Command Desk: Privacy Policy

Effective 2026-09-25. Controller: DDA Projects SIA, Latvia. Contact: [email protected].

In one paragraph

Command Desk stores your matters on your device, encrypted with a key derived from your passphrase. We do not collect analytics, do not show ads, and do not ask you to create an account. If you turn on sync, our server stores only ciphertext it cannot read. If you buy Command Desk Pro, the store and our billing provider handle the payment under an anonymous identifier. The other Pro features (Obsidian bridge, AI agent bridge, report export) work entirely on your own device.

What the app stores on your device

Your matters, clients, to-dos, notes, file references, time entries and hourly rates, and progress, encrypted at rest (AES-256-GCM; passphrase → Argon2id). Time entries are vault data like everything else: they never leave the device except as ciphertext through sync or as Markdown into a folder you chose. Your passphrase and your recovery code are never stored in plain text and never leave the device. If you enable biometric unlock, the passphrase is sealed in the operating system's secure element (Android Keystore / iOS Keychain) and released only after the OS verifies you.

Sync (Command Desk Pro, optional)

If you connect a sync server, the app sends and receives only encrypted records, addressed by a random per-account code. The server holds: that code's hash, record identifiers, version counters, timestamps and ciphertext. It holds no passphrase, no key, and no readable content. Losing both your passphrase and your recovery code makes the data unrecoverable, by design.

Purchases

Command Desk Pro is sold through Google Play (and, later, the App Store). Our billing provider, RevenueCat, receives an anonymous app-user identifier and the purchase record from the store so the app can confirm your entitlement and restore it on a new device. On macOS, which has no store SDK, the app checks your Pro entitlement by sending only that anonymous RevenueCat identifier to RevenueCat; the answer is cached on your Mac. No content from your vault is ever sent to the store or to RevenueCat. RevenueCat's privacy policy: https://www.revenuecat.com/privacy

Obsidian bridge (Command Desk Pro, macOS, optional)

If you turn on the Obsidian bridge, the app writes Markdown copies of your matters into a folder you choose on your Mac and reads edits you make to those files back into the app. Those files are plain text, protected only by whatever protects that folder (FileVault, your Obsidian sync, etc.); the bridge is off by default and you pick the folder.

AI agent bridge (Command Desk Pro, macOS, optional)

If you turn on the agent bridge, the app runs a small server only on your own Mac (loopback address 127.0.0.1, random port) with a per-session token that is regenerated each time it starts. Tools you run on the same Mac and give that token to (for example an AI coding assistant) can read and change your matters through it. Nothing leaves the device; the server stops when you lock the vault or quit. Every request is listed in Settings under "Agent activity".

Report export (Command Desk Pro, optional)

Report export renders a Markdown summary of your matters into a file that you then choose to save or share. The app itself sends it nowhere.

What we do not do

No analytics or crash-reporting SDKs. No advertising. No account, e-mail or phone number. No access to your contacts, location, camera or microphone. No sale or sharing of data with anyone.

Optional local features (macOS desktop app only)

The watched-folder Inbox reads file names in folders you explicitly choose. The optional local-model classifier sends only a file name and your matter titles to a model runner on your own computer (loopback addresses only; the app refuses any other host). Nothing goes to the internet.

Refunds

Command Desk Pro is sold through Google Play (and later the App Store). Within 48 hours you can refund directly from Google Play. After that, email [email protected] within 14 days of a first yearly purchase or lifetime unlock and we will refund it in full, no questions asked. Renewals are not refunded, but you can cancel at any time and keep Pro until the period ends. App Store purchases are refunded by Apple. Your matters and vault data always stay on your device and are unaffected by a refund; only sync and Pro features stop. Statutory rights under EU and Latvian consumer law are not limited by this policy. Seller: DDA Projects SIA, Latvia.

Deleting your data

Delete the app, or in the app delete the vault. If you used sync, the server keeps only ciphertext that nothing can decrypt once your keys are gone; contact us to have the account's ciphertext removed.

Changes

We will update this page and the effective date if anything above changes.