Privacy Policy
Last updated: 19 May 2026
This Privacy Policy describes how Dashly ("we", "us") handles your personal information when you use dashly.live. Using the service means you accept what's described here.
1. Who we are
Dashly is an independent product. For any questions about this policy, get in touch through the support page.
2. What we collect
Account details
When you register, we store your email address, first and last name, and a hashed copy of your password (we use scrypt, so the original is never stored). If you enable two-factor authentication, the TOTP secret is stored encrypted and used only for that purpose.
Dashboard content
Everything you create inside Dashly (bookmarks, notes, to-do items, habits, calendar and news feed settings, widget configuration, and any images you upload) is stored on our servers so we can show it back to you. We don't analyse or process it for any other purpose.
Technical data
We log your IP address, browser, and operating system in an internal audit trail for security purposes (for example, to spot unusual login activity). We also set a session cookie to keep you logged in; see our Cookie Policy for details.
Support messages
If you send us a support message, we keep that conversation so we can follow up.
3. Why we use your data
| Purpose | Legal basis (GDPR) |
|---|---|
| Running and personalising the service | Contract performance (Art. 6(1)(b)) |
| Sending transactional emails (verification, password reset) | Contract performance (Art. 6(1)(b)) |
| Security and audit logging | Legitimate interests (Art. 6(1)(f)) |
| Responding to support requests | Contract performance (Art. 6(1)(b)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
4. Who we share data with
We don't sell, rent, or trade your data. We do pass it to a small number of service providers:
- Resend (resend.com) handles our transactional email. Your email address and name are sent to them when we need to contact you. They process this under their own Privacy Policy.
- Railway (railway.app) is our hosting and database provider. All stored data lives on their infrastructure. See their Privacy Policy.
- Google reCAPTCHA v3 may be active on the registration form. If it is, Google processes your IP address and browser fingerprint to check you're not a bot. This is covered by Google's Privacy Policy.
- External sources you configure (RSS feeds, calendar URLs, weather) are fetched by our servers on your behalf. Your browser never contacts them directly, and we don't pass your details to those services.
5. How long we keep your data
Your data stays on our systems as long as your account is active. Once you delete your account, everything tied to it (dashboards, widgets, uploads, and support messages) is removed within 30 days. Anonymised aggregate figures (like total widget counts) may be kept longer.
6. Your rights
Depending on where you are, you have rights over your personal data. You can:
- Request a copy of what we hold about you.
- Correct inaccurate details (most of this you can do yourself in Profile settings).
- Delete your account and all associated data at any time from Profile settings.
- Ask for a machine-readable export of your data.
- Object to or ask us to restrict certain processing.
To make a request, contact us and we'll respond within 30 days. You can also file a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
7. Security
We use TLS in transit, scrypt hashing for passwords, CSRF tokens, HTTP Strict Transport Security, and rate limiting on sensitive routes. That said, no system is completely immune to attack, and we can't make absolute guarantees.
8. Children
Dashly is not intended for anyone under 13. If you think a child has registered an account, please let us know and we'll remove it.
9. Changes
If we update this policy, the date at the top of this page will change. Carrying on using Dashly after an update means you accept the revised version.
10. Contact
Any questions? Reach us through the support page.