Privacy information

Updated October 23, 2026 (draft for the next app update; not yet published). Dealdesk is a workspace for vehicle brokers. This describes the Dealdesk website and the Dealdesk iPhone app.

Records on your device

Customers, contact details, requested cars, offers, notes, follow-ups, fees, dealers and programs are stored on your device. Without signing in, these workspace records are not uploaded. The web version uses browser storage. Native packages use an app-private file for records and Keychain (iOS) or Keystore-backed encrypted storage (Android) for sign-in credentials. Native credentials do not use iCloud Keychain sync. The prepared iOS app requires a personal app code or optional OS biometric verification on opening and returning. A salted code verifier stays in device-only Keychain; the code is not sent to the web view or cloud. This access lock does not encrypt existing records with the app code, and there is no end-to-end encrypted workspace backup. Android and web do not have this app lock. There is no forgotten-code bypass or automatic data wipe. Never enter Social Security numbers, credit reports or bank credentials.

With an account

Your email and password go to Supabase Auth to create or verify your account. If you provide your name during signup, it is stored in your account profile; it is never used to grant access or ownership. Account deletion also sends your password over HTTPS to the Dealdesk deletion function for a fresh Auth verification; it is not saved in your workspace or logged by that function. My workspace syncs with the dedicated Dealdesk Supabase project. Demo records do not sync. Server rules limit each account to its own workspace. Account switching keeps local copies separate. Signing out immediately hides that account’s records on the device and revokes the device session. Edits made offline before signing out stay stored on the device locked to that account; they are shown and synced only after you sign back into the same account and are never moved to another account. Signing out does not delete cloud records. Deleting an account removes its local copy after confirmed deletion.

Cloud records are not end-to-end encrypted. Authorized project administrators and service providers can technically access them for service operation and support. Supabase and the authentication email provider, Brevo, receive the email and request metadata needed to deliver account confirmation and password recovery messages. Do not put customer records in support emails.

You can also sign in with Apple or Google. Apple or Google confirms who you are and tells Dealdesk your account email (with Sign in with Apple this can be a private relay address) and, the first time, your first name if you share it. Dealdesk never receives your Apple or Google password. To delete an account made this way, you confirm by signing in with that provider again; for Sign in with Apple, Dealdesk also asks Apple to revoke the app’s access to your Apple ID.

Membership and payments

The iOS app offers an optional auto-renewing membership (monthly or annual, with an introductory free trial for eligible Apple IDs) sold through Apple’s in-app purchase system. Apple processes the payment; Dealdesk never sees your card details. To confirm that a membership belongs to your account, the app sends Apple’s signed purchase record (product, dates, an Apple transaction identifier and the account identifier attached at purchase) to the Dealdesk service, which verifies Apple’s signature and stores that status. Apple also sends the Dealdesk service signed renewal, expiration, refund and revocation notices for those transactions. This information is used only to decide membership access and for support; it is linked to your account and is deleted with it. Manage or cancel a membership in Settings › Apple ID › Subscriptions on your device. When a membership ends, your records stay readable and exportable on the device and in your account; nothing is deleted. Dealdesk may also grant complimentary access to selected accounts at its discretion; such grants are recorded with the granting administrator and dates, do not involve Apple billing, and do not cancel an existing Apple subscription.

Customer links

A link you create reveals the customer’s name, requested car, deal stage, handoff progress and saved offer terms to anyone holding it. Dealer names are hidden unless you choose to show them. Notes, phone and email addresses, targets, dealer contacts, stock numbers, broker fees, programs and internal quote requests are excluded. Links expire and can be revoked. The service records an aggregate view count and last-opened time. Account deletion removes these links.

Request links and broker pages

A broker can turn on a request link that opens their public broker page. The page shows only what the broker chose to publish: their name, and optionally a photo, brokerage, short bio, public phone, website and short updates. A broker photo is re-drawn on the iPhone before upload so camera and location details are removed, and it is stored in a public folder for that page. If you send a request through that page, the broker receives your first and last name, phone number, optional email, preferred contact method, the car you describe and your preferences, whether you want to lease, finance or buy, the budget and down payment you enter (your own goals, not a credit decision), your ZIP code, your timing, and the time you agreed to be contacted. The page does not ask for a Social Security number, date of birth, street address, card, bank or credit information, or documents, and it refuses text that looks like those numbers. Your request goes only to that broker; Dealdesk does not contact you, sell it or use it for advertising. To limit abuse, the service keeps a salted one-way fingerprint of the sending network address and counts requests over short periods; the address itself is not stored with your request. When the broker adds you as a customer, your details move into that broker’s workspace (see above) and the request keeps no personal details; when the broker dismisses it, its personal details are deleted. Requests nobody acts on are deleted after 90 days. To have a request removed, contact the broker or dealdesk7@gmail.com. Brokers can turn their page off at any time, and Dealdesk can switch off a page after a report.

Customer reviews and private feedback

Public reviews are not switched on. A broker can instead send a customer a one-time invite link for private feedback. The invite stores only a one-way fingerprint of the link and the broker’s private reference to that customer. Private feedback — the star rating, text, the name you sign with and, if you add it, the car — is not shown on the broker’s page, in any count or average, on a customer share page or anywhere public, and it is never published later unless you are asked again and agree. The broker can read it only if you tick “let my broker read it”, and you can turn that off again. Nobody but you can change it. You can edit it for 30 days and delete it at any time with your private link. Dealdesk deletes it automatically 90 days after you write it. You confirm it is your own experience and that you were not paid or offered anything for it. Dealdesk does not verify purchases. Filters refuse contact details, ID numbers, slurs and threats in the text. To limit abuse, the service keeps a salted one-way fingerprint of the sending network address for rate limits; it is removed with the feedback. A record of what happened (for example “sent”, “deleted”, a refusal reason code and the star rating, never the text) is kept for 90 days. Used, cancelled and expired invites are deleted 90 days after they were created. Deleting a broker account deletes its feedback, invites and records.

Quote PDFs

A broker can make a PDF of one saved offer on their iPhone. It is created on the device and is not uploaded by Dealdesk. It contains the dealer’s figures and terms as saved, the customer’s name, the broker’s own page details if set up, and the dealer’s name only if the broker turns it on. It never contains notes, broker fees, dealer contacts, stock numbers or quote requests. The temporary file is removed when the preview closes or the app locks; copies the broker shares are then outside Dealdesk.

Screenshot reading and device features

OCR runs on the device. Original images are neither uploaded nor kept in workspace records. Suggested values are saved only after your review. The web version downloads reader software and language data from this website when needed; native packages bundle them. File selection grants access only to the image you choose. Call, text, email and website links open the relevant app or browser; you choose whether to call or send the composed message. Dealdesk does not automatically contact customers or dealers, read your contacts, or track location.

Widgets

The iPhone widgets (Follow-ups, Fees owed) read a small summary the app keeps on your iPhone: how many follow-ups are due on which days, fee totals, the number of unpaid deals and the app language. It contains no customer names, cars, notes, phone numbers or other record content, is never uploaded, and fee amounts are hidden unless you turn them on in the widget.

Hosting and usage data

Vercel serves the website and public customer pages; Supabase serves account, sync, deletion and sharing requests. These providers receive ordinary request information such as IP address and technical logs. Dealdesk has no advertising SDK, behavioral analytics SDK or cross-app tracking. Native apps include Capacitor, its app/link/keyboard/clipboard helpers, a credential-storage plugin and the local OCR engine; these do not add an analytics service.

Retention and deletion

Records remain until you remove them or delete your account. Use Delete your account for authenticated deletion or an ownership-verified email request. Confirmed deletion removes the active Auth user, sessions/refresh credentials, workspace and share links. Old signed tokens cannot recreate the deleted account’s records. Other devices clear account copies when they reconnect with credentials that can verify deletion. Offline or expired-session devices may keep local copies; clear site data or remove the app to erase those. Independently copied customer pages, screenshots or recipient messages cannot be recalled.

Provider operational logs and backup copies may outlast active-record deletion under their configured retention schedules. The operator must verify that restoration procedures do not reactivate deleted accounts. Exact provider retention and backup settings must be confirmed by the operator before general native release. Native app backups are disabled/excluded by the prepared configuration; OS/device behavior still needs device verification.

Contact

For privacy, access, corrections, support or deletion requests: dealdesk7@gmail.com. Support information. Please do not email private customer details.