Privacy Policy

1. Controller

Desloper. Privacy questions and data-rights requests: privacy@desloper.xyz.

2. Data used to provide an edit

We send the text and optional voice/style instruction you submit to Fireworks AI so its AI inference service can review and revise it. We return the visible review, score, and revision to your browser. Private inference reasoning is discarded.

The legal basis is performance of the service you request (GDPR Article 6(1)(b)). Do not submit secrets, special-category personal data, or material you are not entitled to process.

3. Security and usage limits

We temporarily use a one-way HMAC of the router-reported IP address, request identifiers, timestamps, sizes, status, service usage, and error codes to enforce limits and secure the service. We do not place raw drafts, outputs, or raw IP addresses in application logs.

The legal basis is our legitimate interest in preventing abuse and maintaining a reliable service (Article 6(1)(f)). Heroku necessarily receives the network address and its router/platform logs may retain raw connection metadata under the platform's operational retention; Desloper disables its duplicate application access log.

4. Optional research contribution

Research contribution is off by default. If you actively enable it for a run, we store the input, optional voice/style, complete visible AI output, parsed review and score, revision, technical generation metadata, and limited token counts. We do not store private inference reasoning, raw IP addresses, or API keys with the example.

The legal basis is your consent (Article 6(1)(a)). Each example expires after 90 days and may disappear sooner due to capacity limits. We return an anonymous receipt that lets you retrieve or delete it. Withdrawing consent does not affect processing already performed before withdrawal.

5. Recipients, locations, and transfers

The web application is currently configured in Heroku's EU region, but Desloper does not promise EU-only data residency. Redis Cloud may process quota and contributed-example data in its configured infrastructure, and Fireworks AI provides global serverless inference through a US-based provider. Processing may therefore occur in the United States or other countries outside the EEA.

Where data leaves the EEA, the controller documents the destination, recipients, and subprocessors and uses the applicable transfer mechanism and vendor terms, ordinarily Standard Contractual Clauses plus a transfer assessment. Global processing is an accepted product choice; accurate disclosure and lawful transfer safeguards remain required.

6. Retention

• Submitted text and output: streamed for the requested edit; not retained by Desloper unless you opt into research or browser history.
• Research examples: no more than 90 days, with earlier capacity pruning possible.
• Quota keys and active locks: up to the configured rolling window or lock timeout.
• Application metadata logs: the platform's operational log window, currently documented by Heroku as a limited recent buffer.
• Legal acceptance token: held in your browser until expiry, policy change, or deletion.

7. Your rights

Depending on the GDPR, you may request access, correction, deletion, restriction, portability, or object to processing, and may complain to your supervisory authority. Contact privacy@desloper.xyz. Research receipts support immediate self-service access and deletion without an account.

Because we deliberately do not identify research examples by name or email, we may need the anonymous receipt to locate a specific contribution.

8. Automated decisions and children

Desloper does not make legal or similarly significant decisions about you. It creates editorial suggestions which you must review. The service is for people aged 16 or older.

9. Changes

Policy version: 2026-08-26.1. A material change invalidates the stored acceptance and requires a new acknowledgement.