# Privacy

Last changed: 27 October 2026

Småverk runs Maindesk and is responsible for your personal data in it (the controller). Write to
maindesk@smaverk.com with questions and requests.

## What we collect, and why

- **Your email address**, to sign you in, and to write to you about your account and answer you.
- **How you sign in**: a hash of your password, or the sign-in provider you chose and the account id it gives us. To
  sign you in.
- **Your desk's files and machines**: what you and your agents put on your Linux desk, your Windows machine and your
  desk drive, and the settings of each machine. To run your desk; this is the service.
- **Task logs**: each task's title, prompt, steps, messages and result, and the sign-in list of your desk with its log.
  To show you what your agents did and let you take over.
- **Usage minutes**: how long each machine ran, per day. To count your plan, the daily stop and the prices.
- **Payment status**: your plan, whether it is paid, and the payment provider's customer id. To give you the plan you
  paid for. Your card details stay with the payment provider; we do not see or store them.
- **Sessions and requests**: the browser of each session you are signed in on (Settings lists them), and the network
  address of requests, to limit abuse and keep the service safe.

We use your data to run Maindesk, to keep it safe, and because the law asks for it (bookkeeping). We do not sell it,
and we do not use it for advertising.

## How long we keep it

- Your account, desk, files and task records: while you have the account. A finished task's screen and run logs on
  the desk are cleared after 14 days.
- After a plan ends: your files stay on your desk, at least 90 days, and today until you delete
  your account.
- When you delete your account, your machines, files, keys, sessions and desk are deleted at once. Our database backups
  keep a copy until they expire, at most 62 days later. Records of machine time stay, because they count toward the
  server's daily limit, and payment records stay as long as bookkeeping law asks (7 years in Sweden).

## Where it is processed

Our server, its database and backups, the Windows machines and the sign-in browsers run in Stockholm, Sweden. Your
Linux desk and your Mac jobs run in the United States. Transfers outside the EU are covered by the EU's Standard
Contractual Clauses or the EU-US Data Privacy Framework.

## Who processes your data

These companies process data for us, each for the part named:

- **Amazon Web Services** (Stockholm, Sweden): our server, its database backups, Windows machines, sign-in browsers,
  file transfers and the email we send.
- **E2B** (United States): Linux desks.
- **Google Cloud**: Linux desks for some accounts.
- **use.computer** (United States): Macs.
- **Namespace** (United States): Mac jobs by the minute.
- **Cloudflare** (western Europe): the desk drive.
- **Stripe**: payments. It is the merchant of record, and your card details stay with it.
- **Google, GitHub and Apple**: sign-in, when you choose to sign in with one of them. They tell us your email address.
- **Google Fonts**: the web page's fonts. Your browser asks it for them, so it sees your network address.

Your AI agents' vendors are not on this list: you sign in to them yourself, with your own plan or key, and their terms
apply to what your agents send them.

## Your rights

You can see, copy, correct and delete your data.

- **Access and export**: your files are on your desk; copy them with `maindesk pull` or the files tools. Your tasks and
  their logs are on the Tasks page and in the API. For a copy of everything we hold about you, write to us.
- **Deletion**: Settings, Delete account. Or write to us and we delete it.
- **Correction, objection and restriction**: write to us.

Write to maindesk@smaverk.com from your account's email address; we answer within 30 days. You can also complain to
the Swedish data protection authority (IMY, imy.se).

## Cookies

Maindesk sets only the cookies it needs to work, and no tracking or advertising cookies:

- `md_session`: keeps you signed in (30 days).
- `__Host-md_oauth`: holds a sign-in with Google, GitHub or Apple while it happens (10 minutes).
- `md_embed`: the demo desk on the home page (2 hours).
- `mdp_<port>`: opens a preview link of your desk (as long as the link).

The page also keeps a few choices in your browser's own storage (the theme, an unsent draft, panel widths); they stay
in your browser.