Privacy policy

Last updated 19 September 2026.

DeskVane is operated by Gumtree Hill Solutions Pty Ltd in Queensland, Australia. We store account email, workspace membership, and encrypted vault/clipboard ciphertext on our servers in AWS Sydney. We cannot decrypt vault items, private clipboard entries, private secret shares, or scratch-pad note bodies.

Some features store information we can read, because that is how they work: tab session titles and URLs; public and unlisted secret-share bodies; HTTP request history if you use that tool; scratch-pad titles; and sign-in telemetry (device identifier, user agent, and IP) for new-device checks and when someone opens a secret share.

Optional voice capture sends the recording to AWS Transcribe so we can return a transcript. That step is not zero-knowledge: AWS hears the audio and sees the text. We delete the audio and job output after transcription. You then encrypt the transcript on this device onto the private clipboard. Voice notes are off unless you use them.

The DeskVane Chrome extension and the iOS / Android apps talk to the same API. They keep a sign-in token on this device and never send vault passwords or decrypted secrets to us. On a phone, Face ID or the device fingerprint can unlock that local session; biometric data stays on the device. Optional passkey vault unlock stores only a ciphertext wrap of the vault key, sealed with a secret the passkey derives on this device.

You can revoke trusted devices and delete your account in Settings. Deletion removes workspace ciphertext and related rows we hold. Stripe keeps billing records they need for their own legal obligations.

We use email (Postmark) for device confirmation, MFA, invites, and password reset. Billing is processed by Stripe when you subscribe. We do not sell personal data.

Eligible data breaches are assessed under the Australian Privacy Act / Notifiable Data Breaches scheme. Contact: privacy@gumtreehill.com