Privacy Policy

Last updated: October 19, 2026

This policy explains what data Wardesk collects, why we collect it, and how we protect it. We wrote it in plain language because you deserve to understand what happens with your information.

Wardesk is operated by OVERMATCH OÜ, a company registered in the Republic of Estonia (EU) under registry code 17564126. Because we are based in the European Union, the General Data Protection Regulation (GDPR) applies to all data we process, regardless of where you are located.

Legal basis for processing

Under GDPR Article 6, we process your data on the following legal bases: performance of contract (providing the service you signed up for), legitimate interest (improving the product, understanding how people find Wardesk, preventing abuse), and consent (for optional features like AI-powered briefings, which you can choose not to use).

What we collect

When you create an account, we collect your email address and display name. These are required to identify your account and personalize your experience.

If you sign in with Google, Google shares your name, email address and profile picture with us so we can set up your account.

If you subscribe to Pro, you pay on a checkout page run by Stripe. Your card details go straight to Stripe and never reach us. We keep your subscription status, a Stripe customer reference, and a record of the terms you accepted at checkout.

When you use Wardesk, we store the data you create: projects, tasks, milestones, your Weeklies, goals, and context notes. This is your content and it lives in your account.

We also collect basic usage data to keep the product working and improve it over time. This includes things like which features you use, how often you log in, and your device type. We do not track you across other websites.

AI features and your data

Wardesk includes an AI companion called Aster, powered by Google Gemini. When you use Aster, we send a snapshot of your project data (tasks, deadlines, progress, goals) to Google's API to generate personalized advice.

This data is sent only when you actively use AI features. It is not stored by Google beyond the time needed to generate a response. We do not use your data to train AI models, and we require the same commitment from our AI providers.

How we use your data

We use your data for three purposes: to run the product (storing your projects, generating briefings, tracking your progress), to improve the product (understanding which features are used, where things break, and which of our pages and campaigns bring people to Wardesk), and to communicate with you (account-related emails like password resets, and notification emails, which you can turn off in Settings). That's it.

We do not sell your data to anyone. We do not share it with advertisers. We do not use it for profiling or behavioral targeting.

Where your data lives

Your data is stored in Supabase (built on PostgreSQL), hosted on infrastructure within the European Union. Supabase maintains SOC 2 compliance and encrypts data at rest and in transit. Nightly backups of the database are stored with Cloudflare in Europe.

Sub-processors

We use the following third-party services to operate Wardesk:

Each sub-processor is bound by a Data Processing Agreement. Stripe also handles some payment data as an independent controller, for example to prevent fraud and to meet its legal obligations, under its own privacy policy. We will update this list if we add new sub-processors and notify users of significant changes.

A few features load content straight from other services, which then see your IP address. We do not have Data Processing Agreements with these services, and each handles that data under its own privacy policy:

If you connect Wardesk to Linear, or give an AI assistant access through the Wardesk API or our MCP server, we exchange the data that connection needs with that service, on your instruction. You can disconnect at any time, and that service handles the data under its own privacy policy.

International data transfers

Your primary data is stored in the EU via Supabase. When you use Aster's AI features, project data is sent to Google's Gemini API, which may process it on servers outside the European Economic Area. Cloudflare, which hosts this website and the app and runs our visit statistics, operates a global network, so a request may be handled in a data center outside the European Economic Area. Stripe and Resend may process your data in the United States. Sentry keeps our error reports in its EU data region.

These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, and by the EU-US Data Privacy Framework where applicable. We maintain Data Processing Agreements with all sub-processors.

Your rights under GDPR

As an EU-based service, we respect all rights granted by GDPR. You can:

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated. In Estonia, the supervisory authority is the Data Protection Inspectorate (Andmekaitse Inspektsioon).

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

Visit statistics

We count visits to wardesk.co and the Wardesk app with our own cookieless, first-party statistics tool, which runs on Cloudflare. For each page view it records the page address (without any query string; ids and tokens in the address are removed), the referring website, your country and a rough screen size (mobile, tablet or desktop). Your IP address and browser details are processed briefly to tell one day's visitors apart and are never stored. It sets no cookies and stores nothing on your device. We keep only aggregate counts, for up to 25 months. If your browser sends Global Privacy Control or Do Not Track, you are not counted. Legal basis: our legitimate interest in understanding how the website and the app are used (Art. 6(1)(f) GDPR).

During October 2026 we also run Cloudflare Web Analytics, which is also cookieless, to cross-check these counts.

Cookies and local storage

The app keeps your sign-in session, your preferences (like your selected theme) and a cached copy of your data in your browser's local storage, so it stays signed in and loads quickly. These are strictly necessary to provide the service you asked for. We do not use advertising cookies or third-party cookies, and nothing follows you across other websites.

When you follow a link from a Wardesk article or another page to the app, the page path may accompany that link so we can understand which page led to a signup. If the page has campaign tags, those tags may accompany the link too. This information stays in memory only while the page is open. If your browser sends Global Privacy Control or Do Not Track, we do not use or pass campaign attribution. For the page address, we record only its path, without its query string or fragment.

We do not store campaign attribution in cookies, local storage or session storage. It is not needed to use Wardesk, and we do not carry it across visits. If you complete signup after following an article, page or campaign link, its page path and any campaign tags are saved with your account as referral attribution.

Data retention

Your private content stays in your workspace while your account is active. If you choose to delete your account, from Settings or by emailing us, you have 30 days to change your mind. Sign in during that time to keep your account. After those 30 days, we permanently remove your account and private content from the live service.

When you share a trip, an experience or a project with friends, it becomes part of their shared space too. Deleting your account preserves those shared memories for the people you shared them with. This includes trip photos and captions, shared books, films, games and notes, and contributions to shared projects. Account deletion does not make this content public or give anyone new access to it.

Shared trip and Shelf memories keep your display name so friends can recognise who they shared them with, without your profile photo. If you own a shared project, it passes to the friend who joined it first so the group can continue using it.

Backup copies expire within 90 days of creation. Including the 30-day account-deletion grace period, a backup containing your data can remain for up to 120 days after your deletion request.

If your account is inactive for more than 12 months, we may send you a reminder email. We will not delete inactive accounts without notice.

Data breach notification

In the event of a personal data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.

Children

Wardesk is not intended for anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will remove it promptly.

Changes to this policy

If we make meaningful changes to this policy, we will notify you by email or through the app at least 14 days before the changes take effect. Minor clarifications or formatting changes may be made without notice.

Contact

If you have questions about this policy or how your data is handled, reach out to us at [email protected].