in your Google account permissions.

3.8 Company / team accounts

If your employer uses Deskletics for teams, we process your team membership, the email address used to invite you, and your opt-in participation status. Where you opt in, a team admin can see your individual participation (such as whether you’re active and your session counts); aggregate trends are only shown for cohorts of five or more members. Admins never see health, stress, mood or medical data — none is collected. Billing-related data (e.g. a billing contact email) is processed for the company account.
Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR (legitimate interest of the employer in workplace wellbeing activation), within the limits agreed with your works council where applicable.

3.9 Contacting us

If you email us (for example at hello@deskletics.app) we process the content of your message and your contact details to handle your request.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual / contractual steps) or Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

3.10 First-party usage statistics (only with your consent)

To understand whether the website and onboarding actually work, we count a small number of anonymous usage events on our own server — for example “landing page viewed”, “onboarding completed” or “checkout started”. For each event we store only: the event name, the page path, the referring website’s domain (not the full address), campaign parameters (UTM) if you arrived through one of our ads, a random identifier stored in your browser so we can count unique visitors, and — for the “page left” event — the number of seconds the page was open. We store no IP address, no device fingerprint, and no link to your account — these events cannot be traced back to you, and no third party receives them. Events are deleted after at most 13 months.
You can opt in or out at any time via the cookie settings (footer link). Withdrawing consent deletes the random identifier from your browser, so any later events cannot be connected to earlier ones.
For visitors who are clearly outside the EEA, the United Kingdom and Switzerland (judged solely by the time zone your browser reports — no location lookup is performed), this category is enabled by default and can be switched off at any time via the cookie settings; an explicit choice always wins.
Independently of your choice, we count how often the consent banner is shown, accepted and declined — as bare daily totals with no identifier, no page path and no IP address, so this is not personal data; it only tells us what share of visitors opt in.
Legal basis: Art. 6(1)(a) GDPR (your consent); for the identifier-free banner totals, Art. 6(1)(f) GDPR (our legitimate interest in knowing how representative the consented statistics are).

3.11 Ad conversion measurement (Google Consent Mode)

To know whether our ads work, we use Google’s conversion tag with Consent Mode v2. Until you opt in to the “Marketing” category, the tag runs in a restricted “denied” state: it sets no advertising cookies, performs no ad personalization, and ad-click identifiers are redacted; Google LLC / Google Ireland Limited receives only limited, cookieless technical pings (such as the fact that the page loaded), which Google uses for aggregate, modeled statistics. Only after you opt in does full conversion measurement begin — Google then sets its own cookies and learns that your visit (and, where applicable, a signup or purchase) followed an ad click. With that same consent we may also store the ad-click identifier (“gclid”) from the link you arrived on and report the resulting signup or purchase to Google as a conversion server-side. You can withdraw consent at any time via the cookie settings; we then switch the tag back to the denied state and delete Google’s conversion cookies from your browser.
For visitors clearly outside the EEA, the United Kingdom and Switzerland (judged solely by the browser’s reported time zone), conversion measurement runs by default and can be switched off at any time via the cookie settings; an explicit choice always wins.
Legal basis: Art. 6(1)(a) GDPR (your consent) for cookie-based conversion measurement; Art. 6(1)(f) GDPR (our legitimate interest in fraud-resistant, aggregate ad measurement) for the cookieless denied-state pings. Google’s processing is governed by the Google Privacy Policy.

3.12 Mobile app (iOS and Android)

The Deskletics mobile app uses the same account, preferences and activity processing described in 3.2–3.4 — signing in on your phone connects to the same account. In addition, if you enable break reminders in the app, we store a push token issued for your device, a random device identifier, a device label (e.g. the phone’s model name, so you can tell your devices apart), and your time zone, so reminders reach the right device at the right local time. You can turn reminders off at any time in the app or in your phone’s notification settings. Your sign-in token is kept in the device’s secure storage (iOS Keychain / Android Keystore). The app contains no third-party analytics, advertising or tracking SDKs.
Legal basis: Art. 6(1)(a) GDPR (your consent, given via the system notification prompt) and Art. 6(1)(b) GDPR for delivering the features you use.

3.13 Browser extension

Our browser extension (“Deskletics — Movement Breaks”) works entirely on your device by default and sends us nothing unless you choose to connect your account — in which case your completed breaks sync to your account and are processed as described in 3.4. The extension has its own dedicated policy: Browser Extension Privacy Policy.

4. Cookies and local storage

Deskletics works without tracking cookies. We use storage that is strictly necessary to run the app (for example to keep you signed in and remember your settings). The only consent-gated extra is the anonymous visitor id for our first-party usage statistics (see 3.10). Full details, including the exact keys we use, are in our Cookie & storage policy.

5. Who receives your data (processors)

We do not sell your personal data and do not share it for advertising. We rely on a small number of service providers who process data strictly on our behalf under data-processing agreements (Art. 28 GDPR):

• Hosting: our website, application and database are hosted with an EU hosting provider (Hetzner Online GmbH, Germany).
• Email delivery: a transactional email provider is used to send account, invitation and reminder emails.
• Web-push delivery: push notifications are delivered through your browser vendor’s push service (e.g. Google, Mozilla, Apple/Microsoft), which receives the technical push endpoint.
• Mobile push delivery: reminders to the mobile app are relayed through Expo’s push notification service (Expo, Inc.), which passes them to the Apple Push Notification service or Google Firebase Cloud Messaging for delivery to your device. These services receive the technical push token and the notification content (e.g. “time for a break”) — never your account data.
• Google (only if you choose Google sign-in) — see 3.7.

6. International transfers

Our core hosting and storage are in the EU. Some optional providers (notably Google, if you use those features) may process data outside the EU/EEA. Where that happens, the transfer is safeguarded by an EU adequacy decision and/or the European Commission’s Standard Contractual Clauses.

7. How long we keep your data

We keep account data for as long as your account exists. If you delete your account, or ask us to delete your data, we erase your personal data unless we are legally required to retain certain records (e.g. billing/accounting obligations). Anonymous server logs are kept only for a short period for security and then deleted or anonymised. Calendar busy/free windows are cached only briefly and refreshed.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21); and
• withdraw any consent at any time, with effect for the future (Art. 7(3)) — for example by turning off reminders or disconnecting your calendar.

You can delete your account yourself at any time under Settings → Account (on the web and in the mobile app); this erases your personal data as described in section 7. To exercise any of these rights, email hello@deskletics.app. You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna.

9. Security

We protect your data with appropriate technical and organisational measures: encrypted transport (HTTPS/TLS), hashed passwords, scoped access tokens, and least-privilege access to the production environment. No method of transmission or storage is completely secure, but we work to keep your data safe.

10. Children

Deskletics is intended for adults in a workplace context and is not directed at children. We do not knowingly collect personal data from children under 16.

11. Changes to this policy

We may update this policy as the product evolves or the law changes. The current version always lives at this page, with the “last updated” date above. Material changes affecting how we use your data will be communicated appropriately.

12. Contact

Questions about privacy? Email hello@deskletics.app or write to PS New Media, Ulrich-Schreier-Straße 17, 5020 Salzburg, Austria.