Privacy Policy

1. Who is responsible

fuda, Inc. operates Dekkit and is responsible for the personal data processing described in this notice. Contact our privacy inbox at hi@dekkit.ai. This notice covers our websites, web app, mobile and desktop apps, browser extensions and related support.

This notice explains our practices; using Dekkit is not blanket consent to every form of processing. Optional cookie consent is separate. The Data & AI Policy and Cookie Policy give more detail.

2. What we collect

• Account and profile: name, email addresses, authentication records, profile image, preferences, terms acceptance and your declaration that you are at least 18. We record the accepted version and time, rather than collecting a date of birth or identity document for this declaration. If you sign in with Apple or Google, we receive the identifiers and profile details that service shares, which can include a private relay email. We do not receive your Apple or Google password.
• Saved content: URLs, notes, files, images, audio or video you submit, Card metadata, Decks, Collections, tags, comments, ratings, sharing permissions and activity. Other users may provide your email when sharing or inviting you.
• Derived content and AI: extracted page or file text, previews, summaries, transcripts, generated images, embeddings (numerical representations used for search), prompts, assistant conversations and usage records. Uploaded files can contain EXIF metadata, including camera details or GPS coordinates. This is different from continuously tracking your device’s location.
• Subscriptions: plan, billing status, customer and transaction identifiers, purchase validation and renewal information from Stripe or Apple. Payment providers handle your payment details; we do not store your full payment card number.
• Notifications: your delivery preferences, browser push subscription or Apple device push token, app identifier and delivery environment. Notifications can include a sender name, content title or message preview and a link to a Card or Deck; previews may appear on a lock screen.
• Support and safety: contact messages, reports, blocking relationships, content references and moderation records.
• Technical data: IP addresses and request, authentication, error and security logs needed to run the service. When Dekkit hits a fault, the website or app sends a diagnostic report with the error type, a technical message from which links and email addresses are removed, the code location, app version, platform and the section of Dekkit that was open. Reports from your device are not linked to your account and store nothing on it; a fault on our servers may be recorded against your account identifier.
• Product usage: events that record what was done, not what was saved: for example that a Card or Deck was created or shared, that enrichment finished, that a plan changed or that an AI feature was used, together with attributes such as Card type, plan name, counts and token totals. They are recorded on our servers against your account identifier and never include Card text, titles, URLs, prompts or your email address. You can turn them off in Settings.
• Visit analytics: on the website and web app, and only after you accept analytics, page-view events with the section opened, the website domain you arrived from, campaign tags and browser/device information. These are not linked to your account. Dekkit does not run visit analytics in its native apps. The same AdSense tag used on dekkit.app also loads in those apps.

3. Why we use it

Where the GDPR or comparable rules require a legal basis, we rely on the following bases according to the processing involved:

• Providing the service and performing our agreement: sign-in, storing and organizing content, supported AI processing, sharing you request, managing subscriptions and answering service requests. Required account and content information is necessary to provide those features.
• Legitimate interests: securing accounts, preventing abuse, investigating safety reports, diagnosing faults, resolving disputes and understanding how Dekkit’s features are used so we can improve them (product usage events). We consider the impact on individuals and their rights; you can object where this basis applies, and you can switch product usage events off at any time in Settings → Product analytics.
• Legal obligations: applicable tax, accounting, regulatory and valid legal requests.
• Consent where required: optional visit analytics in the browser and optional communications. Push delivery also requires the relevant browser or operating-system permission. You can withdraw an optional choice without making earlier lawful processing unlawful.

AI organization and suggestions assist your use of Dekkit; they are not a system for making decisions about you with legal or similarly significant effects.

4. Who receives it

We do not sell your personal data. Information may be disclosed to:

• People you share with: recipients, collaborators and people with access to public links, according to your sharing choices. Your name, avatar and relevant activity may be shown to them.
• Infrastructure providers: Google Cloud for hosting and file storage, MongoDB for database services, and our configured email delivery provider (SMTP2GO) for service messages.
• AI providers: OpenAI and Google Gemini when the relevant processing is configured. NVIDIA/Kimi is experimental and is not used for production users’ content. The Data & AI Policy explains the types of data involved and differences between providers.
• Payments, identity and delivery: Stripe, Apple and Google for the payment or sign-in services you use; Apple Push Notification service and browser push services for enabled notifications.
• Analytics and diagnostics: PostHog, hosted in the United States, receives fault reports, product usage events unless you have turned them off, and visit analytics only after you accept it on the relevant website or web app. Google AdSense loads on dekkit.ai, dekkit.app and in the iOS, Android and desktop apps. Advertising choices are collected by Google’s European regulations message.
• Legal and operational recipients: authorized personnel, professional advisers or authorities where necessary to handle support, protect rights or meet legal obligations. A business transfer may involve relevant records, subject to applicable protections and notice requirements.

Payment, identity, external media and platform providers may also process information for their own purposes under their own privacy notices. Opening external content can disclose your IP address and browser information to that provider. Safety reports are handled for investigation and are not published to the reported user.

5. International processing

Dekkit uses providers operating internationally. Information may be processed outside your country, including in the United States; a European hosting region does not mean that AI, email, payment and support processing all remain in Europe.

Where applicable law requires a transfer mechanism, the relevant transfer must be covered by an adequacy decision or appropriate contractual safeguards and any necessary supplementary measures. Contact hi@dekkit.ai to ask which destinations and safeguards apply to your information and to request a copy of applicable safeguards. We do not promise exclusive storage in one country.

6. Retention and deletion

Account details and saved content are kept to provide the service while you maintain an account. Moving content to Trash is not immediate permanent erasure: it remains recoverable until permanently removed or the applicable Trash cleanup runs. Assistant conversations and generated metadata are stored to support your history and features.

You can request account deletion in Settings → Delete my account or contact our privacy inbox. Deletion removes access and starts removal of account-related information, including the product usage events held by our analytics provider; turning Product analytics off in Settings also deletes those events. It is not a promise that every record, backup, provider log or recipient’s copy disappears instantly. Contact us for an erasure request covering remaining AI history, uploads or other records.

Some records may need to be retained for accounting, fraud prevention, safety investigations, disputes or legal obligations. Their retention depends on those requirements, the time needed to resolve the issue, and applicable limitation periods. Provider processing and backup cycles can have separate retention periods. Copies others have saved and content they independently own are not erased by deleting your account. Store billing must be cancelled separately.

7. Your choices and rights

• Review and edit your profile, preferences and sharing permissions in Dekkit.
• Enable or disable notification options in Settings. On iOS you can also change permission and lock-screen previews in the system Settings. This does not stop essential account or billing messages.
• Change optional visit analytics through Cookie preferences on each browser/site, and turn product usage events on or off for your account in Settings → Product analytics; declining either does not prevent core use of Dekkit.
• Request access, correction, deletion, restriction, objection or a portable copy of your data where the applicable law grants those rights. You may withdraw consent where processing relies on it.

Email hi@dekkit.ai from your account address where possible. We may need proportionate verification before disclosing or deleting information. We respond within the period required by applicable law. You can complain to your competent data protection authority, including your EEA authority or the Swiss Federal Data Protection and Information Commissioner where applicable. These rights can be subject to lawful exceptions.

8. Browser Extension

Dekkit Share saves the webpage URL, selected text or image you explicitly choose to send to Dekkit. It does not continuously collect your browsing history. It stores authentication information and recent deck selections locally and can read Dekkit session cookies to restore sign-in, not unrelated websites’ cookies. The extension does not include advertising or analytics trackers.

We do not sell this data, use it for personalized advertising or use it to determine creditworthiness or lending eligibility. Saved content is processed by Dekkit and its AI providers as explained here. Removing the extension clears its local data according to the browser’s rules; it does not delete content already saved to your Dekkit account.

9. Security and children

We use authentication, access controls and encrypted connections to protect data. No service can guarantee absolute security. Dekkit’s server-side enrichment requires content processing and is not end-to-end encryption that excludes our servers and processing providers.

Dekkit is for adults aged 18 or older and is not offered to minors, including with parental permission. The age declaration is not an independent identity or age verification. If you believe someone under 18 has an account, contact hi@dekkit.ai so we can investigate, restrict access and address removal of their data as appropriate.

10. Updates and contact

We will update this page when practices change and provide additional notice for material changes where required. A revised notice does not replace consent when consent is needed.

Privacy requests and questions: fuda, Inc., hi@dekkit.ai.