Privacy

Last updated 10 November 2026.

The Desk Widgets app has no analytics, no telemetry and no crash reporting. Nothing is sent anywhere to tell us that you installed it, opened it or used it. There is no account to create unless you want to publish a widget. This website counts visits, which is described below, and the two are entirely separate: the count cannot see the app, and the app never contacts the website.

What the app does send is simpler to describe: a widget talks to the service it shows you data from, and only once you have added that widget.

What stays on your PC

All of your settings and data are files in your own Windows user folder. They are never uploaded.

Your widgets and their settings
%APPDATA%\DeskWidgets\widgets.ini — which widgets you added, where they sit, your city, your tickers, your GitHub username.
Caches
%APPDATA%\DeskWidgets\cache and %LOCALAPPDATA%\DeskWidgets — the last answer from each service, widget previews, and installed community widgets, so the app works offline and starts quickly.
Passwords you give a widget
Encrypted with Windows DPAPI for your Windows account only. They cannot be read by another user on the PC, and they do not work if the file is copied to another machine.

Deleting a widget stops its requests. Deleting those folders removes everything the app has kept.

Which services each widget contacts

A widget only contacts its service after you add it. Each service sees your IP address, as it would for any website you visit, plus whatever that widget needs to ask for.

Weather
open-meteo.com — the place you chose, as a name and coordinates. No account.
GitHub
api.github.com — the GitHub username you entered. Public data only.
Crypto
api.binance.com — the coin you picked. No account.
Watchlist
query1.finance.yahoo.com — the tickers you entered.
F1 Hub
api.jolpi.ca — the schedule and standings. Nothing about you is sent beyond the request itself.
F1 Timing
livetiming.formula1.com for session data, and api.openf1.org if you choose to connect an OpenF1 account. That account's password is stored encrypted on your PC and sent only to OpenF1.
Gmail
mail.google.com — your Gmail address and the Google app password you created, sent to Google only, to read your unread mail. Desk Widgets never sees your normal Google password, and your mail is never sent anywhere else.

The app itself

Update check
The app asks GitHub for the latest release so it can tell you a new version exists. GitHub sees the request and your IP address.
The widget gallery
Browsing or installing a community widget is a read from our Supabase database. No account is needed, and we keep no record of who installed what.

If you make an account

An account is needed only to publish a widget. It stores your email address, your username, and anything you choose to put in your profile. Sign-in is handled by Supabase, our database provider, which processes your email and password on our behalf.

When you sign in from the app, the access token is stored encrypted on your PC (%APPDATA%\DeskWidgets\account.dat). In a browser it is kept in that browser's local storage, along with your light or dark theme preference and, so the menu doesn't reload on every page, your username and a small copy of your profile photo. Signing out removes them. The site sets no advertising or tracking cookies.

A widget you publish is public: its name, description, source code and author name are shown to everyone. Your email address is not.

This website

This website counts page visits so we can tell a launch post apart from a quiet week, and counts clicks on four things: Download, Microsoft Store, Get, and the prompt Get shows when the app turns out not to be installed. That is the whole list.

The counting is done by GoatCounter, which sets no cookie and stores no identifier for you. It records the page, the referring site, your country, and your browser and screen size, and to tell one visit from another it keeps a hash that is thrown away and regenerated daily. There is no way to follow you from one day to the next, or from here to anywhere else. If your browser sends Do Not Track, the counting script is never loaded.

This applies to the website only. Installing the app from the Microsoft Store means the Store tells Microsoft, under their privacy policy, not ours. Downloading a release from GitHub means GitHub serves that file, under theirs.

What we never do

We do not sell or share your data. We do not build a profile of you, show advertising, or track you across websites. We have no way to see which widgets you use or what any of them display, because that never leaves your PC.

Children

Desk Widgets is not directed at children and does not knowingly collect anything from them.

Changes

If this policy changes, the date at the top changes with it, and the edit is visible in the project's public history.

Contact

Ask anything, or request deletion of an account, by opening an issue at github.com/whoissaaif/desk-widgets/issues.