Privacy Policy

Paper Desk (flash.me.uk) is run by the owner of Paper Desk, an individual based in Alberta, Canada. The operator is responsible for the personal information described here and acts as the site's privacy contact. To reach them, use the contact page or call (403) 471-3798.

• Your account: email address, role and status, and your password, stored only as a salted hash, never in readable form.
• Mailing list: your email address, the page you signed up on, when you signed up, and a note of the consent wording you agreed to.
• Contact messages: your name, email address, phone number if you give one, the topic, your message and when it arrived.
• Phone calls: if you call (403) 471-3798, the phone company shows us your number and we may make a short note of the call. Calls are not recorded.
• What your desk sends (signed-in accounts only): scans, trades, positions, risk limits, backtest results and account values. Brokerage account numbers are masked before they reach the site.
• Technical logs: our host, Cloudflare, processes standard request data such as IP addresses, browser type and pages requested, to run and protect the site.

• To run your account and show your own desk's data back to you.
• To let admins approve, suspend or delete accounts.
• To send mailing-list emails only to people who asked for them.
• To read and answer contact messages and calls.
• To keep the site secure and working, and to meet legal obligations.

We use personal information only for these purposes, or for a new purpose we tell you about and, where needed, ask your consent for first. We don't sell or rent personal information, share it for advertising, or use it to build profiles of you.

We collect information with your consent: by creating an account, joining the mailing list, sending a message or calling, you agree to the uses above. You can withdraw consent at any time by leaving the mailing list, asking us to delete a message, or closing your account. Withdrawing may mean we can't provide that part of the site.

• One sign-in cookie, set only when you log in. It keeps you logged in for up to 30 days and is deleted when you log out. It can't be read by page scripts.
• One small note in your browser's storage on iPhone and iPad, so the “add to Home Screen” tip stays closed once you close it.
• No advertising, analytics or tracking cookies, and no third-party trackers.

• Your desk data is private to your account. Other accounts can't see it.
• Admins can see account emails, status and when a desk last reported. They can't see passwords. Mailing-list addresses and contact messages are read only by the operator.
• Public pages show sample or demo figures only, never anyone's account.
• Service providers that run the site for us: Cloudflare (hosting, database and security) and, when you call, our phone carrier. They handle information on our behalf and under their own security and privacy terms.
• We may disclose information if the law requires it, for example under a valid court order.

The site and its database run on Cloudflare, whose servers are in many countries, including the United States. Your information may be stored or processed outside Canada, and while it is, it may be accessible to courts, law enforcement and national security authorities in those countries under their laws. You can ask us questions about this at any time.

• Accounts and desk data: while the account exists. Deleting an account removes it, along with all of its desk data and sign-in sessions.
• Mailing list: until you unsubscribe or ask to be removed. We may keep a note that you unsubscribed so we don't email you again.
• Contact messages: only as long as needed to deal with them, and then deleted. You can ask for a message to be deleted sooner.
• Server logs: kept for a short period by Cloudflare under its own policies.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA), you can ask what personal information we hold about you and how it has been used, ask us to correct it, and withdraw consent. You can also ask us to delete it.

If you live in California or another U.S. state with a privacy law that applies to us, you may also have the right to know, access, correct and delete your personal information, and not to be treated differently for using these rights. We don't sell or “share” personal information for cross-context advertising, as those laws define the terms, and we don't use sensitive personal information to infer things about you.

To make a request, use the contact page or call (403) 471-3798. We may need to confirm it's you, and we'll answer within the time the law allows (generally 30 to 45 days). It's free.

If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, or the privacy regulator where you live.

Connections are encrypted (HTTPS only), passwords are hashed, desk tokens are unique per account, and every request is checked against the signed-in account. No system is perfectly secure, so keep your password and desk token private, and never send them to us. If a breach puts you at real risk of significant harm, we'll tell you and the regulators as the law requires.

The site is for adults. You must be 18 or older to create an account, join the mailing list or send a message, and we don't knowingly collect information from anyone younger. If you think a minor has sent us information, tell us and we'll delete it.

This policy may be updated. The date at the top shows the latest version. If we start using personal information in a new way, we'll say so here first. Questions: use the contact page or call (403) 471-3798. See also the Terms of Use.