Privacy · Deckle

Where it lives

Everything is kept in Google Firebase (a database, a web host and server functions in the United States). Your X3 talks to it over encrypted connections, and checks the server’s certificate.

The person who runs Deckle can see the database, which they need to fix things. They don’t look at your mail, letters or memory unless you ask them to help with something. Passwords, sign-in tokens, calendar links and your own Anthropic key aren’t readable there: each is encrypted before it’s stored, with a key kept in Google Cloud’s key service that Deckle’s server is allowed to use, and Google keeps a record of every time the key is used.

This website serves its own fonts, Figtree and Recoleta, so reading it makes no requests to Google Fonts. Deckle works with a few others, each for one thing:

Google: sign-in; Firebase, which hosts this site and keeps the database and the server; and Google Analytics, which counts visits to this site (see Counting visits).
Anthropic: the AI that writes Deckle’s words (see AI). For a photo sent from the send page, or with a letter, a small copy (a JPEG, 512 px on its longest side, made on the phone it’s sent from) is sent to it once, so Deckle can say what it sees (and, for a letter, check that it can go). Deckle doesn’t keep that copy.
Open-Meteo: the weather. The app’s place search sends it the name you type. For the forecast, air quality, cloud cover, soil temperature and past weather (the garden’s frost dates, and this day in your weather since 1940), the app and Deckle’s server send the coordinates of the place you picked, rounded to 2 decimals first: about a kilometre.
iNaturalist: wildlife seen near home. The server sends it the same rounded coordinates and asks what people saw within 5 km in the last week. Photos from iNaturalist are shown with their open-licence credit.
The Metropolitan Museum of Art and the Art Institute of Chicago: the pictures Deckle hangs on its wall, all in the public domain. To find one for something you like, Deckle’s AI turns what you’ve told it into a few plain search words, such as “sailboat”, and only those words go to the museums: never what you told it, your name or where you live.
The Library of Congress: if you switch on 100 years ago in the paper (in the United States), Deckle’s server asks Chronicling America for the front pages printed in your state on this day a hundred years ago: only the state’s name and the date, never your town or who you are.
cdnjs (Cloudflare): the app’s code editor, fetched the first time you open it (Show code) in Screens or Advanced.
Hacker News: the app looks up the stories in your briefing by their numbers, to show their whole titles.

Deckle’s server also fetches public data from CelesTrak (the space station’s orbit), NOAA’s Space Weather Prediction Center (the aurora forecast, and where the northern lights are now), Launch Library 2 (rocket launches), NASA (the Mars rover’s pictures), the U.S. Geological Survey (earthquakes), NOAA’s OSMC (where the Global Drifter Program’s buoys are), Wikipedia and Wikimedia (facts for Deckle’s project notebook, and what happened on this day) and PoetryDB (a poem, now and then). None of them is told anything about you. If you list Washington Metro stations, WMATA is asked for their trains, never who you are. The sentence on a species’ page is Wikipedia’s too, passed on by iNaturalist.

The classic editor at /classic, kept as a fallback, still loads its fonts from Google Fonts and its editor from cdnjs.

Counting visits

This website uses Google Analytics to count visits, so the person who runs Deckle can see what’s read and what’s used. It records the pages opened, the site that sent you, your rough location (country and city, worked out from your connection, whose address Google doesn’t keep), your kind of device and browser, and a few steps: which setup steps you reach, and whether you skip one; which device you say you have, and whether Deckle is on it yet; the installer opened, sent to another computer, or not able to run in this browser; an install starting, finding no device, saving its full copy, connecting, finishing or stopping; a sign-in, and whether it made a new account; a pairing, or why a code wasn’t taken (mistyped, run out, or already used); and your device’s first hello. Each is a step and a word or two about it, never what you typed.

It never gets your name, your email or anything in your account, and never the part of an address that carries a code, a key or a letter. The send page and the pen-pal page don’t load it at all.
Its advertising features and Google signals are off.
In the EU, the UK and Switzerland it sets no cookies. Elsewhere it sets two of this site’s own, _ga and _ga_9CRVFGXHTD, to tell a return visit from a new one.
If your browser sends Do Not Track or Global Privacy Control, this site doesn’t load it.

Deckle’s server also keeps four numbers a day, for everyone together: how many accounts were made, how many new devices showed a pairing code, how many were connected, and how many first checked in. They’re kept under /stats, which no app or browser can read, and never say which account or device any of it was, or when in the day. Turning off Analytics above doesn’t change them, because they’re only totals.

How your X3 is used

Once a day, your X3 sends a few counts about the day before, so the person who runs Deckle can see which parts of it get used and when, and make it faster and better. For each hour of your day, by your X3’s clock:

how many times it was picked up, and how many seconds it was awake while you were using it;
which kinds of screen you opened from the top, such as Letters, Books, the paper or Settings, each with how many times. Only the kind, counted: never a title, never what a screen, letter, mail or book says, and never an id.

Nothing else: not what you read or wrote, not who you wrote to, not where you were. The counts are kept in Deckle’s database under /stats, which no app or browser can read, only Deckle’s server, and each day’s counts are deleted after 90 days. The person who runs Deckle looks at them only added up across everyone’s X3s, in a report that never shows which X3 any of it came from. Their own X3s are left out of it.

To stop: in the app, Device → Where it lives, switch off Share usage counts. Your X3 stops counting and sending at its next wake, and the counts already kept from it are deleted straight away. Removing your X3 or deleting your account deletes them too.

Your account and your X3

Sign-in: your Google account’s email address and name, through Google sign-in. Deckle never sees your Google password. The person who runs Deckle may now and then email you about what’s new or to ask how it’s going: one email to you alone, never a list. Reply “no more” and they’ll stop.
Each X3: a random id, the key it proves itself with, and what it reports when it checks in: battery, text size, whether it’s in dark mode, how long it has been on, how it woke, its firmware version, and whether it’s an X3, an X4, an X4 Classic or an X4 Pro. An X3 with the newest firmware also reports when it was last shaken, how many books you finished this year and when the last one was (never which), and its outings: when it was out of reach of your Wi-Fi for an hour and a half or more, and whether it was moving then. Never where it was: it doesn’t know, and sends nothing that could say.
Your time zone, from the city you pick, or one you choose, or your browser’s if you skip the city, so times on the X3 are yours.
What you set up: your city, screens you build and publish, buttons, feeds you watch, the name friends see.
Prints: each one-bit print (about 3 KB), Deckle’s line about it, your note and the time, and who sent it for a friend’s photo you hung. Up to 30 are kept, the oldest removed first, never the one on the wall. The photo itself is never stored. Deckle also counts the photos each day, for the limit of 10.
Deckle’s life:
- the letters it writes you, and your replies to them;
- its dreams;
- what it’s making, and the shelf of things it finished;
- jars of weather;
- a guestbook of visitors, and of friends’ Deckles that stayed;
- the life list of species you marked;
- the garden: six beds and their harvests;
- the buoy it adopted: its id, its name, a daily track of up to 400 points, and the logbook;
- cached forecasts and sightings. A sighting is the species, about how far away it was, and the day: never who saw it or exactly where.
The night post: a record of each stay (which friendship it was, the visiting Deckle’s name and look, and the times; never the other X3’s id), and when two friends’ Deckles last stayed, which keeps stays to once a week.
Usage counts: how many AI calls and tokens each X3 used each day, and how many calls each account made. Numbers only, never what was asked.

Location

Home is the place you pick in the app, from a list of towns and cities. Deckle keeps that place’s name and coordinates, never your address, and the coordinates never appear on a screen.

The coordinates go to two services only: Open-Meteo, for the weather, and iNaturalist, for wildlife seen nearby. They’re always rounded to 2 decimals first, about a kilometre, by the app and by the server alike.

A sighting is shown as about how many kilometres away it was, and which day. Never who saw it, or exactly where.

The place’s name, not its coordinates, can be part of what goes to the AI: in an answer about the weather, or as one of the pieces of a dream.

Mail and calendars you connect

Gmail and other mailboxes connect with an app password you make for Deckle, encrypted and stored where no browser can read it, only the server. The mailbox is opened read-only: never sent from, deleted or changed. You can revoke the password in your mail account at any time.
You can also connect Gmail by signing in with Google (open to the first 100 people). Deckle then keeps a read-only token, stored the same way.
It reads the last two days when you connect, then new mail every 15 minutes. In Gmail it skips the Promotions, Social and Forums tabs. Copies of messages are deleted after 14 days, and so are the screens made from them: the last message opened, your X3’s last answer and the Inbox list the app shows. What a message says never goes into Deckle’s journal or memory. A promise Deckle finds in one stays on your Commitments list until you mark it done or not yours, then it’s deleted 14 days later. Your X3 may keep its own copy of a screen you opened on its memory card until it’s replaced.
Calendar links are kept the same way as passwords, and read when the briefing is made, at most hourly. Deckle keeps each calendar’s next day and a half of events (title, time and place) until its next good read, and deletes them with the calendar.
Removing a mailbox or calendar deletes its password, token or link, and Deckle stops reading it.
Links and notes you send to your X3 stay until you remove them or the X3.

Feeds and the morning paper

Deckle prints your morning paper from the feeds you follow. Here is what it keeps, and what it fetches.

Feed items (a headline, a link, a short description, and sometimes the text the feed itself carries) are kept for each X3 for 14 days, then deleted.
Each paper (its stories’ headlines, standfirsts and links, Deckle’s note, and the weather line) is kept for 7 days. Which days you opened one is kept for 14 days; how many papers you’ve opened, and what Deckle folded from them, are kept until you remove your X3.
Articles. For a story that isn’t headlines only, Deckle’s server fetches one copy of the article, around 5 AM where you live, so you can read it on your X3. The words are cached for up to 3 days, and shared by link: anyone whose paper carries the same article reads the same copy, and nobody’s copy says who else read it. They’re shown only on the X3, with the source named, never in the app.
Being a good guest. Deckle reads each site’s robots.txt and does what it says, and it never gets around a paywall, a sign-in or a bot check. It names itself as Deckle/1.0 (+https://getdeckle.web.app/bot); the bot page says what it fetches and how a site can ask to be left out.
The headlines and short descriptions of your feeds’ newest items, the names of the feeds, what you said you care about in them, what your Deckle knows you like, and your town’s name go to the AI once a morning, to choose the stories and sum them up (see AI). On a day the AI rests, the paper is put together without it.
Stopping a feed deletes the items kept from it. Removing your X3 deletes its feed items and papers.

Photos

A photo you send from the send page is developed on your phone, in the page, into a small one-bit print.
Two things are sent: the print, and a small copy of the photo (a JPEG, 512 px on its longest side). The copy, with your note if you wrote one, goes once to Anthropic’s model so Deckle can say what it sees. The copy isn’t kept.
Deckle keeps the print, its line about it, your note and the time. It takes up to 10 photos a day and keeps up to 30 prints, removing the oldest first but never the one on its wall.
To remove one, open it on your X3 (Deckle → Around us → Prints) and choose Take it down, or Throw this one away. It’s deleted.
Deckle’s line says only what it can see. It’s told never to name anyone or guess about them: who they are, how they feel, or what they look like. A line that seems to is thrown away, and the print hangs without one.
The print on the wall is part of the sleep screen (see who can see your X3’s screens).

A photo with a letter can come from a friend or a pen pal, never in a bottle or a knock. It’s made into a print on the phone it’s sent from, and before it goes Anthropic’s model looks once at its small copy. A face close up, writing or a screen that could say who or where someone is, or anything sexual, violent or otherwise not right for a 13-year-old can’t go: the sender is told why, and nothing is sent. If the look can’t be had, nothing goes either. The copy isn’t kept. The print is kept with the letter on the X3 it went to, and among its prints once it’s hung on the wall. Each X3 sends up to 10 photos a day, its own wall’s included, and each pen pal up to 10.

Books

Deckle reads the books on your X3’s memory card: EPUB without DRM, and plain text.
Books you send from the app go through Deckle: the file is uploaded, converted on Deckle’s server if it isn’t EPUB or text (and split into parts if it’s too long for your X3 to open today), and kept only until your X3 has it, 14 days at most, then deleted. Its title and author show in the app until 7 days after it arrives. Removing your X3 or deleting your account deletes any still waiting. Deckle never unlocks a book with DRM. Nothing about what you read leaves your X3.
Only a count leaves your X3: how many books you finished this year, and when the last one was. Never a title, what you’re reading, or your place in it. Wi-Fi is off while you read.
The library, the covers it makes, your place in each book, and this year’s and last year’s finished books (title and month, for your X3’s own Our year in books page) are kept on the card, in a hidden folder. Pairing it to a different account deletes them; the books themselves stay.

Deckle’s memory

Your Deckle keeps a journal of what happens (letters, what you asked, things it noticed; never what your email says) and folds it into a short memory, plus the facts you tell it in the app. Notes it writes its letters, dreams and projects from are kept 21 days, and the rest of the journal a week; if it can’t fold its memory for a while, none is kept past 30 days. The memory stays until you clear it (in the app, under Deckle: Forget what it has learned) or remove the X3; the facts you gave it stay until you change them.

Letters and friends

Letters between friends are kept on both sides: each of you has your own copy.
They are not end-to-end encrypted: each Deckle reads the letters it receives so it can suggest replies.
Friends see the name you choose and your Deckle’s name and look, never your email or your X3’s id.
The night post: when you write to a friend who also has an X3, your Deckle may carry the letter and stay the night at theirs. Their X3 shows your Deckle’s name and look. Yours brings back the word for the weather there (such as “Light snow”) and what their Deckle is making. Never a place. It happens only between friends who both have an X3, when one writes to the other.
Pen pals don’t sign in. Their letters are kept with yours and read by your Deckle. Withdrawing the invitation deletes the conversation.
A photo can go with a letter between friends, or from a pen pal. It’s looked at before it goes, and its print is kept with the letter (see a photo with a letter).
Letters for later are encrypted the moment you seal them, as passwords are. The server opens one only on its day; before then nobody can read it, in the app or the database, you included. Until then all that’s kept in the open is who it’s to and the day it opens. You can throw one away unread. One to a friend reaches them on its day; if you stop being friends first, it’s thrown away unread.
Gifts: now and then Deckle finds something (a chestnut, a feather, a shell) that you can give to a friend’s Deckle. A gift says what it is and whose Deckle sent it, nothing else.
Reporting a friend sends your last 20 letters with them to the person who runs Deckle, and blocks them.

Bottles and the pal board

Two ways to meet someone new: a bottle, a letter to whoever finds it, and the pal board, where you knock on a Deckle’s door. Bottles are on unless you turn them off, in the app or with “Not for me” when Deckle asks on your X3. The pal board is off until you turn it on. Each X3 has its own.

What a stranger sees is your Deckle’s card: its name and look, what it’s making, up to three things you’re into, and the languages you write in. Never your name, email, town, time zone, weather or your X3’s id. Once you’re pals, they see the name you give friends, as any friend does.
Every bottle is read before it floats. Deckle’s AI checks it for contact details, links, and anything unkind, sexual or threatening, or not right for a teen. One that doesn’t pass stays with you, and you’re told why. If the check can’t run, the bottle waits until it can.
Age bands: bottles and the board are for 13 and over. Deckle asks once whether you’re 13 to 17 or 18 or over, and until you answer, your X3 finds no bottles and throws none. Teens only meet teens, and grown-ups only grown-ups, by bottle and on the board alike. Nobody checks it, so say it truly.
Reports of a bottle, a knock or a pal go to the person who runs Deckle, with the last letters, and block them: their bottles never reach you, their knocks never arrive, and they don’t see you on the board.
A stranger’s words stay out of Deckle’s memory until you write back: it notes that it found a bottle, never what was in it. When it drafts replies to a bottle, it reads the letter only to answer it, and the drafts never mention your name, where you live, your work or how to reach you.
The travelling notebook drifts from room to room as a bottle does, in the same age band. Each room adds one line: one your Deckle writes from its own weather, garden and visitors (never a place), or one you type, which is checked as a bottle is before it goes. Each line shows which Deckle’s room it came from. When it’s full, everyone who wrote in it gets a copy. Reporting a line takes it out and blocks the room it came from.
Turning bottles off stops them reaching your X3, notebooks included. Taking your Deckle off the board takes its card off.

AI

Answers, screens, briefings, the morning paper’s stories and note, sorting new mail, the check a bottle gets before it floats, suggested replies, and Deckle’s letters, dreams and photo captions are written by Claude, through Anthropic’s API. What that needs is sent to Anthropic for that request: the question, the mail being sorted, the letter in a bottle or a line for the travelling notebook being checked, a letter you write to Deckle (to answer it, and to see whether it asks Deckle to watch for something), what’s new on the pages and feeds you watch (with what you said you care about in them), the newest headlines from your feeds for your morning paper, the letter being answered, the pieces of a day a dream is made from, a photo’s small copy and your note with it, the small copy of a photo sent with a letter, and what your Deckle remembers about you. For the line Deckle says on your sleep screen, it’s also told the next thing on your calendar: its title and time. See Anthropic’s privacy policy.

Deckle’s server keeps logs, so the person who runs it can fix things. They say what kind of thing happened and how big it was, such as “a question, 38 characters”, never your words: not your questions, subjects, notes or letters, and not the names you give things.

Each X3 gets a free allowance of up to 25 of these a day (100 across an account) while the shared budget lasts, paid for by the person who runs Deckle. After that, Deckle rests until the next day, and new mail waits unsorted. Add your own Anthropic key in the app, under Deckle, to have no limit; Anthropic bills you for it, it is encrypted and stored where no browser can read it, and it is used only for your X3. Photos are limited either way: up to 10 a day for each X3.

Who can see your X3’s screens

Your X3 can’t sign in the way you do, so it reads its screens from a private address worked out from the key it was given when you paired it. Only your X3 and Deckle’s server have that key. From its first check-in, its id alone reads nothing: not its screens, not the sleep screen with your print on Deckle’s wall, and not what it was last shown, such as a letter or your Waiting list. Your mailbox, letter history, memory and keys were never readable that way.

Firmware from before September 28 read its screens by the X3’s id, so anyone who knew the id could read them. Every X3 on it is offered the update over Wi-Fi. The id is 16 random letters and numbers, isn’t shown on the X3 or to friends, and can’t be listed or searched. Pen pals’ links no longer contain it. (Links made before September 28 did; you can withdraw and re-invite.)

The community

Posts and comments on the community page are public. They show the first name and last initial from your Google account, never your email.
Votes are private: only the totals show, and nobody else can see how you voted.
You can delete your own posts and comments whenever you like. The person who runs Deckle can hide or delete any post or comment.
To stop floods, Deckle counts each account’s posts, comments and votes a day.

Deleting things

Remove this X3 (Device → Your X3 → Remove this X3) deletes:
- its mail, tokens, passwords, memory, friends, letters and screens;
- its pal card, its bottles and knocks, and any bottle on its shelf;
- its prints, and its count of photos;
- Deckle’s letters, dreams, projects, jars, guestbook, life list, garden and buoy, its finds, almanac and the names it gave its regulars, and what it’s waiting for;
- its letters for later, sealed or opened, and its gifts on their way;
- its lines in notebooks still drifting, and its copies of finished ones;
- its cached forecasts and sightings;
- its records of the night post;
- its counts of AI calls and tokens, and its usage counts;
- its saved-to-read list and the promises it kept from your mail;
- its feed items, its morning papers and what Deckle folded from them.
It connects like a new X3 afterwards. Do this before giving an X3 away, and delete net.txt and the cache folder from its card too: they hold your Wi-Fi password and copies of screens. The X3’s chip keeps no Wi-Fi password: since the October update, its first start clears any it held, including the one its original firmware saved.
Connecting an X3 to a different account does the same automatically: nothing of the last owner’s comes with it.
Delete my account (Device → Delete my account) wipes every X3 you own, as Remove this X3 does, and deletes your sign-in record (your email and name) and your account’s count of AI calls. You don’t need to ask anyone.
Friends keep their side: their copy of your letters and the prints of photos that came with them, gifts your Deckle gave theirs, and a line in their Deckle’s guestbook if yours stayed the night. Copies of finished notebooks keep the line you wrote.
Messages you send us, from this page or the app, are kept so we can answer them; deleting your account doesn’t delete them — ask and we will.
Community posts and comments stay when you delete your account. Delete them on the community page first, or ask and we will.

Write to us

A question about any of this, a problem, or just hello: it goes to the person who runs Deckle, and you don’t need an account. Leave your email if you’d like an answer.

Your message, and your email if you give it, reaches the person who runs Deckle as a support message, with a copy on their own X3, and is kept so we can answer it (more under Deleting things). To stop floods, Deckle counts messages a day under a scrambled form of your internet address. Signed in to Deckle? You can also write from the app (the account menu, then Contact); a message from there says which account it came from, so we know who to answer. If the installer stops, it offers to send what happened the same way: what the page said, your browser, and the last lines of its log. It goes only if you press Send, you can read all of it first, and the chip’s MAC address is left out.

What Deckle keeps, and who sees it.