Privacy Policy
Written in English, Polish and Russian. If the versions differ, the Polish version applies.
Who is responsible
Desorb is run by a private individual in Poland. It is not a registered company. This person decides why and how your data is used, which makes them the controller under the GDPR.
Contact: legal@desorb.app.
What we never receive
Everything the app does to your accounts happens on your PC. These things never leave it:
- The text, pictures and links of your messages, posts and comments.
- Your passwords. Desorb never asks for them.
- Your platform tokens and sign-ins.
- Your filters, search words and the list of items you reviewed.
- Your archives and your log files.
What we do collect
This is the complete list of what our servers hold about you or your visit. Hashed values are still personal data under the GDPR, because someone with the right extra data could link them back to you. We treat them that way.
| What | Why | Where | How long |
|---|---|---|---|
| Your account code, stored as a hash plus its first and last four characters | Sign you in and link your license | Our database | Until you delete your account |
| A session token (hashed), the time of last use, a hash of your IP address and browser, the app version | Keep you signed in and spot abuse | Our database | Until the session ends: 7 days on the web, 30 days in the app |
| A hash that identifies your PC (made from the Windows machine id, so we cannot read the id back from it) | Count the free allowance per PC and stop it being reused | Our database | Kept after you delete your account, with no link to you, so the free allowance cannot be reset |
| How many Discord items the app asked to remove, and how many it removed | Apply the free Discord allowance | Our database | Until you delete your account |
| Your license state. Once sales open: payment id, provider, amount, currency and status | Know what you bought, handle refunds, keep accounts | Our database and the payment provider | As long as accounting and tax law require |
| A hash of your IP address on sign-in and sign-up attempts | Limit guessing and abuse | Our database | Removed soon after the short limit window ends |
| Security log entries: event type, time, hashes of IP address and PC | Detect abuse and show what happened | Our database | Kept for security and legal claims. After you delete your account, nothing links them to you |
| Your browser push address and keys, only if you click "Get notified" | Send the one launch notification you asked for | Our database | Up to 90 days, or until your browser revokes it or you ask us to remove it |
| The announcement you dismissed | Do not show it again | Your browser (local storage) | Until you clear site data |
The website
The website has no analytics, no advertising tools and no embedded third-party content. Fonts and icons come from our own server.
If you sign in on the web, we set one cookie, desorb_session. It is HttpOnly, SameSite Strict and Secure, and lasts up to 7 days. It is needed for the sign-in to work, so no cookie banner is required.
A service worker is installed only if you click "Get notified". The hosting provider sees your IP address and browser details in order to deliver each page, as every web host does.
The desktop app and our servers
The app talks to our servers only for your Desorb account. It sends:
- your account code, when you create an account or sign in;
- a session token, the app version and your PC hash with each account request;
- for Discord only: how many items you ask to remove and how many were removed, so the free allowance can be applied.
Updates are checked only when you click "Check for updates". The update server then sees your IP address. The app sends no telemetry and no crash reports. Diagnostics stay on your PC until you copy them yourself.
An account is optional. The local features work without one.
What stays on your PC
Desorb keeps its files in %APPDATA%\Desorb. Please know how they are protected:
- Platform tokens and your Desorb session are encrypted with Windows DPAPI, so only your Windows user account can read them.
- The lock passphrase hides the app and blocks actions. It is a screen lock, not disk encryption.
- Archives and the lists the app keeps while you review results contain the text of your items. They are plain files and are not encrypted. Archives sit in the folder you choose.
- Log files have tokens and similar secrets removed and never contain message text.
For Discord, the app can look for a signed-in Discord session in the browsers and the Discord app of your Windows user. It asks for your consent first, reads only on your PC, checks the result with Discord, and saves only the one you pick. Nothing from this is sent to us.
To remove local data, use Reset in Settings, or delete the folder %APPDATA%\Desorb and your archive folders. Uninstalling the app does not delete them.
Platforms you connect
When you clean an account, your PC sends requests directly to that platform: Discord, YouTube, Facebook, Instagram, GitHub, GitLab, TikTok, Twitch, Pinterest or Dev.to. They receive what any request from you would contain, and their own privacy policies apply to it.
Who else handles data
We do not sell your data or use it for advertising. Service providers process it on our behalf: our hosting and database providers (in the EU and the United States), browser push services that deliver notifications, and, once sales open, a payment provider.
Where data leaves the European Economic Area, we rely on standard contractual clauses or another transfer mechanism the GDPR recognises. You can ask us for the names of these providers at any time.
Why we may process it
- Contract: to give you an account and a license (GDPR Article 6(1)(b)).
- Legitimate interest: to protect the service from abuse and to keep the free allowance fair (Article 6(1)(f)).
- Consent: for browser push notifications. You can withdraw it in your browser at any time (Article 6(1)(a)).
- Legal obligation: to keep accounting records once sales open (Article 6(1)(c)).
Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit its use, or send it to you in a usable format. You can object to processing based on our legitimate interest, and you can withdraw consent.
To delete your account, use "Delete account" on your account page. It takes effect at once. For anything else, write to legal@desorb.app. Because we hold no name or email for you, we need your account code to find your record. Without it we cannot tell which record is yours. We answer within one month. We do not make automated decisions that affect you.
You may also complain to the Polish data protection authority (the President of the Personal Data Protection Office, UODO, uodo.gov.pl) or to the authority in your own country.
Children
Desorb is not meant for anyone under 16. We do not knowingly collect data from children. If you think a child has an account, tell us and we will delete it.
Security
Account codes and session tokens are stored only as hashes. The database cannot be reached from the public internet or by the website directly, and only our account service can use it. Connections are encrypted. No system is perfectly safe. If a breach puts your rights at risk, we will tell you and the authority as the law requires.
Changes to this policy
If we change this policy in a way that matters, we say so on the website and update the date at the top. Earlier versions are available from us on request.
Contact
Questions, requests or complaints: legal@desorb.app. The rules for using Desorb are in the Terms of Service.