Privacy Policy

Last updated: August 27, 2026

GraphDeck is operated by Adam Broder, United Kingdom, acting as the data controller for the purposes of this policy. Registered with the UK Information Commissioner's Office, reference ICO00013746097. Contact: [email protected].

1. Data Collection

GraphDeck is designed as an offline-first tool. Your graphs, settings, and preferences are stored locally on your device and are never transmitted to us. The only data that leaves your machine is (a) optional update checks, (b) AI requests you initiate using your own API key, (c) for GraphDeck Pro only, the license-activation data described in Section 3, and (d) the anonymous, opt-out usage counts described in Section 5.

2. Local Storage

All your data (blueprints, settings, preferences) is stored locally on your computer. GraphDeck does not have access to this data.

3. Pro License Activation

GraphDeck Pro requires a valid license key. To enforce the 3-machine limit described in our Terms of Service, the Software sends the following to our activation server when you activate or validate a Pro license:

• Your license key.
• A hashed, non-reversible identifier derived from basic properties of your device. The raw properties never leave your machine — only the hash is transmitted.

Purpose. This is used solely to enforce your license terms and prevent unauthorised key sharing. It is not used for analytics, advertising, profiling, or any form of user tracking.

Legal basis (GDPR). We process this data under legitimate interest (Art. 6(1)(f)) — specifically, licence enforcement and fraud prevention. No separate consent is required for this purpose.

Where it is stored. On our activation server, alongside your license key and an activation timestamp. It is not shared with any third party.

Retention. Stored while your Pro license is active. Deleted when you clear your active machines via Settings → Deactivate All Machines, when the license ends (e.g. refund or revocation), or on request via email.

Your rights. Under UK/EU GDPR you have the right of access, rectification, erasure, restriction, and objection. To exercise any of these, email [email protected] with your license key. You can self-serve erasure at any time via Deactivate All Machines.

Scope. This section applies only to GraphDeck Pro. The Free edition does not require activation and sends no license data.

4. AI Features

If you use the optional AI generation features, prompts are sent directly to the AI provider you configure (such as Anthropic or OpenAI) using your own API key. GraphDeck does not intercept, store, or log these communications.

5. Anonymous Usage Counts

To learn which features are used and guide development, GraphDeck counts feature usage anonymously (in both the Free and Pro editions).

• What is sent: event names with counts (for example “ai_generate: 3”), the app version, and the operating system family. The full fixed list of event names is published at graphdeck.app/telemetry-events.
• What is never sent: your graphs or their contents, node or graph names, file paths, prompt text, personal information, or any device or install identifier. The counts cannot be linked to you.

This is disclosed on first launch and you can turn it off at any time in Settings → Privacy (or machine-wide via the GRAPHDECK_TELEMETRY=off environment variable). When it is off, nothing is tallied and nothing is sent.

Beyond this, GraphDeck does not use tracking pixels or similar technologies. The Pro license-activation calls described in Section 3 are not used for tracking or profiling.

6. Third-Party Services

GraphDeck does not share your data with any third parties for marketing, advertising, or profiling. Payment processing for Pro purchases is handled by Paddle, who acts as the merchant of record and has its own privacy policy.

7. The Website

The graphdeck.app website is hosted on Cloudflare, which processes visitor IP addresses to serve and secure the site. Beyond hosting, three third-party services run on the site:

Mailing list. The "Stay in the loop" signup form on the homepage is provided by EmailOctopus. If you submit it, the email address you enter is stored by EmailOctopus on our behalf and used only to send GraphDeck updates; every email carries an unsubscribe link. EmailOctopus has its own privacy policy.

Spam protection. That form is protected by Google reCAPTCHA, which loads on the homepage and analyses interaction signals (such as IP address and browser information) to distinguish people from bots. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

Fonts. Web fonts are served from Google Fonts, which receives your IP address in order to deliver them.

None of these services is used for advertising or profiling, and none is loaded by the GraphDeck app itself.

8. Updates

The Software may check for updates via a secure connection. No personal data is transmitted during this process.

9. Contact

For questions about this privacy policy, or to exercise any of your rights under GDPR, email [email protected] or visit graphdeck.app.