What we keep, and why.
Desk exists to hold one support conversation across email and the web. It collects only what that needs.
What we store
- • Your name, email address and the conversations you participate in.
- • Messages, timestamps, channel metadata and delivery status.
- • Attachments you send, held in Cloudflare R2.
- • Security events such as sign-in and failed verification attempts.
We do not use advertising trackers, sell data, or share conversations with third parties beyond the processors listed below.
How access works
A ticket reference is not a credential. Portal access requires a verified email address that already participates in the conversation. Verification links are single-use, expire after 15 minutes, are hashed at rest and are exchanged for an HttpOnly session cookie.
Email authentication results (SPF, DKIM, DMARC) help us judge whether a message is authentic. They do not prove that the human sender is authorized, and a mismatched sender is held for review rather than attached to the conversation.
Processors
- • Cloudflare — application hosting, D1 database, R2 attachments, email routing.
- • Resend — outbound email delivery and delivery events.
- • OpenRouter — optional drafting assistance. Only ticket text and relevant published documentation are sent; identity and access decisions stay in Desk.
Retention and deletion
Conversations are kept while they are needed to support you and to meet legal obligations. You can ask us to delete a conversation and its attachments. Security logs are kept for a shorter period and then removed.
Your rights
You can request access to, correction of, or deletion of your data, and object to processing. Write to the address below from the verified email on the conversation and we will respond within the period required by law.