Last updated: 25 October 2026
Privacy Policy
This policy explains what personal data Dead Point collects, why, how long we keep it and what rights you have. It covers the website deadpoint.app, the app app.deadpoint.app, the Dead Point mobile apps for iOS and Android, the API api.deadpoint.app and the public estimate pages that users share by link.
1. Who we are
Dead Point is run by the controller named below ("we").
- Controller: Leonid Konchulizov
- Status: Individual Entrepreneur (Georgia)
- Registration number: 324095901
- Registered address: Georgia, Akhaltsikhe District, Abi
- Privacy contact: privacy@deadpoint.app
2. Two roles: controller and processor
- We are the controller for data about our users: your account, how you use the product, the website and our emails to you
- We are a processor for the data you put into estimates about your own clients (for example the client's name and email for approval). You decide what to enter and why. Our processing terms for that data are in section 9 of the Terms of Service. If you are a client who received an estimate link, the studio or freelancer who sent it is responsible for your data; you can still write to us
- We are the controller for approval receipts. When your client approves an estimate, we keep a receipt as proof of the approval for both sides. It stays with us even if the estimate or the account is deleted, see section 7
3. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Email address | You, when you sign in or register | Account, sign-in links, service emails |
| Name (optional), profile picture (optional), interface language | You, in onboarding and account settings | Showing your profile, choosing the email language |
| Password (stored only as a hash), if you set one | You | Password sign-in |
| Sign-in links and session records: device browser string, creation and expiry time | Created when you sign in | Keeping you signed in, letting you see and end sessions |
| Consent record: document versions accepted, time, IP address, marketing opt-in yes or no | Created when you register | Proving consent (Art. 7(1) GDPR) |
| Workspace data: name, country, currency, logo, brand colour, company details you choose to add | You | Running your workspace, showing your branding on shared estimates |
| Projects and estimates: tasks, hours, rates, scenarios, comments, any text you type | You | The product itself |
| Shared links: link settings, optional password (hashed), a snapshot of the shared estimate, view events (time and format, no IP) | Created when you share | Delivering the link, showing you when it was opened |
| Data about your client for approval: name, email, company, job title of the approver; their decision and comment | You and your client | Sending the approval code and recording the decision |
| Security data on public links: keyed hashes of IP address and browser string, failed password attempts, browser string on approval requests | Created automatically | Rate limiting and abuse protection |
| Product usage events: event name, time, page path, a random device ID, a keyed hash of the browser string, app version, language | The app | Understanding which features work, fixing the product |
| Referral and campaign data: referral code, UTM tags, Google click ID, referring page, time of first visit | The link you followed (UTM and click ID are stored only after you accept analytics on the website) | Crediting referrals, measuring campaigns |
| Approval receipt: approver's name, email and company, time and method of confirmation, a frozen copy of the approved estimate (PDF and data) | Created when your client approves an estimate | Proving what was approved, when and by whom |
| Support requests sent from the app: contact email, language, message text, page and app version, workspace name, browser string | You, through the "Report a problem" form | Answering you, improving support quality |
| Emails you send us | You | Answering you |
| Mobile app: device push token, platform (iOS or Android), when the token was registered and last used, link to your sign-in session | The app after you sign in, if you allow notifications | Sending a push when your client approves an estimate |
| Error reports: error message and stack trace, app version and platform, page, browser or device type, user ID | The website, the apps and the server when something breaks | Finding and fixing errors |
We do not collect payment data. The service is free.
The mobile apps contain no Google Analytics and no advertising identifiers. Their product usage events are the same as in the web app and go only to our server.
We do not make decisions about you based solely on automated processing.
4. Legal bases
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Account, sign-in, estimates, sharing, service emails | Contract (b) |
| Security, rate limiting, abuse protection, server logs | Legitimate interest (f): keeping the service safe |
| Consent records | Legitimate interest (f) and our duty to prove consent (Art. 7(1)) |
| Product usage events of signed-in users | Legitimate interest (f): improving the product. You can object, see section 8 |
| Google Analytics cookies on the website, campaign attribution | Consent (a) |
| Marketing emails | Consent (a), given by a separate optional checkbox |
| Referral crediting | Contract (b) |
| Push notifications in the app | Contract (b). You can turn them off in your profile or in the phone settings |
| Error reports | Legitimate interest (f): keeping the service working |
| Answering privacy requests, deletion records | Legal obligation (c) |
| Answering your support request | Contract (b) |
| Measuring and improving support quality (counts, share of replies edited by a person, no message text) | Legitimate interest (f) |
| Approval receipts | Legitimate interest (f): proving an approval and settling disputes between you and your client |
5. Who receives your data
We use these processors. Each acts on our instructions under a data processing agreement.
| Processor | What it does | Location |
|---|---|---|
| netcup GmbH | Servers for the app, API, database, uploaded files and website | Germany (Nuremberg data centre) |
| Resend | Sending our emails (sign-in links, approval codes, notices) | Sending region EU (Ireland); company and parts of processing in the USA |
| Google (Google Analytics 4) | Website statistics, only on deadpoint.app | EU and USA |
| Cloudflare | DNS for deadpoint.app. Your traffic does not pass through Cloudflare | USA |
| Apple (Apple Push Notification service) | Delivering push notifications to iPhone and iPad | USA |
| Google (Firebase Cloud Messaging) | Delivering push notifications to Android | USA |
| OpenRouter, Inc. | Routes a support request to the language model that drafts a reply for our team. Its sub-processor Mistral AI runs the model | USA (OpenRouter), France, EU (Mistral AI) |
| Linear (Linear Orbit, Inc.) | Our task tracker. A feature request from a support request becomes a task: a short summary without names or contact details | USA |
A draft reply to your support request is prepared by an AI model. Before the text is sent to the model we automatically replace email addresses, phone numbers, links with secrets and your known names with placeholders. A member of our team reads and edits every draft before anything is sent to you. No decision about you is made by the model alone. The model provider does not store the request and does not use it for training.
When you share an estimate, its content is visible to anyone who has the link (and the password, if you set one). The approver you name receives an email with a code from us.
We fetch currency exchange rates from public sources (European Central Bank and other central banks). These requests contain no personal data.
Error reports are kept by our own GlitchTip instance on a server in Germany; no third-party service receives them.
We do not sell personal data.
6. Transfers outside the EU
Resend, Google and Apple are based in the USA. All three are certified under the EU-U.S. Data Privacy Framework, and Resend's data processing agreement also includes the EU Standard Contractual Clauses. OpenRouter and Linear are based in the USA; transfers rely on the EU Standard Contractual Clauses in their data processing agreements. The model runs on Mistral AI's servers in the EU. Cloudflare provides DNS only.
7. How long we keep data
| Data | Retention |
|---|---|
| Account | Until you delete it. On deletion we immediately replace your email with a placeholder, clear your name, picture and password and end all sessions. After 30 days the account and your solo workspaces (those with no other members) are erased |
| Deleted workspace | Erased 30 days after deletion |
| Deleted project or estimate | Hidden at once, erased together with its workspace |
| Sign-in link | Valid 15 minutes. Erased at the next daily cleanup once used, or 7 days after it expired |
| Account deletion code | Valid 15 minutes |
| Sign-in session | Access token 15 minutes, refresh token 7 days, never longer than 30 days in total. The session record is kept until the account is deleted |
| Password attempts on public links | 90 days |
| Viewer sessions on password-protected links | 24 hours, record erased 7 days after expiry |
| Snapshot files of a shared estimate | Erased 30 days after the link is revoked or expires |
| Approval code | Valid 10 minutes, 5 attempts |
| Approver data and decision | As long as the shared link exists |
| Approval receipt | 5 years after the approval, then erased. Deleting the estimate or the account does not erase it. The approver can ask us to erase it earlier, see section 8 |
| Support requests, drafts and replies | 12 months after the request, or until the account is erased if that is sooner |
| Feature request task in Linear (a short summary without names or contact details, and a link to the request) | Not erased on a schedule, so it stays in Linear longer than 12 months. The link stops working once the request is erased |
| Product usage events | 365 days |
| Device push token | Until you sign out of the app on that device, delete the account, or the delivery service rejects the token |
| Error reports | 90 days |
| Campaign and referral data | Until the account is deleted |
| Consent records | Kept after account deletion as proof, without the link to your account |
| Deletion records | Kept as proof of deletion, without the link to your account |
| Server logs | Contain no IP address or browser string. Rotated by size |
| Google Analytics cookies | Up to 2 years |
8. Your rights
You have the right to access, correct, delete and export your data, to restrict processing, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting earlier processing.
How to use them:
- Correct your name, picture, email, language and password in account settings
- Delete a workspace in workspace settings
- Delete your account in the app profile or at deadpoint.app/delete-account
- Turn off push notifications in your profile or in the phone settings
- Withdraw website analytics consent by clearing site data and choosing again in the banner
- Unsubscribe from marketing emails with the link in each email
- For anything else (a copy of your data, deleting your account, objecting to usage events) write to privacy@deadpoint.app from your account email. The export includes your support requests and the replies sent to you
- If you approved an estimate and want your approval receipt erased, write to privacy@deadpoint.app from the email you used for the approval. We answer within one month and record the erasure in a deletion log
We answer within one month. We may ask you to confirm the request from your account email.
You can also complain to a data protection authority, in particular in the EU country where you live or work.
9. Security
Data is stored on servers in Germany. Connections use TLS. Passwords and public link passwords are stored as hashes. Sign-in cookies are not readable by scripts. IP addresses on public links are stored only as keyed hashes. Staff access to admin functions is logged. An approval receipt page opens only by its secret link; we store only a hash of that link.
10. Children
Dead Point is a business tool and is not meant for anyone under 16. We do not knowingly collect data from children.
11. Cookies
See the Cookie Policy.
12. Changes
We will post changes on this page and update the date at the top. If a change is significant, we will tell signed-in users by email or in the app before it takes effect.