Privacy Policy

The data controller for Panoptik is Skarnlabs, a sole proprietorship (personligt ejet mindre virksomhed) registered in Denmark under CVR no. 35098178, owned by Bram Alexander Lyng Andersen, at Bådehavnsgade 55 H, 2450 København SV, Denmark.

For any request about your data, including access, correction, export or deletion, write to us through the contact form, or from Settings, Help & support when you are signed in. You also have the right to complain to Datatilsynet, the Danish Data Protection Agency.

• Account: email address, password hash (argon2), the public key and name of each passkey you add (the private key never leaves your device), organization name, verification and session timestamps.
• Content: dashboards, widgets, backgrounds, and media assets you create or upload.
• Devices: device name, pairing state, last-seen timestamp, assigned dashboard.
• Support:the messages you and our staff exchange in Help & support, kept with your account and workspace and deleted with either. You can also delete a solved conversation yourself, which removes it for our staff too; the email copy of each message that went to our support inbox when it was sent is not removed by that.
• Billing:plan tier, subscription status, and an opaque Paddle customer ID. Card data never touches our servers — it's handled by Paddle (our Merchant of Record).
• Operational logs: request metadata and error traces, retained for up to 30 days to debug and defend the service.
• Usage: on this website and in the editor (never on a display or a share link), which page you opened (the kind of page, not its address), the site that sent you, the site a link took you to, how long the page was in view, your device type, browser and operating system family, and your country. Your country is looked up on our own server from your IP address using IP Geolocation by DB-IP; your address is not stored and is never sent to DB-IP. Visits are counted with an identifier made from a key that is replaced and deleted every day, so a visit cannot be linked to one on another day. No cookie or browser storage is used for it. Retained for up to 400 days.

• No telemetry or analytics from rendered dashboards. We don't know what's on your screen.
• No advertising identifiers or ad-network tracking. We don't sell data.
• No persistent storage of the third-party payloads your widgets proxy (calendars, photos, JSON feeds) beyond short caches required to deliver them.
• No speech service outside our own servers. When a calendar alert is set to read an event aloud, the event's title is turned into speech by software running on our own EU server, and the recording is kept there for at most 30 days so a display can play it.

We use a single encrypted session cookie (iron-session) to keep you signed in. No tracking cookies. No cross-site cookies. No third-party cookies are set by our application.

• Paddle: Merchant of Record for payment processing, subscription management, and EU VAT remittance.
• Lettermint and Brevo:one of the two at a time carries our transactional email (verification, password reset, billing receipts), workspace invitations, which carry the workspace's name to the address invited, and display alerts to the owners of a workspace, which name the displays that went offline, and support chat mail: your message to our support inbox, and our answer to you.
• Hetzner: server and storage hosting inside the EU.
• GlitchTip: error tracking, self-hosted on the same EU infrastructure. Receives stack traces and request metadata when something fails.
• Microsoft 365:only if someone in your workspace adds your organisation’s own Microsoft Entra app to a meeting room widget. We then read your room list and the room calendars' times, titles, organiser names and privacy flags, with the permissions your administrator gave that app and can withdraw. Titles and organisers reach a display only where its tile is set to show them, never for a meeting marked private. Our server caches them for at most a minute, and a display keeps the last answer it showed so it can redraw after a restart. We store that app’s tenant ID, client ID and client secret with the widget; the secret is never sent to a display or a shared link. If the widget is set to allow booking, a display can also create, extend and end bookings in a room’s own calendar, and only extend or end the bookings it made. We hold no Microsoft password of any person.
• Google Workspace:only if someone in your workspace adds your organisation’s own Google service account to a meeting room widget. We then read your domain’s room resources and the room calendars, acting as the user your administrator named, with the same limits as Microsoft 365 above: titles and organisers only where a tile shows them, never for a private meeting, cached for at most a minute. We store the service account’s key and that user’s address with the widget; neither is sent to a display or a shared link. A booking made from a display is created in that user’s calendar with the room invited.
• A CalDAV server or a published calendar link: only if someone adds one to a meeting room widget. We read that one calendar, and with CalDAV we store the username and app password you typed; the link, username and password are never sent to a display or a shared link. A CalDAV room can be booked from a display; a published link is read only.
• Open-Meteo: weather data for the weather widget (requested server-side; no end-user identifiers sent).

Each vendor receives only the minimum data needed to perform its function.

Deleting your account removes your data from our systems. It does not reach back into theirs, so their retention is worth stating rather than leaving you to assume. Paddle keeps billing records for the period tax law requires, which is the same reason ours survive. Each of Lettermint and Brevo holds delivery logs for the messages it sent you. GlitchTip is self-hosted on our own EU infrastructure and its records age out on the windows described above, so a deletion reaches it as those windows pass rather than at the moment you ask. Hetzner holds nothing of its own: it is the hardware everything above runs on, so its retention is ours, and a deletion is complete there once the backups written before it have aged out. Microsoft 365 is your organisation’s own system: we only read from it, so it holds nothing from us, and deleting the widget or closing the workspace deletes the app details we stored. Google Workspace and a CalDAV server or a published calendar link are the same: each is your own system, holds nothing from us beyond any booking a display makes there, and deleting the widget deletes the details we stored. Open-Meteo never receives anything identifying you.

Nobody at Panoptik can open a terminal on one of your displays unless an owner of your workspace allows it, for that one display, from All displays. Access lasts 15, 30 or 60 minutes, ends by itself, and an owner can end it at any moment. Every owner is emailed when it is allowed and when someone connects, and the display shows a notice for as long as someone is connected.

The connection runs through a relay we operate ourselves, in the same EU datacentre as the rest of the service, and staff must sign in with a passkey to open it. On the display it runs as a separate user that holds none of the display's credentials and cannot reach other devices on your local network. We record which staff member connected, when, and everything they typed, and keep that record for 90 days.

We keep your data for as long as your account is active. When you delete your account, your content is removed from live systems immediately. Backup archives are retained for up to 30 days and are transferred over an encrypted connection, so a deletion becomes final in them once the archives written before it have aged out of that window. Billing records are retained for the period required by tax law (typically five to ten years, depending on jurisdiction). Usage records are kept for up to 400 days. They carry no account and no address, and their visitor identifier cannot be recomputed once its day has passed, so they are not tied to your account and are not part of an account deletion. Records of support sessions on your displays are kept for 90 days, and go before then if the workspace is closed.

If you're in the EU, UK, or another jurisdiction with similar laws, you have the right to:

• Access the personal data we hold about you.
• Export your data in a portable format.
• Correct inaccurate data.
• Delete your account and associated data.
• Object to or restrict certain processing.
• Lodge a complaint with your local data protection authority.

Use the contact form to exercise any of these rights. We'll respond within 30 days.

Passwords are hashed with argon2id. A passkey is checked against its public key, and changing or resetting your password removes every passkey added before it. Sessions ride in encrypted, signed cookies. All traffic is served over TLS, and backups are transferred over an encrypted connection. Our servers sit in EU datacentres with physical access controls; the disk volumes themselves are not separately encrypted at rest. Access is least-privilege: production is reachable by a small number of people, and each of them by name.

No system is perfectly secure. If you believe you've found a vulnerability, please use the contact form with subject “Security vulnerability”.

Panoptik is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child has created an account, contact us and we'll remove it.

We'll update this policy as the service evolves. Material changes will be announced by email or in-app notice before taking effect.

Privacy questions? Contact us.