PRIVACY

What we keep, and for how long.

EFFECTIVE 9 NOVEMBER 2026

Who runs Deskhaus

Deskhaus is run by The Nomad Ops, which decides what is collected and how it is used. For anything on this page, write to hello@deskhaus.app.

What we keep

Your email is how you sign in. We use it for your sign-in codes and the reminders you switch on. News from Deskhaus only comes if you tick the box for it, and we note when you did. You can turn it off in your profile or from the link in any news email.

Chat is kept for 30 days. Door notes, and messages held while you're in Do not disturb, are kept for 7.

The member list

The Deskhaus team can see who has joined and download that list to run the haus. The news list holds only members who said yes. If we send news through an email service, it gets only the name and email of those members.

Deskhaus for teams

When you send the team form, we keep your name, work email, organisation, team size and message so we can reply and set up your haus. Email hello@deskhaus.app and we delete it.

Your public page and your links

Your public page and your Sit next to me link are off until you turn them on. While one is on we keep the link and what you ticked; turn it off and the link is gone for good. Your public page shows only what you ticked, never your email, your room or when you were last here. When someone walks in through your link we keep that they did, and whether you let them in, until either of you deletes your account. If you walk in through someone's link and they're around, they see your @username at their door, and the link's page tells you so. Your link says "A friend" unless you choose to show your @username or your real name. A username is often made from your name, so treat it the same.

Counting visits

We count visits to our pages on our own server, without cookies or a tracking script. Counting visits never stores your IP address. To count visitors we keep a scrambled code for one day at most, and it changes every day, so nobody can be followed from one day to the next.

Our security log is separate. When a request is blocked or slowed down, a sign-in fails, or something breaks on our side, we keep its IP address, country and the page it asked for, for 30 days.

When you're signed in, we note which days you opened the app, to count active members. That record goes when your account does.

When you click a button in one of our emails, we add one to the click count for that type of email. The count doesn't say who clicked.

Notifications

Push notifications are off until you turn them on in your panel's Settings. If you do, your browser hands us a token: an address for this device and the keys to encrypt to it. Token only, nothing else leaves your phone. We don't keep what device it is. Notifications go from our own worker, with no third-party service. A notification carries no message text and no names, only what kind it is, encrypted, so the push service your browser uses (Google, Apple, Mozilla or Microsoft) sees nothing. We keep a log of which kind went when, for 30 days, so we can stop at 6 a day. Your token goes when you turn this off, when you sign out, and when your account is deleted.

Deleting your account

When you delete your account, you have 30 days to change your mind: sign in and it all stays. After that your profile and sign-in email, your promises and check-ins, your focus sessions, your coins, your office and your board posts are removed. Messages other people received stay for up to 30 days under the name Deleted member, as all chat does. Reports stay for safety, without your name. Payment records stay, with no name on them, and the payment provider keeps its own. Your username stays unused for 90 days so nobody can pose as you.

Delete my account is at the bottom of your profile.

Cookies

Deskhaus sets only the cookies it needs to run. None of them track you and none come from anyone else, so there's no cookie banner.

• dh_session: Keeps you signed in. Up to 90 days, or 30 days without a visit, or until you sign out.
• dh_signin: Ties a sign-in code to the browser that asked for it, so the code only works there. 15 minutes.
• dh_device: Remembers that this browser has signed in to your email before, so your codes still arrive when your network changes. 90 days.
• dh_sit: Notes when this browser first opened a Sit next to me link while signed out, so the friend who shared it gets credit only for an account made after that. 7 days.
• dh_theme: Remembers day or night mode. A year.

The haus also keeps a few choices in your browser's own storage, such as which panels are open, the tips you've seen and 2D or 3D. They stay on your device.

Who handles it for us

A few providers handle information for us, only to run their part of Deskhaus:

• Cloudflare hosts Deskhaus, stores its database, sends our emails and carries voice calls between friends. It also runs the bot check on the sign-in form when that is on.
• Pesapal takes payments. It collects your payment details under its own privacy policy; we get whether you paid, the amount and a reference.
• Google Fonts serves the typefaces our pages use, and sees your IP address when a page loads.
• Telegram carries our security alerts to the team. An alert can include the IP address of a blocked request.
• If you turn notifications on, your browser's push service delivers them (see Notifications above).

If we start sending news through an email service, we'll add it here before the first send. We don't sell your information and we don't share it for advertising.

Where it's processed

Cloudflare runs Deskhaus on its network of data centres outside Kenya, so your information is stored and handled in other countries, whose laws may differ from where you live.

Your rights

You can see, correct or delete what we hold about you, and stop news at any time. Most of it is in your profile: change your details, turn news off or delete your account there. For anything else, such as a copy of what we hold, write to hello@deskhaus.app from your sign-in email and we'll answer within 30 days.

If you're unhappy with how we handle your data, you can complain to Kenya's Office of the Data Protection Commissioner, or to the data protection regulator where you live.

Children

Deskhaus is not meant for children under 16. We don't knowingly collect information from children under 16.

Changes

If this page changes, we post the new version here with a new effective date. For a big change we also tell members by email or in the haus.

The haus rules · Privacy · Terms