Privacy

Privacy notice

Version 2 · last updated 29 October 2026

1. Who we are

DeskDot and idotmatrix.com are run by Shiv Patel, India (“we”). We decide how the data described here is processed (in Indian law, the data fiduciary; in EU/UK law, the controller). Contact: shiv.patel1.3.2003@gmail.com.

DeskDot is unofficial: it is not made, endorsed or supported by Shenzhen Heaton Technology or the iDotMatrix brand, and it sends nothing to the panel's manufacturer.

2. What we process and why

(a) Website hosting

The site and the browser app are hosted by Netlify. Like any web host, Netlify receives your IP address, user agent and the URL you request, and keeps logs for security and operations under its own retention. We don't add analytics or tracking cookies.

(b) Multiplayer signalling

When phones join a game running in a browser tab, the two devices exchange a WebRTC offer and answer through our signalling function. These messages contain your devices' IP addresses (network candidates). They are stored for at most 60 seconds; a room's record is deleted at most 10 minutes after the host stops polling. They are used only to connect phones to the host.

(c) Relay

When a direct link fails, the encrypted game traffic between phones and the host passes through a TURN relay (Cloudflare's TURN service). The traffic is encrypted end to end (DTLS); the relay can't read it.

(d) STUN

To find the best direct route, your browser asks STUN servers run by Google (stun.l.google.com) and Cloudflare (stun.cloudflare.com) for your public IP address.

(e) The data proxy

Some data providers can't be called directly from a browser. For those, the browser app sends the request to our proxy function, which fetches it from an allow-listed provider and passes the answer back. The request URL may include what you entered for that app, such as a city or, for the calendar app, your calendar link. We don't store these requests; Netlify may log function requests as part of normal hosting (see (a)).

(f) Direct requests to data providers

Most live-data apps (weather, flights, earthquakes, markets and others) call their provider directly from your browser. Those providers receive your IP address and, if you set them, your city or coordinates, under their own terms and privacy policies.

(g) Pyodide from jsDelivr

The browser app's engine runs on Pyodide, which your browser downloads from the jsDelivr CDN (cdn.jsdelivr.net). jsDelivr receives your IP address and user agent like any CDN.

(h) Update checks in the installed app

The installed DeskDot app (Windows, Mac, Android) asks GitHub about every 6 hours whether a new version is out, and downloads it from GitHub when you choose to update. GitHub receives your IP address and user agent like any website; nothing else about you is sent. You can turn the check off in Settings → Device → Updates. The browser app doesn't do this: it updates when you reload the page.

(i) AI Creator (optional)

If you use the AI Creator, your prompt and your own Google Gemini API key go straight from your browser to Google's Gemini API, under Google's terms. We never receive your key or prompts.

3. Legal basis

We process this data because you use the site or app for a specific purpose and provide it voluntarily for that purpose (India's Digital Personal Data Protection Act 2023, s.7(a)), and, where EU/UK law applies, to provide the service you asked for and for our legitimate interest in running it securely (GDPR Art. 6(1)(b) and (f)).

4. Camera, microphone, screen and location

Some apps can use your camera, microphone, screen or location, only after you allow it in your browser. This is processed only in your browser for the app you start; frames go to your panel, never to us. Location is used only to fetch local data (such as the weather) from the provider and is not stored by us.

5. Storage in your browser

The browser app keeps your settings, layout, uploads, tokens you enter and its engine cache in this browser (localStorage, IndexedDB and a service-worker cache). The website remembers small preferences, such as a dismissed notice and your light / dark and page theme choice (which the browser app shares). None of this is sent to us or used for tracking. You can delete it any time by clearing this site's data in your browser.

6. Retention

7. Service providers and international transfers

We use: Netlify (hosting, functions and short-lived storage; USA), Cloudflare (TURN relay and STUN), Google (STUN; and the Gemini API if you use it), GitHub (update checks and downloads for the installed app), and jsDelivr (CDN, served through providers such as Fastly and Cloudflare). They may process data outside India, including in the USA. Where EU/UK law applies, transfers rely on the providers' standard contractual clauses or adequacy decisions.

8. Children

The site isn't directed at children. DeskDot is intended for users aged 13+; under-18s need a parent's or guardian's permission. The casino is 18+ only. Please don't use names that identify a child (for example as a player name). We don't knowingly collect personal data from children.

9. Your rights

You can ask us for access to, correction of or erasure of personal data about you, nominate someone to exercise your rights, and raise a grievance (DPDP Act ss.11–14). Where the GDPR applies you also have the rights to restriction, portability and objection. Write to shiv.patel1.3.2003@gmail.com. You can also complain to the Data Protection Board of India or, in the EU/UK, to your data protection authority. Since we don't keep accounts or analytics, most requests can be met by clearing your browser's data for this site.

10. Security

The site is served over HTTPS with a Content-Security-Policy; signalling accepts only connection messages, and the proxy only allow-listed providers. If a breach affects your personal data, we will notify you and the authorities as the law requires.

11. Changes

We'll update this notice when what we process changes, and change the date and version above.