1. Controller and contact details
Ilya Andreevich Kostylev, self-employed (professional income tax payer). Taxpayer ID (INN) 773502744073. Moscow, Russian Federation.
Support, data questions and legal notices: support@desktubo.com. Include DeskTubo in the subject.
You can also write from your account: Support. Answers to common questions are on the support page.
This policy applies only to DeskTubo. The seller's other apps have their own accounts, licenses and data processing rules. Data is processed under Russian Federal Law No. 152-FZ “On Personal Data”.
2. Data the service needs
- Account: email, ID, password hash, language, the times of registration, address confirmation and last sign-in. Used for sign-in, recovery, letters and account protection. The address is confirmed by a link from a letter; passwords are not stored in plain text.
- Premium and purchases: the plan and its number of computers, the Premium term, order number and amount, the price currency and the Bank of Russia rate for dollar orders, payment status. Used to fulfill the contract and answer payment questions. DeskTubo does not receive full bank card details.
- Computers and free minutes: a pseudonymous computer ID (a hash of the Windows machine number; the number itself is not sent), computer name, app version and bitness, time zone, the time and IP address of the first and last request, and how many seconds a day the Premium features of the free minutes (ghost mode, transparency, control from games, the lock, the sleep timer) were in use while a video played. Used to count free minutes, enforce the plan's computer limit, list computers in your account and announce new versions.
- Security: IP address and request times, sign-in events, failed sign-ins, password changes and resets, payments and disconnected computers. Used to protect against break-ins and abuse. App files are downloaded without linking them to the visitor: only the total number of downloads is counted.
- Website visit statistics (only with your consent): if you press “Accept” in the cookie notice, every page of the site except the admin panel runs Yandex Metrica. Without consent the counter is not loaded. Metrica collects visit data: the page address and where you came from, IP address, device type, browser and operating system, screen resolution, approximate location, actions on the page (scrolling, clicks, a Webvisor session recording; by default Metrica does not record values typed into fields) and its own cookies. In your account and on the payment pages Metrica only counts visits: no session recording, no clicks. The data helps us understand how the site is used and improve it.
- Support: tickets from your account (subject, the chosen order, message text, attached pictures, times, your rating of the answer) and letters to the support address. Used to answer your question and keep the conversation. Only you and the support can see the pictures. Only send information needed to resolve your issue; do not send passwords or card details.
DeskTubo does not receive the videos you watch, your searches, your Google or YouTube account data or bank card details.
Processing is based on entering into and performing a contract at the user's request, complying with legal obligations and protecting legitimate interests without infringing user rights; at registration, a separate consent to the processing of personal data; for visit statistics, the consent given with “Accept” in the cookie notice. We do not use advertising mailings or advertising profiling.
3. Data that stays on your computer
Settings, favourites, history and recent videos, and the window's size and position stay on your computer. DeskTubo does not send what you watch or search for to its server.
Videos, live streams and chat load directly from YouTube in the built-in Microsoft Edge WebView2 component. YouTube and Google receive the usual data of such requests, including your IP address, and process it under their own policies. Signing in to Google inside the app is optional and stays on your computer.
The DeskTubo sign-in key is stored on your computer encrypted by Windows. To check the system clock, the app reads only the time from the responses of google.com, youtube.com and ya.ru, without sending any of your data.
4. Storage, protection and recipients
Processing includes collection, recording, storage, correction, use, necessary disclosure and deletion. Connections to the website and server are encrypted (HTTPS). Passwords are stored as Argon2id hashes, one-time links and sign-in keys as SHA-256 hashes, the admin panel requires two-factor sign-in, and access to the database and backups is restricted.
Account data and support tickets are retained while the account exists and deleted with it. An account whose address is not confirmed within 7 days is deleted automatically. Payment records are also retained for legally required periods. Free-minute counters are kept for 60 days, the security log for up to 400 days, ended app sign-ins for 90 days and database backups for 14 days. When a purpose has been fulfilled, data is deleted or anonymized unless another legal basis applies.
Necessary information may be processed by hosting and email providers on the controller's behalf, or supplied to authorized bodies in response to lawful requests. Payments use Robokassa, which receives the email, description and amount of the order for the payment and the receipt. Visit statistics are processed by YANDEX LLC (Yandex Metrica) under the Metrica terms of use. The server gets the dollar rate from the Bank of Russia website without any of your data. Personal data is not sold or shared with advertising networks.
When processing the data of Russian citizens, the controller complies with applicable database localization and cross-border transfer requirements.
6. Your rights
You may request information about processing, correction, restriction or deletion, and withdraw consent where processing is based on it. You can delete your account yourself: your account → Security → Delete account. Send other requests to the email above from your account's address; we may ask you to confirm that you own it to protect your account.
When an account is deleted, its data is erased and its app sign-ins end. Records required by law or to protect the parties' rights, including payment records, may be retained on that basis. Requests are answered within statutory periods. You may contact Roskomnadzor or a court.
The current policy is published here. Material processing changes are made in accordance with legal requirements.