Privacy policy
Version 1.0, effective October 1, 2026
This policy explains what personal data Desidera collects, why, on what legal basis, who helps us process it, how long we keep it and what your rights are. It follows the EU General Data Protection Regulation (GDPR).
Right now Desidera offers a free daily card and a waitlist. Accounts, the journal and readings with Vesper aren't open yet. Before they open, we'll update this policy and let everyone on the waitlist know.
The short version
- The daily card works without an account, and we store nothing about you on our servers when you use it.
- For the waitlist, we keep your email address and a few details about your signup, in the EU.
- Analytics only run if you accept them.
- We never sell your data and show no ads.
- You can remove yourself from the waitlist at any time with the link in any of our emails.
What we collect and why
Daily card
When you draw a daily card, the card and the date are kept in a cookie in your browser, so you get one card per day. We don't store them on our servers. If you download or share the card's image, it's made on the spot and not saved.
Waitlist
If you join the waitlist, we store your email address, your language, where you signed up (the home page or the daily card), whether you agreed to news and offers (and when), the campaign tag of the link you came from, if any, when you confirmed your email, and a salted hash of your IP address that helps us stop abuse. We don't store your IP address itself.
We use this to confirm your signup and to tell you when Desidera launches, including about the founding-member offer, and, if you ticked the box, to send occasional news and offers.
Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time by deleting your signup. The IP hash is used for our legitimate interest in preventing abuse (art. 6(1)(f)). Giving your email address is voluntary, but we can't add you to the waitlist without it.
Emails
We send a confirmation email when you join the waitlist, and the launch announcement. If you opted in, we also send occasional news and offers. Every email has a link that deletes your signup.
When you write to us, we use your message and email address to answer you, based on our legitimate interest in handling your request (art. 6(1)(f)).
Analytics
If you accept analytics cookies, we use PostHog to record which pages you visit and a few actions, such as drawing a card, joining the waitlist or switching language, together with your language, the campaign tag of the link you came from and technical data such as browser and device type. We don't send your email address, IP address or anything you type to analytics, and PostHog is set to discard IP addresses.
Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time in the cookie settings.
Security and error tracking
To keep Desidera working and safe, we and our hosting provider process technical data such as your IP address, browser and the time of a request, and we use Cloudflare Turnstile to block bots on our forms. When something breaks, we record the technical error, such as the page and the browser, with personal data such as email and IP addresses removed before the report is stored.
Legal basis: our legitimate interest in running a secure, working service, preventing abuse and fixing errors (art. 6(1)(f)). We've weighed this against your rights: we use only what's needed, store only a hash of your IP address, strip personal data from error reports and keep logs briefly. You can object at any time (see "Your rights").
Who helps us
Your data is stored in the EU (Frankfurt, Germany). We use service providers who process data only on our behalf and under a data processing agreement:
| Provider | What for | Where the data is |
|---|---|---|
| Supabase, Inc. | Database | EU (Frankfurt) |
| Vercel Inc. | Hosting | EU (Frankfurt); pages are delivered from worldwide |
| Plus Five Five, Inc. (Resend) | Sending and receiving emails | USA (emails are sent from Ireland) |
| Cloudflare, Inc. | Blocking bots on forms (Turnstile) | Worldwide |
| PostHog, Inc. | Analytics, only with your consent | EU (Frankfurt) |
| Functional Software, Inc. (Sentry) | Error tracking, with personal data removed | EU (Frankfurt) |
Where a provider processes data outside the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework if the provider is certified under it, or otherwise by the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.
We may also disclose data to public authorities when the law requires us to.
Cloudflare also uses the technical signals Turnstile collects to improve its bot detection, as an independent controller under its own Turnstile privacy addendum.
How long we keep it
| Data | How long |
|---|---|
| Waitlist signups you never confirmed | 30 days after the last confirmation email |
| Confirmed waitlist entries | Until you remove them, or 12 months after launch if you haven't created an account |
| Analytics events | Up to 12 months |
| Error reports | Up to 90 days |
| Server and security logs | Up to 30 days |
| Emails to and from us about your requests | Up to 3 years after the matter is closed |
When you delete your signup, we delete it right away. Copies in our backups are overwritten within 30 days.
Your rights
You have the right to:
- get a copy of your data
- correct your data
- delete your data: use the link in any of our emails, or write to us
- restrict processing, or receive your data in a portable format
- object to processing based on legitimate interest, and to direct marketing at any time
- withdraw your consent at any time, without affecting what happened before
Write to hello@desidera.app from the email address you signed up with, so we can check that the request is yours. We answer within one month.
You also have the right to complain to a data protection authority, in particular in the EU country where you live, where you work or where you believe your rights were infringed. We'd be glad if you came to us first.
Age
Desidera is only for people aged 18 or over. We don't knowingly collect data from anyone younger. If you believe a child has given us data, write to us and we'll delete it.
Cookies
We only use analytics cookies if you accept them. Details are in our cookie policy.
Changes to this policy
When we change this policy, we update the version and date at the top. If a change matters for how we use your data, such as when accounts open, we tell you by email before it takes effect, and ask for your consent again where the law requires it.