Your Privacy Rights

Overview

PrivyDeck respects privacy rights worldwide. Depending on where you live, you may have the rights below. Most requests can be completed instantly in Settings; email us for anything else.

Right to access (know what we have)

You may request a copy of the personal information we hold about you. Signed-in users can download a complete portable export at any time:

• Settings → Privacy data export — JSON bundle with account data, devices, alerts, score history, DSAR letters, vault metadata, and encrypted vault files
• Or email privacy@privydeck.com with subject “Access request” — we respond within 30–45 days

Open Settings

Right to delete

You may request deletion of your account and associated personal information:

• Settings → Delete account — type DELETE to confirm permanent erasure
• Or email privacy@privydeck.com with subject “Deletion request”

Deletion removes score history, devices, alerts, vault files on our servers, DSAR requests, and cancels active subscriptions. This cannot be undone.

Right to correct (rectification)

Update your name and profile image through your sign-in provider (Google, GitHub, Apple, or email). For other corrections, contact privacy@privydeck.com.

Right to portability

Export your data in a structured, machine-readable JSON format via Settings → Privacy data export. Vault ciphertext is included so you can decrypt files locally with your passphrase.

Right to opt out of sale or sharing

We do not sell personal information and do not share it for cross-context behavioral advertising. See our Do Not Sell or Share page. We honor Global Privacy Control (GPC) browser signals.

Right to limit use of sensitive personal information (CPRA)

Vault categories may include identity, financial, medical, or legal documents you choose to store. We use this data only to provide encrypted storage — not for advertising or profiling. To limit processing: do not upload sensitive categories, disable AI coaching in Settings → Privacy preferences, or delete your account.

Non-discrimination notice

We will not discriminate against you for exercising your privacy rights. We will not deny service, charge different prices, provide a different quality of service, or suggest that you will receive different treatment because you exercised rights under CCPA, CPRA, VCDPA, CPA, CTDPA, or other applicable privacy laws.

United States state privacy rights

Residents of the following states have additional rights under local law:

• California (CCPA / CPRA): access, delete, correct, opt out of sale/sharing, limit sensitive PI — see Do Not Sell page
• Virginia (VCDPA): access, delete, correct, opt out of targeted advertising and sale — we do not sell or use data for targeted advertising
• Colorado (CPA): access, delete, correct, opt out of sale and targeted advertising
• Connecticut (CTDPA): access, delete, correct, opt out of sale, targeted advertising, and profiling

Submit requests via Settings or privacy@privydeck.com. Opt-out page: Do Not Sell or Share My Personal Information.

Canada (PIPEDA)

Canadian residents may access personal information we hold, challenge its accuracy, and withdraw consent where processing is consent-based. Our privacy contact acts as privacy officer. Lodge complaints with us first at privacy@privydeck.com, then with the Office of the Privacy Commissioner of Canada if unresolved.

Japan (APPI)

We specify purposes of use in our Privacy Policy. You may request disclosure, correction, suspension of use, or deletion. Cross-border transfers use appropriate safeguards with subprocessors.

South Korea (PIPA)

You may access, correct, delete, or suspend processing of personal information. Contact privacy@privydeck.com to exercise rights or withdraw consent for optional features such as AI coaching.

Australia (Privacy Act)

We collect personal information only for stated purposes (see Privacy Policy). You may request access and correction. Complaints: contact us first; you may also contact the Office of the Australian Information Commissioner (OAIC).

European Union / UK / Switzerland (GDPR, ePrivacy, FADP)

See our Privacy Policy for legal bases, retention, and subprocessors. Cookie details: Cookie Policy. Swiss residents have equivalent rights under the FADP.

Authorized agents

You may designate an authorized agent to submit requests on your behalf where your local law allows. We may require written proof of authorization and verify your identity directly.

Response times

• Self-service (export, delete, AI opt-out): immediate in Settings
• Email requests: within 30 days (GDPR / most laws) or 45 days (CCPA/CPRA, extendable once)
• We may verify identity before fulfilling sensitive requests

Contact

Privacy requests: privacy@privydeck.com
Full policy: Privacy Policy