Privacy Policy

uxdeck is an independent project, designed, built and run by Soufiane Chraibi, a product designer, from Morocco, as the design canvas of uxspot.io. There is no company behind the policy you are reading: I am the data controller for uxdeck, the person responsible for your data and the one who answers for it. For anything in this policy, write to me at privacy@uxdeck.app.

To use uxdeck you sign in, and signing in is also how you sign up. There are three ways, and none of them involves a password I could see:

• Continue with Google or Continue with GitHub. You sign in on Google's or GitHub's own page, and they tell uxdeck who you are. uxdeck receives your name, email address and profile picture, and nothing else: no access to your mail, your repositories or anything in those accounts.
• An emailed link. You enter your email address and uxdeck sends you a link that signs you in.

Google One Tap on uxdeck's website. When you are signed out of uxdeck, the website (uxdeck.app) may show Google's own prompt offering to sign you in with the Google account your browser is using. To offer it, the website loads Google's sign-in service, so Google learns that your browser opened a page offering it, as on any site with Sign in with Google, under Google's privacy policy. uxdeck receives nothing from it unless you choose to continue, and then it receives the same as with Continue with Google. If you are signed in, the website does not load it.

Signed in on the website. While you are signed in, the website's menu shows your name, picture and most recent files. It reads them from your account as you browse and keeps none of them.

uxdeck keeps your name, email address, picture, the sign-in methods you have linked and your plan, to run your account. For each device you are signed in on, it keeps a session record with the browser's description and IP address, to keep you signed in and to protect your account. Signing out ends it.

Everything you make in uxdeck, your files, folders, images, comments and versions, is stored on uxdeck's servers and linked to your account, so it is there on any device you sign in from. It is processed only to store it, show it to you and to the people you share it with, and run the features you use on it. It is yours: I do not use it for anything else, and I do not look at it unless you ask me to help with a problem.

When you share a file, the people you share it with can see it, and what they see depends on the access you give them. Collaborators in a file see each other's names, pictures and live cursors, and whatever is said in its comments.

• The AI agent and the UX coach's agent. When you ask the agent for something, what it needs to answer (your request and the parts of the file it works on) is sent to Anthropic, which runs the Claude models behind it, to produce the answer. Anthropic processes it as uxdeck's service provider under its commercial terms, which do not allow it to train its models on this content. Nothing is sent to Anthropic unless you use the agent.
• Voice calls. A call in a file is relayed live by Cloudflare's real-time service between the people in it. Calls are never recorded or transcribed.
• Notifications on your devices. If you turn on notifications (for example, to continue on your computer what you opened on your phone), your browser's own push service (Google, Apple or Mozilla, depending on the browser) delivers them. They carry no content from your files.
• Email. uxdeck emails you sign-in links, invitations and access requests for files, comment and mention notifications (which you can turn off in Settings), and confirmations for account changes. They are sent by Cloudflare's email service. There are no newsletters and no marketing.
• Analytics on sites you publish. When someone visits a site published with uxdeck, the sites server counts the visit for the site’s owner: the page, the site they came from, their country (as Cloudflare reads it from the connection) and their kind of device. To count each visitor once a day, it makes a code from that day’s random value, their IP address and their browser. The IP address is not stored, and each day’s random value is deleted two days later, so the codes cannot be linked from one day to the next or traced back to anyone. No cookie is set and nothing is stored in the visitor’s browser. The counts are kept for three months, are shown only to the site’s owner, and are processed on that owner’s behalf.
• Fonts. When you use a Google Font in a design, your browser loads it from Google Fonts, which sees your IP address as it would on any website using those fonts.

uxdeck runs on Cloudflare: the app, its servers, the database, file storage and email. Like any host, Cloudflare processes IP addresses in short-lived logs to deliver the service and protect it from abuse. Cloudflare acts as my processor. On uxdeck.app’s public pages (the website, not the editor), I use Cloudflare Web Analytics to see, in aggregate, how many people visit, which pages they read and which load slowly. It sets no cookies, stores nothing in your browser and builds no profile of you.

uxdeck sets one kind of cookie: the sign-in cookie on api.uxdeck.app that keeps you signed in, plus a short-lived one used only while a Google or GitHub sign-in completes. Both are strictly necessary, and there are no advertising or tracking cookies. The website reads the same sign-in cookie, to show in its menu that you are signed in. When Google's sign-in service offers One Tap, it uses Google's own cookies on google.com, under Google's policy, not uxdeck's.

Your browser also keeps a working copy of the app and of the files you open, so uxdeck starts fast and keeps working through a poor connection. It is a cache of what is already in your account, and it is removed when you sign out. A few preferences, such as your theme and the coach's findings you dismiss in a file, are kept on your device too. On the website, a single marker remembers that you were signed in last time, so the menu can keep your picture's place while it checks; it holds nothing else and is removed when you log out there.

Your account and files are kept for as long as you have an account. Files you move to Trash can be restored until you empty it. When you delete your account from Settings, uxdeck emails you to confirm, and once you confirm, your account and every file you own are deleted, for everyone they were shared with. Backups made by the database provider roll off within 30 days.

No ads, no ad networks, no selling or renting of your data, no tracking pixels, no tracking across other sites. I never ask for, see or store your Google or GitHub password. If I ever add something that changes any of this, this policy changes first.

Payments are not open yet, and no payment provider receives anything about you today. When they open, paid plans will be sold through a payment provider acting as the merchant of record: you will pay on its checkout, and it will receive your name, email address, billing address and payment details to take the payment, charge tax and send receipts, under its own privacy policy. It will be named here, with a link to that policy, before any payment is taken. uxdeck will receive from it your name, email address, country, which plan you are on, how many seats, and whether your subscription is active, so that your plan works. I will never see or store your card details.

Depending on where you live (for example under the GDPR or Morocco's law 09-08), you have the right to access, correct, delete, restrict, move and object to the processing of your personal data. Some of this you can do yourself in Settings: change your name, choose which emails you get, sign out and delete your account. For anything else, or to complain, write to privacy@uxdeck.app. You can also complain to your local data protection authority.

When this policy changes, the date at the top changes with it. If a change affects how data you have already given is used, I will tell you by email before it applies.