Privacy Policy

Effective 14 October 2026

Coconut Desk (coconut.asia), run by Aneeshan Tyagarajah ("we", "us"), is a dashboard for keeping a coconut farm's harvests, payments, costs and plans. This policy explains what information it collects, how it is used and the choices you have. Questions: aneeshant14@gmail.com.

How Coconut Desk uses Google user data

Coconut Desk uses Google Sign-In only to let you sign in. This section sets out exactly what Google user data the app receives and what happens to it.

Data accessed

When you sign in, Coconut Desk requests only the openid, email and profile scopes. Through them it receives your name, email address (and whether Google has verified it), profile picture URL and your Google account identifier. It does not request or receive any other Google data: no Gmail, Google Drive, Calendar, Contacts or other Google services, and never your Google password.

Data usage

• Your email address identifies your account and decides which farms you can open: a farm's owner shares a farm by adding your email address.
• Your name and profile picture are shown on your account page and to identify you in the app.
• Your Google account identifier links your sign-ins to the same account.

Google user data is not used for advertising, is not sold, and is not used to train artificial intelligence or machine-learning models.

Data sharing

Your email address is visible to the owner and members of any farm you belong to, so they can see who has access. Your Google user data is stored by our hosting and database providers (DigitalOcean and MongoDB) only to run the app on our behalf. It is not shared with anyone else, except where required by law.

Data storage and protection

The data is stored in the app's database on servers run by our hosting provider and is only sent over encrypted (HTTPS) connections. Only the app's operator can access the database. Sign-in sessions are kept in a secure, HttpOnly cookie, and access to every farm is checked on each request.

Data retention and deletion

Your Google user data is kept while you have an account. To delete your account and all of your Google user data, email aneeshant14@gmail.com; we delete it within 30 days, and it disappears from backups as they expire (within 12 months). You can also remove Coconut Desk's access to your Google account at any time at myaccount.google.com/connections.

Coconut Desk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information we collect

From your Google account

You sign in with Google. With your permission, Google shares your name, email address, profile picture and a Google account identifier, and confirms your email address is verified. We ask only for these basic profile details (the openid, email and profile permissions). We never see your Google password and have no access to your Gmail, Drive, contacts or any other Google data.

What you and your farm's members enter

The farm records you add: harvests and nut counts, grades and prices, payments, husk and other sales, expenses, tree counts, tasks and planner settings, plus the name and location of each farm and the email addresses of the people you share it with. A farm's location is used only to show its weather and rainfall. A farm can also keep its estate workers' names with the days they worked and what they were paid, from the farm's wages sheets; identity numbers and bank details are not kept.

Bills and statements you upload

An owner or editor can upload a photo or PDF of a bill, receipt or statement to have it read into draft records. The file is sent to Anthropic, whose Claude AI reads it and returns draft records to the page for the person to check and edit. Coconut Desk does not keep the file: it is held in memory only while it is being read, and only the records the person chooses to post are saved, like records entered by hand. When many past documents are imported at once, each file is stored with Anthropic until it has been read (and is deleted automatically after 3 days at most), and the draft records are kept by Coconut Desk until the person finishes reviewing them (30 days at most). Anthropic processes the file only to provide this service, may process it outside Sri Lanka (including in the United States), keeps it only for a limited time under its own policies, and does not use it to train its models. Bills can include other people's names, such as suppliers or workers; upload only documents you are entitled to share.

Collected automatically

• When you last signed in, and when each bot token was last used.
• A sign-in cookie (see Cookies and browser storage).
• Our server records basic technical information about requests (such as IP address and time) to keep the service running and secure.

We do not use advertising, analytics or tracking tools.

How we use it

• To sign you in and show you the farms you belong to.
• To store your farm records and calculate the dashboard's figures, forecasts and reminders.
• To let a farm's owner share it with others and control what they can do.
• To keep the service secure and to make backups so records can be recovered.

Google account information is used only as described in How Coconut Desk uses Google user data.

Who can see your information

• People on your farm. A farm's records are visible to its owner and to everyone the owner adds as an editor or viewer. Members of a farm can see the email addresses of its owner and other members.
• Bots you connect. A farm's owner can create bot tokens. Anything holding a token can read and change that farm's records until the owner revokes it.
• Service providers that run the service on our behalf: our hosting provider (DigitalOcean) and our database provider (MongoDB), which store the data for us, and Anthropic, which reads the bills and statements you upload (see above). They may not use it for anything else.
• Paddle, our online reseller and merchant of record for subscriptions. When you subscribe, you give your payment details, name, email address and billing country directly to Paddle, which handles them under its own privacy policy. We never see or store your card details; Paddle tells us your subscription's status, plan and renewal date and the email address it's linked to.
• When required by law, or to protect the service and its users.

We do not sell your information or share it for advertising.

Other services your browser contacts

To show the dashboard, your browser loads fonts from Google Fonts and the chart library from jsDelivr, fetches weather for the farm's location from Open-Meteo, and shows your profile picture from Google. These services receive your IP address in the usual way when your browser contacts them. When a farm's owner sets its location, the place name they search for is sent to Open-Meteo's place search; if they choose "Use my current location", the browser asks their permission first and the position is used only as the farm's location. Our server reads public coconut auction prices from the Coconut Development Authority's website; no personal information is sent there.

Cookies and browser storage

• Sign-in cookie (coconut_session): keeps you signed in for up to 30 days. It is essential and cannot be turned off; signing out deletes it.
• Sign-in check cookie (coconut_signin): used for up to 10 minutes while you sign in, to protect against forged sign-in attempts.
• Browser storage: a copy of the farm records you open (so the dashboard can show them if the connection drops), the last farm you opened and your light or dark theme. Signing out from the account page clears the farm records from that browser.

How long we keep it

• Sign-in sessions end after 30 days, or when you sign out.
• Your account and your farms' records are kept while you use the service. A removed farm is hidden from everyone, but its records are kept so they can be recovered unless you ask us to delete them.
• Backups are kept for up to 12 months: daily copies for 30 days, then one copy a month.
• Uploaded bills and statements are not kept once read. Draft records from an import of past documents are deleted when the review is finished, or after 30 days.

Your choices and rights

• See and update your farm records at any time in the dashboard, and download a copy of a farm's records (Quick Actions → Download backup).
• Leave a farm, remove people from your farm or remove your farm from the account page.
• Ask us at aneeshant14@gmail.com to access, correct or delete your information, including deleting your account and your farms' records. Deleted data disappears from backups as they expire, within 12 months.
• Remove Coconut Desk's access to your Google account at any time at myaccount.google.com/connections.

Security

The site is only served over encrypted connections (HTTPS). Sign-in cookies can't be read by scripts, bot tokens are stored only as one-way fingerprints, and access to each farm is checked on every request. No system is perfectly secure, so please tell us straight away if you suspect a problem.

Children

Coconut Desk is meant for farm owners and the people who work with them. It is not directed to children under 16, and we do not knowingly collect their information.

Changes

If this policy changes, we will update it here and change the date above. For significant changes we will let you know before they take effect.

Pricing · Refund Policy · Terms of Service · Sign in