Privacy policy

1. Who is responsible for what

Your brokerage decides what goes into Deskwork and who on its roster may use it. Your brokerage is responsible for those records and for the people it gives access to. Deskwork (deskworkapp.com) operates the service, hosts it, and handles those records on your brokerage's instructions. On this page "we", "us" and "our" mean Deskwork.

If you are an agent or staff member at a brokerage that uses Deskwork, your broker or office manager controls your access and can answer questions about the records your office keeps. We will also answer directly; see section 13.

2. Signing in: what Google or Microsoft tells us

Deskwork has no passwords of its own. Signing in uses a Google account: a Google Workspace account on a domain your brokerage has approved, a Google Workspace account on your own business's domain whose exact address your brokerage has put on its roster, or a personal Gmail account whose exact address is on the roster. Where your office offers it, you can sign in with a Microsoft account instead, on the same terms: a Microsoft 365 work account belonging to your brokerage's own Microsoft 365 organization, on a domain it has approved; a Microsoft 365 work account on your own business's domain whose exact address is on the roster; or a personal Outlook.com, Hotmail, Live or MSN account whose exact address is on the roster.

Signing in asks Google or Microsoft for your basic profile and nothing else: who you are, your email address, your name and, from Google, your profile photo. Those are the three sign-in permissions called openid, email and profile.

• Signing in does not request access to your Gmail, your Drive files, your Calendar, your contacts, or your organization's Google Admin settings. Signing in with Microsoft likewise requests no access to your Outlook mail, OneDrive, calendar, contacts or anything else in Microsoft 365.
• Google Drive is asked for separately, and only when somebody presses a Drive control. Section 3 says exactly what that permission covers.
• Google Calendar is also separate and opt-in. Where enabled, the broker-owner connects it from Calendar; section 3 describes its limited scope.
• Your organization's Google directory is asked for separately too, and only when your broker-owner or office manager presses Add from Google Workspace on the Roster. Section 3 says what is read and what is kept.
• Deskwork stores no password, no security question and no password reset, because there is nothing of that kind to store.

From Google's or Microsoft's response we keep the following, and nothing more:

Sessions expire after eight hours, and signing out ends yours at once. While a session lasts, the server keeps your account identifier, email address, domain and display name with it. So that a restart of the service does not sign the whole office out, it writes its list of open sessions to its own disk: those values, when each session expires and when it was last confirmed — at sign-in, and for a work account on your brokerage's own domain at each hourly check with Google or Microsoft — but not the key your browser's cookie holds. An ended session is removed from that list.

A personal Gmail or Outlook.com address is let in by its exact spelling on the roster, and so is a Google Workspace or Microsoft 365 account on a business domain other than your brokerage's, but an address can change hands. So the first time one signs in, the desk writes down, on its own disk, the address, the account identifier that signed in with it and when, and from then on only that account can use that address. A sign-in refused for that reason is noted in Deskwork's own log with the address (section 10). Taking the person off the roster, or marking them departed, forgets it. Work accounts are not written down this way when they are on your brokerage's own domains, because your brokerage's own administrator decides who holds an address there. Apart from the open sessions and this list, there is no separate database of users.

The bell in the desk's header remembers, for each person, which of its updates they have already opened, so the count on it goes down. That is a short coded list kept on the desk's own disk beside the office — no addresses or names — never shown to anybody else, and an update is forgotten from it once it leaves the bell, after two weeks.

While you are signed in, your browser holds one cookie: a signed session identifier, from which the server also checks that a save came from the Deskwork page and not from another site. The cookie carries no personal information itself. While a sign-in or a Google permission screen is open, short-lived cookies also match the answer to the request that asked for it, and are cleared when that finishes: ten minutes at most on your desk's own address, and a day at most on our sign-in address below. There are no advertising cookies and no cross-site cookies.

Depending on how your desk is set up, the trip to Google or Microsoft may go by way of our sign-in address, auth.deskworkapp.com, so that each needs one return address for every brokerage. For a sign-in to a desk it only relays: it checks their answer and hands it straight back to the desk that asked. It holds no office records, and for those sign-ins its own code writes down nothing about whose account signed in. (The same address also runs signup and find-my-desk, which do keep a few things; they are described just below.) While a sign-in is under way it holds, in memory only, which desk asked and whether to sign in or to connect Drive, when it started, the network address the request came from (so no one address can flood it), and the one-time values that tie the answer to that request. A sign-in not finished within ten minutes lapses. The sign-in address then forgets all of it except which desk it was for, which of the two it was, and when it started, so that a late return can be sent back to that desk with a plain message. Those three are cleared once they are a day old, the next time anyone signs in through it, or sooner if the service restarts. Like every Deskwork address, its requests are in the web server's access log described in section 10.

Setting up a new desk

Signing up for a desk at auth.deskworkapp.com/signup keeps more, because a desk needs an owner and because we have to be able to stop one person setting up desks in bulk or in somebody else's name. Here is everything, why, and for how long.

• While you fill in the form, in memory only: your email address, your Workspace domain (none, if you signed up with Gmail), the network address you came from, when you signed in, and a one-time value that protects the form. If the signup page offers Microsoft and you sign up with it, also that you did, your Microsoft 365 domain and the identifier of its organization (neither, for an Outlook.com, Hotmail, Live or MSN address). Gone after 30 minutes, when you choose "Use a different account", or if the service restarts. Your name and photo from Google or Microsoft are not kept.
• Each desk name you try is sent to check it is free, and so appears in the web server's access log (section 10).
• Name-check limits keep your network address in memory for a one-minute window and your email address for a 24-hour window. The signup limit also keeps your network address in memory for its 24-hour window, to limit desks queued from one network. Expired limit entries are deleted on the next budget check, or when the service restarts.
• When you ask for the desk: a request naming the desk, your brokerage's name, your email address, your network address and the time (and, if you signed up with Microsoft, that you did and, for a Microsoft 365 account, the identifier of its organization) is handed to the program that makes desks, which removes it once it has read it (normally within a minute) and keeps its own copy only until the desk is made or refused, or while we review it, for at most 30 days: a request still waiting for our review by then is declined, and any other we could not make by then is given up and we are told. The signup page also remembers, in memory, the desk name, your brokerage's name, your email address, whether you signed in with Google or Microsoft and the time, so that its progress page answers only you and the same name is not offered to somebody else; that is forgotten after a day or when the service restarts. The request's reference number is made partly from your email address with a secret key, so that when you sign in again with Google (or Microsoft, if you signed up with it), after that is forgotten or while we review the desk, the signup page can pick out your request among that program's answers and show you where it stands. Without that key, nobody can tell from the number whose request it is.
• The program that makes desks keeps a record of each desk it makes — the desk's name, your brokerage's name, your email address as its owner, your network address and when, and the Microsoft details above if you signed up with Microsoft — and one line per desk in a log of desks made (name, owner address, network address, time). It uses them to limit how many desks one account, one network, one Workspace or Microsoft 365 domain, Gmail and Outlook.com owners as a group and the whole service can have or make, and to know who set up a desk if its name is disputed. Your network address is taken out of both 30 days after the desk's name was reserved for you. The rest is kept for as long as the desk exists. Once a desk is taken off our servers and the copy we keep of it is deleted (section 10), its record keeps only the desk's name, your email address as its owner and the dates, as the record of who held the name, until you ask us to delete it (section 13). Next to the desks it also keeps a count of desks per Workspace domain, by a one-way code rather than the domain or any address, so the signup page can tell a second person from the same company that a desk already exists (a Microsoft 365 domain is counted the same way, and one company on both Google and Microsoft is one domain). For a desk set up with a Gmail address, the count is per Gmail account instead, and its one-way code is made from that address as Google reads it (dots and any "+" ending taken out, googlemail.com read as gmail.com), so the signup page can tell you that you already have a desk. For an Outlook.com, Hotmail, Live or MSN address it is per address, as Microsoft gives it. The code is not a secret key: somebody who could read the count and already knew your address could check it, which is why only the signup service and the program that makes desks can read it.
• Your new desk holds your email address as its owner, in its own settings, as part of its records (section 3).
• We are emailed when your desk has been made (or, if we are reviewing new desks before they open, when it is waiting for us): your brokerage's name, the desk's address, your email address, a reference number, the time and how many desks were made that day. The message goes through our email provider (section 8) and is kept in our mailbox as the record of your signup. A request that was refused is not emailed.

Finding your desk

On auth.deskworkapp.com/find you type an email address and we email that address a link to each desk it can sign in to, or say there are none. The page itself shows the same thing whatever the answer, so it cannot be used to learn where somebody works. To answer, the address is sent to each desk on our server, which says yes or no and does not record it; the reply is sent through our email provider. Our sign-in service keeps a one-way code of the address, not the address, for an hour, so that no one address can be sent more than three of these messages an hour, and its log notes that a message was sent and how many desks it listed, without the address. Your network address is held in memory for a quarter of an hour so that no one network can flood it, and the request is in the access log (section 10) like any other. Expired limit entries are deleted on the next budget check, or when the service restarts.

3. Your brokerage's records

The working records your office enters are stored on the server that runs your brokerage's desk. That includes:

• your roster: names, email addresses, roles, teams, start and departure dates, and, where your office enters them, license numbers and the day each person's E&O insurance runs out;
• people's photos: the Google profile photo copied at sign-in (section 2) or when somebody is added from your Google directory (below), or a photo your broker-owner or office manager uploads in its place;
• commission plans: splits, caps, flat transaction fees, and each agent's cap year;
• transactions: property address, side, status, the agents on the file, the dates typed against it, sale price, and the parties recorded on it;
• document checklists: which documents a file owes, which have been filed, the names of the files that were filed, who added each one and when, and, for a document in Google Drive, the identifier Drive gave it;
• closing figures, issued commission statements, referral fees, and office charges;
• any figures your office records from its own commission workbook (below), kept marked as yours and separate from anything the desk computed;
• your brokerage's office address, phone number and license number, if your office enters them on Office settings;
• your brokerage's logo, if one is uploaded, and the picture of a property that a file's screen shows: a listing photograph, a street-level picture or an aerial picture (section 7), kept so it is fetched only once;
• a photo of the property that somebody working a file uploads for it, or picks from the pictures already among that file's documents in Drive (below), for when there is no listing photograph or street-level picture, shown in their place. It is kept with your office until somebody removes it, and shown only to people who can open your office. When the file itself is removed, its photo is no longer shown and is deleted once the room is needed for another. Where and when the photo was taken, which a phone writes into it, is removed before it is kept.

Deskwork stores no document files. The documents themselves live in your brokerage's own Google Drive. A document added to a file in Deskwork passes through our server's memory straight into that file's Drive folder, in one request, and is not kept here: it is never written to our server's disk, and the server lets go of it once Drive has it. A document opened on its file to be looked at comes back the same way, through memory and out to the person looking, and is not kept either. What the desk keeps is the document's name and the identifier Drive gave it, which is how a file's screen links to it. If your brokerage has not connected Drive, the document is not sent anywhere: the desk records its name only, and says so. There is one exception, and it is a copy of a picture, not of a document: when somebody picks one of the pictures already among a file's documents to be that file's photo, our server reads that one picture from Drive and keeps it as the file's photo, as described above. The document in Drive stays where it is, unchanged.

Deskwork can work with Google Drive in the ways below. None of them does anything until somebody at your brokerage grants Google's permission for it, and all of them use Google's narrowest Drive permission (called drive.file), which reaches only the folders and files Deskwork itself created and the files you choose in Google's own picker. Nothing in Deskwork deletes a file from your Drive.

• A folder for each file. Once your broker-owner connects the office's Drive, a file's folder is created in that Drive when somebody asks for it on the file. The folder is named after the property address and the first names of the agents on the file; a referral's folder is named after the other party to the referral instead. Unless your broker-owner switches sharing off, each folder is shared with the agents on that file at their roster email addresses, but only at addresses that can sign in: one on your brokerage's approved sign-in domains, or a personal Gmail address (or, if your office offers Microsoft sign-in, an Outlook.com, Hotmail, Live or MSN address) exactly as it is on the roster. That access is taken back when an agent leaves the file. So that this works while nobody is signed in, the server keeps the office's Drive permission. Disconnecting deletes it from the server and asks Google to revoke it; if Google does not confirm, the desk says so and points to the page in your Google account where you can remove it yourself. A Drive connection set up on the server by whoever runs your desk, rather than by your broker-owner pressing Connect, is not ended by Disconnect; ask us to remove it.
• Adding a document to a file. The agents on a file, the broker-owner, the office manager and an assistant can add a document to it. It goes into that file's folder, in a subfolder named after its checklist section when it is on the checklist, using the office's Drive connection above. A document can be up to 25 MB and must be a PDF, a photo or scan (JPEG, PNG, HEIC, TIFF, GIF or WebP) or a Word document; the server checks what the file actually contains, not only its name. Who can open it is Drive's decision, through the folder's sharing above. Taking a document off a checklist removes the desk's link to it; the file stays in Drive.
• Seeing a document on its file. A PDF or a photo (JPEG, PNG, GIF or WebP) on a file can be looked at in the file's own screen. The server reads it from Drive with the office's Drive connection and passes it straight to the person looking, without writing it to disk or keeping it. It does this only for a document the desk has recorded on that file, and only for somebody who can open the file in Deskwork: the broker-owner, the office manager and an assistant for any file, and an agent for their own files and those of the agents they work with, and then only for a document in that file's own Drive folder or a folder directly inside it. If your brokerage switches off sharing each file's folder with the agents on it, only the broker-owner and the office manager can look at documents this way; agents and assistants open them in Google Drive, where Drive decides. That is the desk's rule, not Drive's sharing, so somebody can see a document here that Drive itself has not shared with them.
• Choosing the commission workbook. On the Tracker screen, the office can pick one spreadsheet in Google's Drive picker. For that, the server holds a short-lived Google permission in memory only, never on disk, and it cannot be renewed without asking again; it is dropped when the signed-in session of the person who gave it ends, and Google stops honoring it within an hour of granting it. The browser fetches the workbook from Google and reads it in the page. The workbook file itself is never uploaded to our server by this control. What is saved is only what somebody chooses to keep: the figures they press Record on, saved to your office's records under the workbook's name, and the answers they give about what each column of the workbook holds, kept by column heading so next month's workbook is read the same way. If the broker-owner or office manager saves a commission spreadsheet mapping in Office settings, we also keep the chosen Google Sheet's identifier and name, included tab names, selected roster identifiers, and column headings and mappings. Other roles are not sent this mapping. Previewed row values are not saved by this control, and saving it does not start background reads or writes to the sheet.
• The Google connection for sheet sync. Sheet sync does not use the office's Drive connection above. The broker-owner or office manager who sets it up connects their own Google account for it, on the Sync screen, with the same narrow drive.file permission, and chooses the sheet with it. So that syncing works while nobody is signed in, our server keeps that person's Google permission for this one purpose, in the office's private storage on our server, readable only by your desk's server process, and never in a log. The only thing sent from it to a browser is a short-lived access to open Google's picker, to that same person, when they choose the sheet. It is accepted only from that person's own Google account, signed in with Google, while they are the broker-owner or office manager on your roster; it is used only after they confirm the sheet with it; and it is never replaced by anybody else's permission. The broker-owner and office manager see which account sync uses; only its owner can disconnect it. If Google stops accepting it, the person leaves those roles, or they press Disconnect my Google connection, syncing and writing pause until somebody connects and confirms the sheet again. Disconnecting deletes the permission from our server; it does not ask Google to revoke it, so remove Deskwork under your Google Account, Security, Third-party apps to end it there too.
• Syncing from the commission sheet. Only once the broker-owner or office manager presses Start syncing under a saved mapping, our server reads that one Google Sheet itself, every five minutes and on a Sync now press, using the sheet's own Google connection (above) and no other permission. Each read fetches the sheet as a workbook, reads the included tabs by the saved mapping, and keeps nothing of the workbook once it has read it. What it saves into your office's records is what a new row starts and an edited row changes: a file with its address, MLS number, agent, price and listing, pending and closing dates. Our server also keeps, beside your office's records, which row each file came from and the values both sides last agreed on for those fields, the conflicts and rows it could not act on, and when it last checked. That record is shown to the broker-owner and the office manager only. Syncing from the sheet never writes to it, never clears a Deskwork value because a cell is blank, and never enters commission. Pressing Pause syncing stops the reads; forgetting the mapping stops them too.
• Writing to your commission sheet, after a trial copy. Deskwork writes to a copy first. When the broker-owner or the office manager presses Make a trial copy (or later Make a new trial copy), our server copies the connected sheet into the Drive of the Google account that sheet sync uses, under a Sheet trial copies folder, with that same connection and no other permission, keeps that copy's identifier and name beside your office's records, and from then on syncs with the copy instead of your sheet. Compare with your sheet reads your sheet the same way and lists what switching to it would change, writing nothing; that list is kept beside your office's records and shown to the broker-owner and the office manager only. Only after one of them presses Switch to your sheet does our server write to your sheet itself. Either way, writing happens only once the broker-owner or the office manager presses Start writing under a running sync, after each save to the office and batched. Before the first write to your sheet it saves a full copy of it in that same account's Drive, under a Sheet backups folder, and keeps that copy's identifier and name beside your office's records. What it writes is what the office did: a file handed in here adds a row on its agent's tab, and a file's dates, price, closing figures, paid date and status go to the columns the saved mapping names, never to an unmapped column (other than a Deskwork id column it adds at the right of each included tab), a formula, or over a value somebody typed that differs from Deskwork. Every change is also listed on a Deskwork log tab in the sheet written: when, which file, which cell, what it held before, what it holds now, and the accounts whose saves it followed. After each write it reads the rows it wrote back, and if one changed while it was writing, it pauses syncing and writing and says which row to check. Our server never deletes a row or clears a cell, and never deletes the trial copy. Pressing Stop writing or Pause syncing stops the writes.
• Attach from Drive. A document your office already keeps in Drive can be linked to a file instead of added again. This opens the same Google picker, with the same short-lived permission held the same way, and you can choose several documents. The picker hands back each document's identifier, name and file type, and Deskwork keeps the identifier and name. Linking it reads no part of the document, in the browser or on our server; once linked, it can be looked at on its file by the people named above ("Seeing a document on its file"), on the same terms. Nothing is linked until you confirm where each document goes. Deskwork does not move, copy or change a linked document, or change who can open it.
• A file's photo from its documents. When a file has JPEG or PNG pictures among its documents in Drive, the people who can change the file's photo can pick one of them instead of uploading it again. When your broker-owner has switched off sharing files' folders with their agents, only the broker-owner and the office manager can pick one. The picture picked is shown to everyone in your office, and the screen says so before anything is picked. Only a picture recorded on that file and kept in that file's own Drive folder can be picked. Our server first asks Drive where the document is, what type it is and how large it is, and goes no further unless it is a small JPEG or PNG image in that folder. It then reads that one picture from Drive with the office's Drive connection, takes out where and when it was taken, and keeps it as the file's photo. Nothing in Drive is changed, and no other document is read.

Google Calendar sync. Where enabled, the broker-owner may connect the same Google account they signed into the desk with. Deskwork asks for permission to create secondary calendars and manage events in calendars created by the app (calendar.app.created), plus verified account identity. It creates a separate office calendar and copies property or referral names, deadline labels and dates. It does not copy pay figures, invite guests, or read or change your existing calendars. Only events marked as managed by this connection are changed or removed. A refresh credential is kept privately on your desk so updates can run while you are away.

Keep this calendar private unless its recipients may see your office's files. Stopping sync removes the stored calendar connection and stops updates; events already copied into Google remain there until you remove them in Google. Stopping it does not revoke all permissions for Deskwork's Google app, because that could also interrupt Drive. You can review or remove those app permissions in your Google account separately.

Adding people from your Google directory. Where we have switched it on, and people sign in with Google Workspace, the broker-owner or office manager can press Add from Google Workspace on the Roster instead of typing people in. That asks Google, on Google's own page, for one permission: to read your organization's directory (called directory.readonly). It cannot create, change or delete anybody's Google account. Our server reads the directory once with that permission: each person's name, work email address and the address of their profile photo. Then it lets the permission go: it is not stored and not renewed. People whose address is not on your office's sign-in domains are left out. The list is held in our server's memory for 15 minutes, only for the person who pressed, so they can tick who to add; then it is forgotten. While it is held, the photos shown in it are fetched from Google by our server, not by the browser. Only the people they choose are kept, as roster rows with their names and addresses, and their photos as roster photos. Nobody is emailed until an invite is sent from the Roster.

Every accepted save keeps a copy of the version it replaced, so a bad save can be undone. Those copies live beside your office's records, are not reachable over the web, and are held under the same rules as the records themselves.

Every accepted save is also written to an append-only history: the time, the account that made it, and which parts changed. The history is kept beside your office's records rather than inside them, so it cannot be rewritten by the same save it records.

4. Who can see your records

• People on your roster. Your office's roster is the server's authority on who may read anything. An account that is not on it is refused, by name, on every screen and every data request.
• Not other brokerages. Each brokerage's records are separate and a sign-in is confined to its own approved domains and the addresses on its own roster.
• Us, only when we have to. The people who operate and support the service can reach the server where your records are stored. We look only when your brokerage asks us to, or when we have to in order to keep the service running or to meet a legal obligation.

What a roster member reads, stated plainly: every file in their own office, not only the files assigned to them. Pay is narrower. An agent is served their own commission figures, those of the agents they assist, and their teammates' unless the office has made that team's pay private; the broker-owner, the office manager and assistants see all of it. License numbers and E&O insurance dates are narrower still: on the desk, only the broker-owner, the office manager and assistants are shown them, and an agent is sent nobody's, their own included. Writes are restricted by role — the roster, the commission plans, the issued statements and the recorded referral fees can only be changed by the broker-owner or the office manager. Removing somebody from your roster, or marking them as left, ends their access at once. Turning off their Google Workspace or Microsoft 365 account ends it within an hour: while a work account is signed in, the desk quietly asks Google or Microsoft about once an hour whether it is still active. If that check cannot be completed — the account is off, the person has signed out of Google or Microsoft in that browser, or the provider cannot be reached at that moment — the session ends and the person signs in again. For a personal Gmail or Outlook.com account, or a work account on another business's domain, the roster is the only control.

5. Email

Deskwork sends email on your brokerage's behalf. It sends exactly nine kinds of message, and there is not meant to be a tenth:

Until your office's email is turned on, every message goes to a test mailbox instead — the broker-owner's own address for an office that signed itself up, or ours while we set an office up — and reaches nobody else. The test mailbox receives the whole message, including a commission statement's figures and a weekly summary's totals. For an office we set up, that means our mailbox holds those figures until email is turned on. Your broker-owner turns email on in Office settings, by switching from Test mode to Live once every address on the roster can be sent to, your office has its own name and its own address for replies, and the broker-owner is signed in. Once it is on, an office sends at most a set number of messages a day, fewer in its first week; a message that limit holds back, such as a commission statement, waits on your office's desk and is sent as soon as the limit allows. If other mail servers refuse or return messages to several addresses on the roster, or several people mark your office's email as spam, email goes back to Test mode by itself until the broker-owner checks the roster and turns it on again. Commission statements issued during that pause wait on your desk until email is Live again; they are not sent to the test mailbox. Your desk keeps a record of which of its messages were returned or marked as spam, and to which address, beside its record of email sent. We can also hold an office's email in Test mode ourselves.

On an office admitting work domains, an exact roster address on an agent's own non-free-mail domain can receive invites and statements too. The rest of that domain gets no access. Messages are sent through Deskwork's own Google Workspace mail account, from notifications@deskworkapp.com under your brokerage's name, with replies going to your brokerage. Google carries each message, and a copy stays in the Sent folder of that Deskwork account. Only the people who operate Deskwork can sign in to it; nobody at any brokerage can. No other email-sending service is used, so no marketing-email vendor holds a copy of an agent's pay. Agents are not sent the deadline digest unless one of their addresses is chosen for your office's digest, and there are no marketing emails, newsletters or product announcements from the application. Every message is sent under your brokerage's name and, if your office has entered them on Office settings, ends with its office address, phone number and license number (section 3), so the person reading it can tell which brokerage sent it and how to reach the office.

A closing reminder holds the file's property address, its closing date and a link to the file, which asks the agent to sign in. It names no client and no dollar amount. The broker-owner or office manager can turn closing reminders off for the whole office at any time, under Office settings, Alerts & email, and each agent can switch off their own under My email.

A document reminder holds each of the agent's own files that still owe a required document: the property address, a line for each document that says it is still missing, and a link to the file, which asks the agent to sign in. It names no client and no dollar amount. A listing is not asked for the sale's documents before it is pending. The broker-owner or office manager can turn document reminders off for the whole office at any time, under Office settings, Alerts & email, and each agent can switch off their own under My email. While document reminders are on, a closing reminder also lists the documents still missing on each closing it names, unless that agent switched document reminders off under My email.

A weekly summary holds the property address of each file opened, closed or paid that week, with a link to the file, the number of commission statements issued, and the office's totals for the files paid: gross commission, anything taken off the top or out of agent pay after the split, agent pay and brokerage revenue, any admin fees the agents charged their own clients and kept, and the monthly charges collected, with any payment dated in an earlier week but entered after that week's summary went on a line of its own, recorded late. The totals are the office's, never a line per agent, though in a week with one paid file they are that file's. It names no client. The broker-owner or office manager can turn it off for the whole office at any time, under Office settings, Alerts & email, and each of them can switch it off for themselves under My email.

A sign-in invite holds the person's name, your brokerage's name, the link to your office and which sign-in button to press with their email address. It names no file, no client and no dollar amount. The roster shows the broker-owner and the office manager whether each person was invited and whether they have signed in; to say so, Deskwork keeps the email address of each person on the roster who has signed in and when they first did, and lets go of it when they are taken off the roster.

A deletion notice says who asked for the office to be deleted, the day they asked and the day the office closes, with a link to Office settings to cancel. When it is canceled, the notice says who canceled it and which request. It names no client and no dollar amount.

6. What the browser contacts

Signing in sends you to Google's or Microsoft's own sign-in page and back, and a control that needs a Google permission (Drive, or Add from Google Workspace) sends you to Google's own permission page and back. The photos in the Add from Google Workspace list are fetched by our server, not by your browser. Apart from that and the Drive picker below, Deskwork's pages make one kind of request outside our own server, and it is not about you: on the listing-search screen, and on the new-file screen when a listing is suggested or chosen, listing photographs are fetched from the MLS image host, listing-images.homejunction.com. Those are public listing photographs. No transaction, agent, client name or commission figure appears in that request.

The Drive picker is the one exception. Google offers no way to choose a Drive file except by running its own picker in the browser. So the window that opens when somebody chooses the commission workbook or presses Attach from Drive (section 3) loads Google's picker code from apis.google.com and Google's related hosts. For the workbook, the browser fetches the chosen file from Google there; for Attach from Drive it fetches nothing. That window opens only when somebody presses the control. No other screen loads code from anywhere but our own server. A document added to a file is sent from your browser to our server, not to Google, and our server passes it on (section 3).

Otherwise, there is:

• no analytics of any kind, first-party or third-party;
• no advertising pixel, tag manager, session recorder or heatmap tool;
• no web fonts, icon service or content delivery network;
• no social media widget or embedded video;
• no third-party JavaScript on any screen of the product other than the Drive picker window, and none at all on this website.

This website, deskworkapp.com, loads only its own files from our own server, and it sets no cookies.

7. Address and listing lookup

Entering a property address is always possible by hand. Every lookup below is made from our server, never from your browser, and sends only address or search text: no agent, no client, no figure and no record identifier.

• Address suggestions. As you type a property address on the new-file screen, the text you have typed is sent first to your brokerage's own public listings website, which needs no lookup key, and the public listing page of the best match there may be opened for its photograph. If that site suggests nothing, and we have switched on the address services for your desk, the same text is sent to them (section 8).
• A picture of the property. When a file's screen shows a property, the server fetches its listing photograph from the MLS image host if your brokerage's listings website has one, or otherwise, if we have switched it on for your desk, sends the address to Google Maps Platform to find it on the map, then the map point Google gave for it to fetch a street-level picture, or an aerial picture of the lot where there is no street-level one. The picture is kept (section 3).
• Listing search. The listing-search screen reads your brokerage's own public listings website. The search terms and filters typed on that screen are sent with the request; nothing from your office's records is.

Your brokerage's listings website is your brokerage's own, run for it rather than for us, so it is not in the list in section 8. The keys for these services are held on our server and never reach your browser. A lookup that is switched off simply does not happen, and the rest of Deskwork works the same either way.

8. Services that handle your records

These are the outside companies (subprocessors) that handle your brokerage's information so that Deskwork can run. There are no others. If that changes, this list changes with it.

9. What we never do

• We do not sell your records, your agents' details or your clients' details. Ever.
• We do not share them with advertisers or data brokers.
• We do not use your brokerage's records to train machine-learning models, ours or anybody else's.
• We do not build a profile of you across other websites, because we cannot see them.
• We do not read your Gmail or your Calendar, because we never ask for permission to. In your Google Drive we reach only the folders and documents Deskwork created and the files you choose in Google's picker. A workbook you choose is read in your browser, a file you attach is not read at all, and we never delete a file there (section 3).

10. How long records are kept

Your office's records are kept for as long as your brokerage uses Deskwork, because a brokerage needs its own closed files for years afterward. Retained copies of earlier versions are pruned over time. Sign-in sessions end when they expire or when you sign out, and are then removed from the server's list of open sessions.

Logs. We keep two kinds, to keep the service running and to look into misuse.

• The web server's log covers every Deskwork address, including the sign-in address in section 2. For each request it records your network address (IP address), the time, the full web address of the page or data asked for, whether it worked, the page that linked to it, and which browser you use. That web address can include what was typed to get it — a property address typed for suggestions, listing-search terms, the name of a document added to a file, and each desk name tried at signup — as well as the property address of a file whose picture is shown, and the identifiers of records such as the file a document is added to, the file whose own photo is shown, or the person whose photo is shown. On a return from Google or Microsoft it includes what they add; Google's can name your Workspace domain. Requests that fail are also written to an error log with the same kind of detail.
• Deskwork's own log notes when the service starts and when something goes wrong, such as an email that could not be sent (with the address it was for), a Drive folder whose sharing could not be updated, or a personal sign-in refused because a different account signed in with that address first (with the address). It also notes the network address a Request access form came from (section 13), and when the deletion of your desk is asked for, canceled or carried out (section 10), without saying who. For signup and find-my-desk it keeps the notes described in section 2. When your broker-owner downloads a copy of your office's records, it notes which copy and how big it was, but not who downloaded it or what is in it. It never holds an email's contents, and it does not record the pages you open.

Both logs start afresh each day. The web server's are deleted after about two weeks, and Deskwork's own after about a month.

Your broker-owner can download a copy of your office's records at any time, from Office settings: the office's records — its people, plans, files, pay and archived years — as one file, and the roster and the files as spreadsheets. The copy leaves out roster photos and files' own photos, which of the bell's updates each person has opened, earlier versions of the office and the history of changes, the record of email sent, and the desk's own settings, such as its logo, its office address, phone and license number, which email domains may sign in and how and when it sends email (its reply address, the hour of the daily email, and whether agents get their own email yet). Who gets which emails is in it, and so are the office's time zone and how many business days after closing its agents are usually paid, once it has chosen them. Documents added to files are in your Google Drive already and stay there; the copy names them but does not hold them. Only the broker-owner can download it. Each download is in both logs above like any other request.

When your brokerage stops using Deskwork, you can also ask us for a copy of your records and ask for them to be deleted from our servers. We will do both. Say so at the address in section 13 and tell us which you want.

The broker-owner can also start the deletion from Office settings, under Delete this office. The office keeps working for 14 days, everybody who signs in is told the day it closes, and the broker-owner is emailed and can cancel until then. We are told when a deletion is asked for, when it is canceled and when the office closes, and each of those steps is recorded, with who took it, beside your office's records. When the 14 days are up the office closes: nobody can open it, and it stops using your Google Drive. Soon after, we take it off our servers. We keep its records, encrypted, for 30 days after the closing, in case the deletion was a mistake, and then delete them. Your documents in Google Drive stay yours.

11. Security

The service is served only over HTTPS. Sign-in is Google's or Microsoft's, so account security — including two-factor authentication — is handled by them. For a work account, turning off a departing employee in your own Google Admin or Microsoft 365 admin center ends their access here within an hour, including a session they already have open. For a personal Gmail or Outlook.com account, or a Google Workspace or Microsoft 365 account on another business's domain, your roster is the only control: removing the person or marking them as left ends their access at once. Saves are checked against the signed session and the sending page before they are accepted, and are refused if the account's role does not permit that change. No system is perfect; if you believe something is wrong, tell us at the address below and we will treat it seriously.

12. Children

Deskwork is a tool for licensed real estate professionals and the staff of a brokerage. It is not directed at children, and we do not knowingly collect information from anyone under 18.

13. Contact, and changes to this policy

Questions about this policy, a request for a copy of your records, or a request to delete them: privacy@deskworkapp.com.

Deskwork (deskworkapp.com) operates the service and answers at that address. Anything else about the product: support@deskworkapp.com.

If you ask for a desk with the Request access form, we receive your name, your brokerage's name, your email address, the size of your office and anything you write, as an email to the people who operate Deskwork. It is sent through the same Google Workspace mail account as section 5, which keeps a copy in its Sent folder. That email also records the network address your request came from and when it was sent, and the server that sends it writes the same network address to its own log, which we use like the logs in section 10: to keep the service running and to look into misuse. We use what you send only to reply to you; it is not added to any mailing list, and the form never emails the address you typed.

If we change what the product does with information, we change this page and move the "last updated" date at the top. A change that materially affects what leaves your office will be told to the brokerages using the product, not left on a page for someone to notice.