Legal
Privacy policy
DeepWork is a timer, a task list and a habit tracker that keeps its data on your own machine. This policy describes the little that happens outside it.
Nothing about you is collected. No account, no profile, no identifier, no cookie, no advertising and nothing sold. Whatever you write in DeepWork is yours, and it stays on your own machine. Nothing is charged, and nothing is taken from you.
Two things exist outside it, and neither says who you are: an anonymous count of visits to the front page and the web app, and a message you deliberately send me. Both are described below.
Who is responsible
DeepWork is a personal open-source project, not a company. I am Rajat Malik, based in Gurgaon, India, and I am the person responsible for the processing described on this page. There is no data protection officer, no registered company and no business partner with access to anything described here.
Write to contact@rajatmalik.dev about this policy, or about anything that concerns your data.
This website
The site at deepwork.rajatmalik.dev is a set of static files. It has no
server of its own, no database, no login and no comment form.
Hosting
The files are published through GitHub Pages, so GitHub processes the request the way any web host does: your IP address, the time, the file you asked for and your browser's description appear in its server logs. I do not receive those logs and cannot read them. GitHub's handling is described in GitHub's privacy statement.
The visit count
The front page and the web app each send one pageview to
GoatCounter (deepwork.goatcounter.com), so that "is
anybody using this?" has an answer without DeepWork running a backend. The page sends
the request itself — no third-party script is loaded to make it — and it contains:
- the address of the page and its title;
- the referring page, if your browser sends one, and any query string;
- the width of your screen;
- a flag saying whether the browser is automated, and a random value that stops the request being cached.
It writes no cookie, reads no identifier, and GoatCounter stores no IP address for it. What I can see is totals and grouped counts — pages, referrers, locations, browsers — never an individual visitor. A browser sending Do Not Track or Global Privacy Control is not counted, and neither is a local build, a preview deployment or the automated audit.
These three documents are not counted. The privacy policy, the terms and this contact page send no pageview at all.
The Site stats panel
The footer of the front page has a Site stats button. It reads the totals and the month's breakdowns back through GoatCounter's read-only API, with a token that can only read. Nothing is fetched until the panel is opened, and opening it reports nothing about your visit.
No cookies, no third-party scripts
This site sets no cookie, so there is nothing to consent to and no banner. The typefaces and screenshots are shipped with the site rather than fetched from a font service or an image host. There is no advertising script, no social widget, no session recorder and no fingerprinting.
What is stored on your device
One preference is stored on this site. It lives in localStorage, which is
not a cookie: it is a file in your browser's own storage, it is never sent with a
request, and clearing site data removes it.
| Name | What it holds | Why |
|---|---|---|
deepwork-site-theme |
dark or light |
So the theme you chose is the theme you get on the next page, without a flash of the other one. It is read on this site only and never transmitted. |
| Your DeepWork data | Tasks, sessions, habits, journal entries and settings — only in the web app | The app works. It is written by the app into your browser's storage or into a local database, and it never leaves the device. See below. |
Nothing else is stored: no analytics identifier, no fingerprint and no preference beyond the theme you chose.
The web app
The browser build at app.deepwork.rajatmalik.dev has no account and no
sign-in. Everything you enter is kept in your own browser storage, on your own device,
and is not sent anywhere. The web app can also be installed, and then it keeps working
offline.
It counts visits with the same counter and the same promises — one pageview per load, no cookie, no stored IP address, and the page never sending a task or a journal entry. Settings → Count my visits turns that off; with the switch off, the counter is never loaded. The desktop build is never counted, and there is no collection of your tasks, your journal or anything else you write — not in aggregate, not anonymously, not at all.
Clearing your browser's site data deletes that data as well. To move it or to keep it, use the app's own JSON backup.
The desktop app
The Windows, macOS and Linux builds keep everything in a local SQLite database on your computer. There is no DeepWork server, no account and no sync: nothing you record is uploaded, and there is no telemetry about your work.
The desktop app makes three kinds of network request, and no others:
- a release check — it asks the public GitHub API whether a newer version exists. GitHub sees the request and your IP address; the app sends no identifier of its own;
- a download you press — an installer or update comes from GitHub's release page;
- a link you open — the app opens it in your browser, where the destination's own policy applies.
The app's logs are local files on your machine, written so that a fault can be understood without anyone connecting to your computer.
Messages you send
You can write to contact@rajatmalik.dev for anything, or to support@rajatmalik.dev for help installing or using the app. A message sent by email passes through your mail provider and mine, and arrives in my mailbox.
I keep it for as long as it takes to answer, and afterwards for as long as ordinary correspondence is kept. It is not added to a mailing list, not sold, not shared, not used for advertising, and not used to train a model. Ask me to delete a thread and I will delete it.
The contact page has a form. At the time of writing it has no form-handling service behind it: pressing Send composes the message in your own email app, so it travels through your own provider and nothing is submitted to this site or to anyone else. If a form service is added later, the form will name it and this section will be updated to name it too, before it is used.
There is no phone number for DeepWork and none is requested. Nothing on this site asks for a date of birth, an address, a payment detail or an identity document.
Who else is involved
These are the only third parties in the picture. Each one handles its own part under its own policy; none of them receives your DeepWork data.
| Who | What they do | What they see |
|---|---|---|
| GitHub | Hosts this site, the downloads and the issue tracker | Ordinary web-server request logs, under its own policy |
| GoatCounter | Counts visits to the front page and the web app | The page and the fields listed above — no cookie, no stored IP address |
| Mail providers | Carry an email you choose to send | The message, as any mail provider does |
There is no analytics account beyond that counter, no advertising network, no data broker and no processor with a commercial interest in your data. Nothing is sold.
Your rights
Because there is no account and no profile, there is very little to hold: the only personal data I have is what you choose to send me. Where laws such as the GDPR or India's Digital Personal Data Protection Act, 2023 apply, you may ask to:
- be told what is held about you, and receive a copy;
- have it corrected or erased;
- object to being contacted, or withdraw a consent you gave;
- complain to your local data protection authority.
Write to contact@rajatmalik.dev and I will act on the request. There is no automated decision-making and no profiling anywhere in this project.
Children
This site and the app are not directed at children. There is no account, no profile and no advertising, so there is nothing to collect. If a child writes to me, the message is treated like any other correspondence and deleted on request.
Changes to this policy
When this policy changes, the date at the top changes with it, and the change is described here. There is no mailing list to notify, so the date is the notice.
- 28 October 2026 — first published, with the privacy, terms and contact pages.
Questions
If something here is unclear, or you think it does not match what the site actually does, tell me. That is a bug in this document, and I would rather fix it than have it stand: contact@rajatmalik.dev.