Privacy Policy
Version of November 1, 2026
Solid Desk is a private work tool run by Sam Badawi and Solid Finance LLC ("we"). Only people Sam has invited can sign in. This page says what Solid Desk keeps, who sees it, and what is sent elsewhere. We keep it short and plain.
What Solid Desk stores
- Your sign-in: your email address and your role. Sign-in codes are stored only as fingerprints (hashes), never as the code itself.
- Security records: the IP address of each sign-in code request (to stop abuse), your sessions, and wrong-code counts.
- Two-factor sign-in, if you turn it on: the secret shared with your authenticator app, the last code step used, and fingerprints of your recovery codes. We never see your phone.
- Your acceptance of this policy: which version, when, your IP address and your browser's name.
- Sponsor work: deals, offers and counters, deliverables, invoices and payments, tasks, contracts and signed copies, disclaimers, rate cards, and notes.
- Contacts: names, handles, emails and notes for brands, agents and the creator accounts we work with.
- History: a before and after copy of each change to deals, invoices, payments, accounts, contracts and tasks, so a change can be undone.
- Imports: import files and the list of recent imports, so an import can be undone.
- Studio files: analytics exports a seller shares for a valuation, and the last 10 results.
- Post numbers: views, likes and similar public counts of sponsored posts, one snapshot a day. X analytics files are read in your browser and only a short summary is kept.
- Finance: money accounts (name, bank, last 4 digits only, balances, rates and due days), transactions, bills and subscriptions, pay to the owner, category rules and settings. Statements you upload: the transactions in them and the file name. PDF statements are read in your browser and the file never leaves your computer.
- Bank links: the Plaid connection key is stored locked (encrypted) and is never sent to a browser. The Mercury key is a read only key kept as a server secret.
What is sent elsewhere, and why
- Cloudflare runs Solid Desk, its database, and the email that sends sign-in codes. Everything above lives on Cloudflare.
- Anthropic (Claude), only when someone presses the button to read a deal from pasted messages: the pasted text and screenshots are sent to read the deal terms. The messages are saved with the deal. Screenshots are not saved.
- Plaid, only for banks connected through it. You sign in to your bank in Plaid's own window; we never see your bank password. Plaid sends accounts, balances and transactions. Nothing can move money.
- Mercury sends business accounts and transactions to a read only key. Nothing can move money.
- X and YouTube get the IDs of public sponsored posts each night, and send back their public numbers.
- Your browser loads fonts from Google Fonts. Opening a post in the Feed shows X's own embed, which X serves to your browser. Connecting a bank loads Plaid's window.
We do not sell anything about you, show ads, or use tracking or analytics cookies. Two-factor secrets and codes never leave Solid Desk.
Who sees what
| Role | Sees |
|---|---|
| Owner (Sam) | Everything in Solid Desk, plus who has accepted this policy (with time, IP and browser) and who has two-factor on. The owner can turn two-factor off for someone who lost their phone. |
| Finance | The Finance page only: every finance account, personal and business. No deals, invoices, contacts or Studio files. |
| Viewer (for example Michi) | The Finance page only, read only, and only the accounts marked to share with them: what is due, balances, spending and history. No notes, bank links, pay or business accounts. |
Everyone sees their own sign-in and two-factor settings. Nobody sees anyone's secret or codes, the owner included.
Cookies and storage
One sign-in cookie keeps you signed in for 14 days. If two-factor is on, a second cookie lasts 5 minutes during sign-in. Your browser also keeps small preferences, such as light or dark look and saved table views.
How long we keep it
- Sign-in codes and the IP addresses of code requests: 24 hours.
- Sessions: 14 days, or until you sign out. Two-factor sign-in tickets: 5 minutes.
- Two-factor data: until you turn it off, or the owner clears it.
- Work and finance records, history and imports: until they are deleted, or Solid Desk is closed.
- Policy acceptances: kept as a record, for as long as Solid Desk runs.
- Sam keeps backup copies of the database on his own computer.
Your choices
- Ask to see, correct or delete what Solid Desk holds about you by emailing sam@thesolidfinance.com.
- Turn two-factor sign-in on or off any time under Security.
- Sign out any time. When Sam removes your address, you are signed out everywhere.
Changes
When this policy changes, the version date above changes, and everyone is asked to read and accept it again before using Solid Desk.