The desk · privacy
What the desk knows about you.
Filing a claim means handing a stranger your purchase receipt and your payout confirmation. That is a lot to ask, so this page lists every field the desk holds and everyone it reaches — not a description of the kind of thing it might hold.
Last updated 2 September 2026 · Terms of use
01 Who is responsible
PropDesk is operated by an individual, not a registered company. Under India's Digital Personal Data Protection Act, 2023, that individual is the Data Fiduciary for the personal data described here, and you are the Data Principal.
Everything — questions, corrections, erasure requests, complaints — reaches the same desk at report@thepropfirmdesk.com.
02 What the desk collects
Field by field, everything the desk stores:
If you make an account
| What | Why it exists |
|---|---|
| Email address | It is how you sign in and how the desk reaches you about a claim. |
| Name | Asked at signup so the desk can address you, and so a claim can be matched to the name on a receipt. |
| Password | Stored only as a bcrypt hash. The desk cannot read your password and cannot tell it to you. |
| Whether your address is confirmed | An unconfirmed address cannot file a claim or run the desk. |
| When the account was made | Shown to you on your profile, and to the desk when reviewing a claim. |
If you sign in with Google
The desk receives your email address and your Google display name from the token Google issues, and makes an account from those two things. Nothing else is taken, and the desk never sees your Google password. This route is optional — an email and password works the same.
If you file a claim
| What | Why it exists |
|---|---|
| The name you trade under | To match the claim against the name on the receipt. |
| Firm, plan and account size | To check the purchase was of a listed evaluation. |
| Plan fee and discount code | To check code DESK was used, which is what the offer turns on. |
| Payout amount and date | To check the claim is inside the 30-day window. |
| Purchase receipt (PDF) | Uploaded by you. Evidence of the purchase. |
| Payout confirmation (PDF) | Uploaded by you. Evidence of the payout. |
| The decision and any note | So you can be told why, and so the desk can answer for it later. |
Those two PDFs are the most sensitive thing the desk holds. They are never shown publicly, never sent to a firm, and downloading one is recorded in the desk's staff log with the date and who opened it.
If you report a firm
Your email address, which firm it is about, the kind of problem, and what you wrote. No account is needed and none is made.
A report does not store your IP address. The desk deliberately does not keep one, because the person most likely to report a firm is one who is worried about being identified for doing it.
Kept briefly, to stop abuse
The API counts recent requests per address and per source so that signup, password reset and the report form cannot be flooded. These counts are held in memory and are not a browsing history.
The staff log
The desk records what its own staff do: claim decisions, price changes, who was given or refused access, and every time a claim document is opened. This is a record of the desk's conduct, not of yours. Your address appears in it only where an action was about you — a decision on your claim, for instance.
03 What it does not collect
- No cookies. Not one, not even a “necessary” one — which is why there is no cookie banner on this site. Signing in stores a token in your browser's own local storage and sends it in an
Authorizationheader. You can see it, and clearing site data removes it. - No analytics. No Google Analytics, no Plausible, no Segment, nothing counting your visit.
- No advertising or tracking pixels, and no profiling. The desk does not build a picture of you.
- Nothing is sold. Your data is not sold, rented, or handed to a data broker, and it never will be.
- No payment details. You never pay PropDesk — you pay the firm, at the firm's own checkout. The desk never sees a card number.
04 Why, and on what basis
Under the DPDP Act the desk processes your data on the basis of the consent you give when you use each feature, and for the certain legitimate uses the Act allows. In plain terms:
- To run your account and sign you in.
- To decide your claim and pay out the free account, which is the contract in section 06 of the Terms.
- To answer your report and, where it holds up, to correct the board or delist a firm.
- To send transactional email — a confirmation code, a password reset, the decision on your claim. The desk does not send marketing email and has no mailing list.
- To stop abuse of the site, and to keep a record it can be held to.
- To meet a legal obligation, if one ever arises.
Consent given can be withdrawn — see section 08. Withdrawing it for something the desk needs to run your account means closing the account.
05 Who else sees it
Only these, and only for what is listed:
| Who | What reaches them |
|---|---|
| Brevo | Sends the desk's outgoing email. They process your address and the contents of the message — a confirmation code, a reset link, a claim decision. |
| Cloudflare | Routes mail sent to the desk's own address, so a message to report@ reaches a mailbox somebody reads. |
| Only if you use Sign in with Google. Separately, every page loads its fonts from Google, which means Google's servers receive your IP address and browser when the page loads. | |
| jsDelivr | The home page loads its animation libraries from this CDN, which likewise receives your IP address and browser. No other page does. |
| A listed firm | Only on a claim, and only the minimum needed to confirm that code DESK was used for that purchase. Your uploaded documents are never sent. |
Nobody else. No advertisers, no brokers, no “partners”. If the desk is ever compelled to hand something over by law, it will say so here unless it is forbidden from saying so.
06 Where it is processed
The desk runs on hosted infrastructure, and Brevo, Cloudflare and Google operate globally. Your data may therefore be processed outside India. The DPDP Act permits this except to countries the Government has restricted, and the desk does not transfer data to any such country.
07 How long it is kept
| What | How long |
|---|---|
| Your account | For as long as you have one. Ask and it is deleted — see section 08. |
| Claim documents | Held while the claim exists. If a claim is removed, its uploaded PDFs are deleted automatically by a job that runs for that purpose. |
| Claims themselves | Kept as the record of a decision the desk made and paid out on. There is no automatic expiry today; the desk will not pretend to a retention period it has not built. |
| Reports | Kept as the desk's record of what was said about a firm, including after that firm is delisted — deleting them when a firm leaves the board would erase the reason it left. |
| The staff log | Kept, and deliberately outlives the staff account it describes. It exists so the desk can answer for its decisions later. |
08 Your rights, and how to use them
Under the DPDP Act you have the right to access a summary of the data the desk holds about you and who it has been shared with; to have it corrected, completed or updated; to have it erased; to nominate somebody to exercise these rights if you die or become incapable; and to have a grievance heard.
Name and email you can change yourself, on your profile page. For everything else, write to report@thepropfirmdesk.com from the address on the account.
Being straight about this: there is no delete-my-account button yet. Erasure is done by hand when you ask, within 30 days, and you get an email confirming it. Building it into the profile page is on the list; until it is there, the email route is the real one and it works.
Two things survive an erasure, and you should know before you ask. A claim the desk decided and funded is kept as the record of that decision — the documents behind it are deleted, the decision is not. And an entry in the staff log stays, because a record the desk can delete on request is not a record. Both are limited to what the desk needs to answer for its own conduct.
09 How it is protected
- Passwords are stored as bcrypt hashes. Nobody at the desk can read yours.
- Changing your password ends every session that already exists — including one somebody else is holding.
- Uploaded PDFs are reachable only by the desk, are served as downloads rather than rendered in the browser, and every download is logged with who opened it and when.
- Uploads are checked by their actual contents, not by what the file is called.
- The desk's own staff accounts carry only the access they need, and everything they do is recorded.
What the desk will not claim: that any of this is unbreakable. It is one person's site. If there is ever a breach that puts your data at risk, you will be told and so will the Data Protection Board, as the Act requires.
10 Children
PropDesk is for adults. It is not directed at anyone under 18, and the desk does not knowingly hold data about a child. If you believe a child has made an account, write to the desk and it will be removed.
11 Changes to this page
The date at the top says when this page last changed. If the desk ever starts collecting something new, this page changes before that happens, not after — and members are told by email if the change is material.
12 Complaints
Write to report@thepropfirmdesk.com. The desk answers grievances within 30 days.
If the answer does not satisfy you, the DPDP Act gives you the right to complain to the Data Protection Board of India.