Privacy Policy

Last updated: September 24, 2026

1. Who We Are

LoginDeck is operated by Balmer Island Media Inc., a corporation registered in Ontario, Canada ("LoginDeck", "we", "us", or "our"). This Privacy Policy explains how we collect, use, share, and protect personal information when you use the LoginDeck desktop application, the LoginDeck account and sync service, and our website (collectively, "the Software"). For purposes of the EU/UK General Data Protection Regulation, Balmer Island Media Inc. is the "controller" of the personal data described here. For purposes of the California Consumer Privacy Act as amended ("CCPA/CPRA"), Balmer Island Media Inc. is the "business".

2. What Stays on Your Computer

LoginDeck is local-first. The following are stored only on your device and are never transmitted to our servers, unless you enable sync (Section 4):

• the contents of your browser profiles: cookies, session tokens, saved logins, local storage, history, bookmarks, extensions, and cached files;
• the proxy addresses and proxy credentials you configure;
• your fingerprint settings for each profile;
• your Flows and their run logs;
• application logs and diagnostics.

Web traffic from a profile goes from your computer to the website (directly or through the proxy you chose). We do not proxy, inspect, or log the traffic of your browser profiles.

3. Information We Collect

We collect the minimum information needed to operate an account and a paid plan:

• Account information: the email address you sign up with. We also store a salted hash derived from your passphrase to check that a sign-in is genuine; the passphrase itself never leaves your device and cannot be reconstructed from what we hold.
• A sealed copy of your encryption key (key escrow): so that we can offer password reset, we store your account's sync encryption key sealed under a master key held by our server. This is a copy of the key, never a copy of your passphrase. It is opened only to complete a password reset that you start and confirm by email, or to complete a "Continue with Google" sign-in on an account you have already set up. See Section 4.
• Billing information: processed and stored by our payment processor, which acts as merchant of record and is named at checkout. We receive your plan, order and subscription identifiers, and the email used at checkout. We do not receive or store full payment-card details.
• Plan and usage data: your plan and its expiry, the number and type of synced records (not their contents), AI-action counts for metering, and the names and self-assigned identifiers of computers that have signed in to your account (so you can see and evict them).
• Computer identifiers: to apply plan limits (the free plan is one account per person, and each plan covers a set number of computers) and to prevent abuse, the Software sends one-way hashes of your computer's hardware identifiers, such as its motherboard UUID and its BIOS, board and system-disk serial numbers (on a Mac, its platform UUID and serial number). We receive and keep only the hashes, never the identifiers themselves, and a hash cannot be turned back into the identifier. We also keep the internet address a new account was created from, to limit how many accounts one connection can create.
• Internet connection (free plan): so that one internet connection cannot run several free accounts, when a free account connects we keep a keyed hash of the connection's internet address (for IPv6, of its network prefix) and which account used it. The hash is made with a secret key that never leaves our server, so what we store is not a readable address. Paid accounts are not recorded this way.
• Team data: if you invite members to a workspace, their email addresses and the permissions you grant them.
• Diagnostic information you choose to send: when you report a problem, the operating system, app version, and any logs you attach.
• Server logs: our servers record the IP address, time, and endpoint of requests to them (sign-in, sync, update checks, AI requests) for security and operations, retained briefly as described in Section 8.
• Communications: the content of emails or support messages you send us.

4. Encrypted Sync

When you enable sync, profile settings, proxies, tags, folders, Flows, and — on plans that include it — a profile's cookies and local storage are encrypted on your device using keys derived from your passphrase, and only then uploaded. Our servers store ciphertext, a salt, and a copy of your vault key wrapped under your passphrase.

We also keep a second, sealed copy of that vault key (key escrow). It is encrypted under a master key held by our server, and it exists for one reason: so that a forgotten passphrase is a password-reset email rather than a permanently locked account. We use it only to complete a password reset that you start and confirm with a code emailed to your address, and to complete a "Continue with Google" sign-in on an account you have already set up. We do not use it to read, mine, or hand over your synced data, and your passphrase is never stored in any form that can be turned back into text.

You should understand the trade-off this creates, because we would rather state it than imply otherwise: because that sealed copy exists, our servers are technically capable of decrypting your synced data, and an attacker who obtained both our stored data and our master key could do the same. This is why sensitive sync content is limited to what the feature needs, and why we recommend you do not rely on sync as the only copy of anything you cannot afford to lose. Synced data is stored on our servers in Europe/North America and in Cloudflare R2 object storage (Section 6). Closing your account deletes your synced data, and its escrowed key, from our storage.

5. Features That Contact Our Servers or Third Parties

• Update checks: the app periodically asks our update server for the latest version. That request carries your app version and, like any web request, your IP address.
• IP quality check: when you check a proxy, the app makes a request through that proxy to our server so we can report the proxy's public address, location, and reputation back to you. We see the proxy's exit address, not your home address, and we keep a short log of these checks for abuse prevention.
• AI Flows: when a Flow step uses AI, the page content or screenshot that step is looking at is sent through our server to our AI model provider (currently Anthropic) to produce the next action. We do not use this content to train models, and our provider does not train on it under our agreement. We keep a count of actions for metering, not the content.
• Imports from other tools: importing profiles from another profile manager happens entirely on your computer.

6. Data Sharing and Sub-processors

We do not sell your personal information. We share data only with the following categories of providers, and only as needed to operate LoginDeck:

• Payment processor (named at checkout) — checkout, billing, tax compliance, and fraud prevention.
• Hosting and storage providers (currently Hostinger for our servers and Cloudflare for object storage, DNS, and email routing) — for account data, encrypted sync data, logs, and backups.
• AI model provider (currently Anthropic) — for AI Flow steps, as described in Section 5.
• Email provider (currently Resend) — transactional and, if you opt in, product emails.
• Legal authorities — if required by a valid legal process (subpoena, court order, or similar), or to protect the rights, property, or safety of LoginDeck, our users, or the public.