Privacy policy
Workspaces at workspaces.rocek.dev · updated 2 November 2026
Workspaces is a private place where teams share files and talk about them. You can only get in if an administrator made an account for you. This page says what the app keeps about you, what it does with it, and what you can ask for.
What we keep
- Your account: your name, username, email address, role, and a hash of your password (never the password itself). If you turn on two-step verification or passkeys, the data needed for them.
- What you add: the files you upload and their earlier versions, the comments you write, the tasks and mentions in your documents, and the settings of your projects.
- Notifications: what happened in your projects that concerns you, and your choices about them. If you turn on browser notifications, the address your browser gives us to send them.
- Activity: a log of who did what in a project (uploads, deletions, changes of settings), which the people who run the project can read.
- Technical data: your sign-in session, and the address you connect from, which is kept for a short time to limit repeated attempts to guess a password.
We do not use advertising or analytics services, and we do not sell or share your data.
What we do with it
- We show it to the people it is meant for: your files and comments to the members of the project, your account details to the administrators.
- We send you email when you ask for it (a sign-in link) and, unless you turn it off, a daily summary of what you have not read.
- Uploaded files are checked for viruses before they are stored.
- Your picture is your own upload or, if you have none, your Gravatar, which is fetched with a hash of your email address.
Google Drive backups
If the people who run a project connect a Google Drive account, the app can save backups of that project there. It asks Google for one permission only, drive.file: to create and manage the files and the folder it creates itself. It cannot see or change anything else in that Drive. The token that allows this is kept encrypted on our server, is used only to upload and tidy up those backups, and is deleted (and revoked at Google) when the connection is removed. You can also remove the app at any time in your Google account under Security → Third-party access.
A backup is a ZIP file with the project's files and comments. It is not encrypted, so whoever can open that Drive folder can read it. The use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
How long we keep it
- Deleted files stay in the project's trash for 10 days, then they are removed for good.
- Notifications stay until you delete them. Backups made for download keep the latest 5 per project.
- When an account or a project is deleted, what belongs only to it is deleted with it.
Cookies
Only the ones the app needs: a cookie that keeps you signed in, short-lived ones during two-step sign-in, and a note in your browser of your light or dark choice. There are no tracking cookies.
Your choices
You can change your details, turn email and browser notifications on or off, and remove passkeys and two-step verification in your settings. To see, correct or delete what we keep about you, or to have your account removed, ask the administrator of this workspace.