Privacy policy

Last updated 14 November 2026

This policy explains what Deckulator collects, why, who we share it with and the choices you have. In short: you can design a deck without giving us anything. If you save a deck we keep your email, the design and where it will be built. We only pass your contact details to builders and suppliers if you tick a box saying we can, and you can untick it at any time.

Who we are

Deckulator (“we”, “us”) runs the website at deckulator.com. For anything in this policy, including requests to see, correct or delete your information, email privacy@deckulator.com.

What we collect

When you just use the designer

The deck you draw is kept in your own browser’s storage so it’s there when you come back. It isn’t sent to us unless you save it, share a link, or include it with feedback.

When you sign in and save a deck

• Your email address, to send you sign-in codes and identify your account. We don’t use passwords.
• Your saved decks: the design, the name you give it, and the state and postcode (or ZIP code) where it will be built.
• Your contact choice: whether you agreed to be contacted by builders and suppliers, with the date and the exact words you agreed to.
• Security records: a scrambled (hashed) copy of each sign-in code and session, and short-lived counters keyed to your email and IP address to stop abuse.

When you send feedback

Your message, the page you were on, your email if you give it, your deck if you choose to include it, and your browser’s name and version.

Analytics and cookies

We use Google Analytics to understand how people find Deckulator and use it: pages viewed, time spent, where visits come from (for example a search engine or link), your general location (country and city, worked out from your IP address), device and browser, and actions such as starting a design, saving a deck or downloading a plan. Google Analytics sets cookies to do this. We have turned off Google’s advertising features and signals, and we don’t use advertising cookies.

In the European Economic Area, the UK and Switzerland, analytics cookies are only set if you accept them. Elsewhere they are on unless you turn them off, which you can do with the cookie banner, the “Cookie settings” link at the bottom of every page, or the choices below. If your browser sends a Global Privacy Control signal, we turn analytics cookies off for you.

Apart from analytics, we use one cookie to keep you signed in, and your browser’s storage to keep your current deck and your cookie choice. These are needed for the site to work.

Our hosting provider, Cloudflare, also keeps short-term technical logs of requests (such as IP address and page) for security and reliability.

Why we use it

• To run the designer, sign you in, save your decks and send your plan.
• To answer feedback and requests.
• To understand which features help and where people get stuck, so we can improve Deckulator.
• To understand where decks are being planned and which materials are popular, as summaries that don’t identify anyone.
• To keep the service secure and stop abuse.
• If you agree, to put you in touch with builders and suppliers who can quote for your deck (see below).

Builders and suppliers

Deckulator may work with builders, deck installers and material suppliers who want to help people planning a deck. When you save a deck you can tick a box that says:

Deckulator can share my email, deck design, state and postcode with trusted builders and suppliers so they can contact me about quotes. I can turn this off at any time.

It is unticked unless you tick it. If you do, we may share your email, the deck design, and its state and postcode with one or more of these partners so they can contact you, and they may pay us for that introduction. That counts as a “sale” of personal information under some US state laws, which is why we only do it with your permission.

• Partners use your details under their own privacy policies. We ask them to use them only to talk to you about your deck.
• You can untick the box at any time (see your choices). We stop sharing from then on and will tell partners we have already shared with that you’ve withdrawn.
• If you don’t tick the box, we don’t share or sell your personal information to anyone.

We may share or sell reports that combine many people’s information so that no one can be identified, such as how many decks are being planned in a region or which boards are most popular. These don’t include emails or anything that identifies you.

Who else sees your information

We use these service providers to run Deckulator. They handle your information on our behalf and only as needed to provide their service:

• Cloudflare hosts the website and database. Saved decks are stored in Cloudflare’s Oceania region; pages are served from data centres around the world.
• Resend sends our emails, such as sign-in codes, from its Tokyo region.
• Google provides Google Analytics, which processes data in the United States and elsewhere.

We may also disclose information if the law requires it, to protect people’s safety or our rights, or to a buyer if Deckulator is sold, in which case this policy keeps applying to your information.

Information sent overseas

Because of the providers above, your information may be stored or processed outside Australia, including in the United States, Japan and other countries where Cloudflare operates. We choose established providers with security commitments, but overseas laws may differ from Australia’s.

How long we keep it

• Account, saved decks and your contact choice: until you delete them or your account.
• Sign-in codes: 10 minutes. Sessions: 30 days, or until you sign out.
• Feedback: as long as it’s useful to improve Deckulator. If you delete your account, we remove your email and account link from it.
• Google Analytics data: up to 14 months.

We protect information with encrypted connections, hashed codes and session tokens, and access limited to the people who run Deckulator.

Your choices

You can change these here at any time. Turning off contact from partners is how you opt out of the sale or sharing of your personal information.

You can also ask us to see, correct or delete the information we hold about you, or to stop sharing it, by emailing privacy@deckulator.com. We’ll reply within 30 days. We won’t treat you differently for using any of these rights.

Your rights where you live

Australia

We handle personal information in line with the Australian Privacy Principles. You can ask to access or correct your information, and you can choose not to receive direct marketing. If you’re unhappy with how we handled a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

United States

Depending on your state (for example California, Colorado, Connecticut, Virginia and others), you may have the right to know what we collect and share, to get a copy, to correct it, to delete it, and to opt out of its sale or sharing and of targeted advertising. We don’t use your information for targeted advertising or for decisions that have legal effects on you. The categories we collect are identifiers (email), location (state and postcode), internet activity (analytics), and the content you create (deck designs and feedback). To use your rights, use the choices above or email us; an authorised agent can ask for you with your signed permission. If we refuse a request, you can appeal by replying to our answer.

Europe and the UK

If the GDPR applies to you, we rely on providing the service you asked for (your account and saved decks), your consent (analytics cookies and sharing with partners) and our legitimate interest in keeping the service secure and improving it. You can withdraw consent at any time, and you can complain to your local data protection authority.

Children

Deckulator is for adults planning a deck. It isn’t meant for anyone under 18, and we don’t knowingly collect their information.

Changes to this policy

We’ll update this page when our practices change and change the date at the top. If a change affects how we share your information, we’ll ask for your permission again before relying on it.