Privacy Policy

1. Summary

• DeckPad has no accounts, no ads and no analytics. Neither app sends telemetry or crash reports.
• We (the publisher) do not collect, receive, store, sell or share any personal data from the apps.
• Your buttons, icons and settings are stored on your PC and your phone and travel only between those two devices, over a USB cable or Bluetooth. They are never sent over the internet by DeckPad.

2. Who we are and what this policy covers

DeckPad is published by DeckPad (“we”, “us”). This policy covers:

• the DeckPad app for Android (the “phone app”);
• DeckPad for Windows, the companion app that runs on your PC (the “PC app”);
• this website.

You can contact us at support@deckpad.app.

3. What we don't collect

The apps do not send any information to us or to anyone else. Specifically, DeckPad does not collect:

• names, email addresses, phone numbers or any account details (there are no accounts);
• location (the phone app doesn't request location access);
• contacts, photos, files, messages or browsing history;
• advertising identifiers, usage analytics, crash reports or diagnostics.

The apps contain no advertising, analytics or tracking libraries. The PC app has an unused “telemetry” setting reserved in its settings file; it is off, nothing reads it, and no telemetry is sent. If that ever changes, it will be opt-in and this policy will be updated first.

4. What stays on your devices

To work, DeckPad stores the following only on your own devices. We have no access to it.

On your phone

• A random identifier the app creates so your PC can recognise this phone. It is not linked to your identity or any Google or device ID.
• The pairing token for each PC you pair with, encrypted with a key kept in the Android Keystore.
• A copy of your button profiles, pages and key icons, so the deck appears instantly.
• App settings: show labels, vibrate on press, keep screen on, screen dimming, and the name and Bluetooth address of the PC you chose for Bluetooth.

The phone app opts out of Android's cloud backup, so this data isn't copied to your Google account.

On your PC

In %AppData%\DeckPad:

• settings (agent-settings.json), including an OBS WebSocket password only if you add one yourself;
• your button profiles (profiles.json) and automatic backups of them;
• the list of paired phones (devices.json): each phone's random identifier, its name, when it was paired and last seen, and a one-way fingerprint (SHA-256 hash) of its pairing token. The token itself is not stored on the PC.

In %LocalAppData%\DeckPad:

• an icon cache and a list of the apps installed on the PC, used for the app picker;
• log files that record what DeckPad did: connections and pairing (including the phone's name, model and USB serial number), which type of action ran, how long it took, and any errors (which can include the path of a file or app that couldn't be opened). Logs don't contain the text typed by “Type text” buttons. They never leave the PC unless you choose to send them to us when asking for help.

5. What passes between your phone and your PC

The phone app and the PC app talk directly to each other, either through the USB cable (using Android's USB debugging connection) or over a Bluetooth connection to a PC already paired with the phone. This traffic does not go over the internet and never reaches us. It includes:

• the phone's random identifier, its name (as set in Android, or its model if none is set), its model, its Android version and the app version;
• the 6-digit pairing code you type, and the pairing token used to reconnect;
• button presses and the actions to run;
• your button profiles and icons, including changes you make in the editor;
• for the app picker, the names and icons of apps installed on the PC; for OBS buttons, the names of your OBS scenes.

Your OBS WebSocket password stays on the PC and is never sent to the phone.

6. Android permissions

DeckPad doesn't ask for location, camera, microphone, contacts, storage or phone permissions.

7. Sharing and third parties

We don't share or sell any data, because we don't collect any. Some things to be aware of:

• Actions you set up. When a button opens a website, an app or a file, or controls OBS Studio, your PC does that with its own apps. Those apps and websites have their own privacy policies.
• Google Play. If you install the phone app from Google Play, Google handles the download and may collect information under its own privacy policy. We receive only the aggregated statistics Google Play shows every developer, such as install counts.
• This website. It uses no cookies, analytics or tracking scripts. It loads a few files from two other services, so your browser connects to them and they receive your IP address and browser details:
  • Google Fonts (fonts.googleapis.com and fonts.gstatic.com) for the fonts, on every page, under Google's privacy policy;
  • jsDelivr (cdn.jsdelivr.net) for the three.js 3D library, on the home page only, and only when your browser can show the 3D animation and you haven't asked it to reduce motion, under jsDelivr's privacy policy.
  Like any website, the company that hosts it may keep standard server logs (such as IP address, browser type and the pages requested) for security and to keep the site running.
• Email. If you email us, we use your message and address only to answer you, and delete them when they're no longer needed.

8. Security

• A phone must be paired with a one-time 6-digit code shown on the PC before it can do anything. Codes expire after 2 minutes, and repeated wrong codes lock pairing.
• The pairing token on the phone is encrypted with a key held in the Android Keystore; the PC keeps only a one-way hash of it.
• The PC app accepts connections only on the PC itself (through the USB connection) and over Bluetooth from devices already paired with Windows, using an authenticated, encrypted Bluetooth link. It refuses connections from web pages open in your browser.
• The phone app refuses unencrypted connections to anything other than the phone's own local address.

No system is perfectly secure. Keep your PC and phone locked and up to date, and approve USB debugging only for your own computers.

9. Retention and deletion

Everything DeckPad stores stays on your devices until you delete it. The PC app keeps one log file per day and deletes logs older than 7 days automatically.

To delete your data:

• Phone: uninstall the app, or go to Android Settings → Apps → DeckPad → Storage → Clear data.
• PC: uninstall DeckPad for Windows, then delete the folders %AppData%\DeckPad and %LocalAppData%\DeckPad if they remain.

Step-by-step instructions are on the Delete your data page. Because we hold no data about you, there is nothing to delete on our side.

10. Children

DeckPad is a general-purpose tool and isn't directed at children under 13. It doesn't knowingly collect personal information from anyone, including children.

11. Your choices and rights

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have rights to access, correct, delete or move your personal data, and to object to its use. Because DeckPad doesn't send personal data to us, we hold none to provide, correct or delete; all DeckPad data is on your devices and under your control, as described above. If you email us, you can ask us to delete your messages at any time. For any privacy question, contact us.

12. Changes to this policy

If DeckPad's handling of data changes, we'll update this page and the effective date above before the change takes effect. For significant changes, such as any new data leaving your devices, we'll also say so in the app's release notes.

13. Contact

Questions about this policy or your privacy: support@deckpad.app.

Publisher: DeckPad