What we keep, and what leaves

What happens when a customer uses Desk.

Your customer chooses what to share with Desk and can stop sharing at any time. Desk uses the shared screen to guide the customer through the task. Desk does not click, type or act in the customer’s account. No pictures of the customer’s screen are kept.

A screen frame, start to finish

Screens

Desk takes a frame of a customer’s screen when they press for a step or a check, and once more straight after a step is done, to find the next one. The screen share stays open in their browser between presses, but nothing is taken from it, and there is no recording.

Each frame is sent to Anthropic to be read. That is how the next instruction is worked out.

Under Anthropic’s commercial terms, what we send is not used to train its models. Anthropic deletes what it receives within 30 days under its standard policy, or keeps it longer only where the law requires or where it is flagged for misuse. It may process it in any region, and stores it in the United States.

We do not write a frame of a customer’s screen to our database, our files or our logs — there is no place in our schema for one. On our server a frame exists only for the request that carries it.

The customer can see the last frame that was read, in their steps window. That copy stays in their browser, in the page they started from, until they close that page.

What is written down is text, and it can include what was on the screen. We save the instruction the customer was given, the check’s result, and the checker’s own description of what it read. The checker is asked to describe your product’s interface rather than the details on it, and email addresses and long numbers are removed before it is saved; a name or a short figure on the customer’s screen can still end up in it. Where the screen and your documentation disagree, what the screen showed is saved too.

Your material

Files you upload are turned into text when they arrive, and we keep the text, the file’s name and its size. The original file is not stored. A PDF is sent whole to Anthropic, which reads it into text; a Word file or a plain text file is read by our own code.

Help-centre addresses you paste are fetched by our server, and their readable text is stored with the address it came from. A video link is stored as a link and marked not read — Desk does not fetch or read video.

When you ask for workflows, the text of the documents you choose is sent to Anthropic, which drafts them. Every line it quotes is checked against your text and dropped if it is not there, so your workflows hold word-for-word quotes of your material.

All of it is kept as text in our database until you delete it. We use no separate file storage: the help-article screenshots your team keeps are in the same database.

Who can open your desk

A person is on your desk in one of two ways: they started it, or they accepted an invite link. An invite is made by one of your members, or by us for a desk we set up for you. It works for one person, once, within seven days, and can be withdrawn; we store only a scrambled form of it (its SHA-256 hash). Knowing your desk’s address gets nobody in.

Every request for your desk’s material first checks that the signed-in person is a member, except the page of a finished help article that a member has chosen to show on your website, and its pictures. Anyone else gets the same “not found” as an address that does not exist. That check is made by our application on every request; the database itself does not enforce it. The part of the software that does the guiding is handed only the workflow for its session. It reads nothing from the database; the one thing it writes there is a record of any error from our AI provider.

At Alongrail, one account can open our admin page, the founder’s. It lists every desk with its members’ names and email addresses, the titles of its documents and workflows, and each session’s outcome and where it stopped. It does not show the text of your documents, the steps of your workflows or what customers typed, and it has no way into your dashboard: we could only join your desk through an invite link, which would put us on your team list. Whoever holds our database credentials can read every table; they are kept in our hosting provider’s settings and on the founder’s computer.

Signing in

Members sign in with a one-time link, or a 6-digit code from the same email, which works once within 20 minutes, or with Google. A sign-in lasts 60 days. There is no second factor.

Your customers

A customer session asks for no account, no email address, no name and no phone number. The link is the whole of it. We never ask for anything that identifies them. If a customer types an email address, a phone number or a long number, it is removed before the record is saved, and the sentence describing their screen is about your product’s interface, not the details on it.

Our analytics does not run on that page — not started and then told to forget, never started — and nothing is written to the customer’s device beyond what their browser needs to hold the page open.

If a customer follows the “Guided by Alongrail” link on the card at the end of a session, or the “Made with Alongrail” link under a help article shown on your website during your trial, they arrive on our own site, where our analytics does run; the link carries a short code for your desk and nothing about them.

Someone reading a help article you show on your website is asked for nothing. No cookie is set, and our analytics does not run there. Their browser keeps the pictures for up to 10 minutes. Their network address appears in our hosting provider’s request logs, kept for 30 days.

A session record holds: which workflow it was; what the customer typed and which buttons they pressed in the steps window; every instruction and answer they were given; every check result, with the checker’s description of the screen; whether they shared a tab, a window or a whole screen, and its size; how long each step and the session took, and what it cost; how it ended, and where it stopped if it did not finish. We do not store their network address; it appears in our hosting provider’s request logs, kept for 30 days.

You see all of it on your dashboard. Your monthly report repeats some of it by email: questions customers typed, and what their screens showed where they disagreed with your documentation.

Payments

Dodo Payments is the merchant of record. It is the legal seller, it handles the payment and it remits tax. We send it the name and email address of the member who pays, your desk’s id and the pack. Alongrail never sees a card number and never holds one.

Deletion

Any member can delete your desk from its dashboard, after typing its name. Or write to hello@alongrail.com and we will delete it from our admin page.

A desk bought before session packs may still have a monthly subscription; if it does, we cancel it with Dodo Payments first, and if that fails nothing is deleted. Any sessions left in your balance go with the desk; write to us first if an unused pack should be refunded. Then, in one step, we delete your material, your workflows, your help articles and their pictures, every session record with its steps and everything your customers typed, your team’s access and any open invites, your usage counts, your balance and its history, your details, and the start-page visits of members on no other desk. Any error from our AI provider that we recorded and that names your desk has that text removed.

We keep payment records for our accounts: the amount, currency, date, Dodo’s payment id and the kind of payment, with nothing linking them to your desk. We keep your members’ Alongrail accounts; only their access to your desk goes, and each can delete their own account. If we wrote to you before you signed up, we keep our record of that letter, any reply, and what was done on the page we made for you: it is our record of approaching you, not your material.

Outside our control, each for its own time:

• Resend keeps copies of the email we sent you for 30 days.
• Anthropic deletes what it received within 30 days, or up to 2 years if flagged.
• Vercel keeps its request logs for 30 days.
• If you showed a help article on your website, copies of its pictures kept by Vercel’s network and by visitors’ browsers stop being served within 10 minutes; a copy a reader saves themselves is outside our control.
• Neon can restore our database to any moment in the last 6 hours, so a copy exists in that history for 6 hours after deletion. We do not restore from it.
• PostHog keeps the page views recorded on our site, including your dashboard’s addresses, and the events noting which desk’s link someone arrived from, for 1 year on its free plan and 7 years on paid plans.
• Dodo Payments keeps its own record of your purchases under its own policy.

Whoever asked for the deletion gets an email listing all of this.

You can also delete a single document, workflow or session from your dashboard. Deleting one session removes its record — its steps, the text read off the screen and everything the customer typed — and nothing else, so one customer’s record can go on its own. Deleting a workflow deletes every session record under it. Earlier versions of a workflow are kept with it until the workflow is deleted. The dashboard asks first before either. Deleting a document leaves its title, its address or file name, and the sentences quoted from it inside the workflow steps that use them, earlier versions included, until the workflow is deleted.

A help article can be deleted the same way, and its pictures go with it, on our side as well. If it was shown on your website, its pictures stop being served there within 10 minutes.

Deleting your own Alongrail account removes you from every desk. If you are the only member of a desk, it is refused until you delete that desk or invite someone else.

If something goes wrong

What we have: automated checks that the site and its database answer, scheduled every hour on GitHub, which starts some late and skips others, so in practice about 22 a day with an occasional gap of up to five hours; and an alert to us when our AI provider refuses a request for billing reasons. What we do not have: intrusion detection, or a log of who read what. If we learn of a breach affecting your data, we will tell you.

Found a security problem? Please write to hello@alongrail.com with ‘Security’ in the subject.

Where it runs

Our application and our database run in Singapore. Frames, PDFs and text go to Anthropic, which may process them in any region and stores them in the United States. Email goes through Resend and analytics through PostHog, both in the United States. Pages are served from Vercel’s global network.

Who else is in the path

Each service that receives your data or your customers’ data, and what it receives. Where each operates is on the sub-processor list.

What we do not claim

We hold no security certifications, and this page names none. We do not publish customer names or logos. We make no claims about uptime, accuracy or results. When any of that changes, this page changes with it and not before.

For article writing only: what we keep

The help-article maker is the one part of Desk that keeps a picture. Everything above about your customers’ screens is unchanged.