Privacy Policy
Short version: we collect what MilkDesk needs to work, and nothing to sell. There is no advertising, no tracking and no analytics on this site.
What we collect
- Your account. Your email address, the display name you choose, and when the account was created. There is no password to store.
- What you put on desks. The PDFs you upload and the notes, diagrams and layout you create, kept so a desk is still there when you come back.
- Guests. If you join a desk without an account, we keep the display name you typed and a token in your browser that identifies you on that desk.
- Technical data. Your IP address is used briefly to limit how often sign-in links can be requested and to run the bot check on that form. Server logs record requests for a short period so we can find faults.
- Payment. We never see or store your card details. From Paddle we keep an identifier for you, which plan you are on, and its status.
What we do not do
We do not sell or rent your data, we do not use it to train anything, we do not show ads, and we do not run analytics or advertising trackers. We do not read the contents of your desks except when you ask us to look at a specific problem.
Cookies
We set one cookie to keep you signed in for up to 30 days. It is called md_session and is not used for tracking. Cloudflare Turnstile sets its own cookie
on the sign-in form to tell people from bots.
The services we rely on
MilkDesk is a small operation built on two providers. Both process data on our behalf:
- Cloudflare: hosting and storage (Workers, Durable Objects, D1 and R2), which means your account data and uploaded files live on Cloudflare's network. We also use Cloudflare Turnstile for the bot check on the sign-in form, and Cloudflare's email service to send sign-in links.
- Paddle: payments. Paddle is the merchant of record for paid plans, so they take the payment, handle tax and issue the receipt. What you type into the payment form goes to Paddle, not to us, and their privacy policy covers it.
Both are outside Taiwan, so your data is processed internationally under their own safeguards.
How long we keep things
Desks stay until they are deleted. That is the point of the product. When you delete a desk it stops being reachable in MilkDesk, and copies of files you uploaded to it may remain in our storage for a while afterwards. Sign-in links expire within minutes of being sent.
Your choices
Write to support@nycu.ai to get a copy of what we hold about you, correct it, or have your account and its desks deleted. We will do it within a reasonable time. Depending on where you live you may have further rights, and you can complain to your local data protection authority.
Children
MilkDesk is not intended for children under 13, and we do not knowingly collect their data.
Changes to this policy
If this policy changes, the date at the top changes with it. If a change is significant, we will say so by email.
Contact
Privacy questions: support@nycu.ai.