What data leaves my site when I install the widget?

Good question — here is exactly what data leaves your site when you install the DeskCrew widget. **What the widget sends (the short version):** When a visitor loads a page with your DeskCrew widget, one request goes out to `https://deskcrew.io/desk.js`. That request carries two identifiers: your **public widget key** (`data-key` attribute) and your **board slug** (`data-board` attribute). These tell DeskCrew which workspace the widget belongs to — nothing more at load time. **What the widget does NOT send at load time:** - No visitor cookies, no browser fingerprinting, no tracking scripts - No page content, no form data, no DOM scraping - No third-party analytics (no Google Analytics, no Facebook pixel, no tracking pixels of any kind are injected by DeskCrew) - The widget runs inside a Shadow DOM — it is isolated from your page's JavaScript and cannot read your site's data **What is sent when a visitor actually uses the widget:** Only when a visitor types a message and hits send does conversation data leave your site: - The message text they typed - A session identifier (so the conversation thread stays connected if they come back) - Timestamp and widget version metadata That's it. The conversation data is transmitted over HTTPS, stored tenant-scoped (your workspace cannot see another workspace's data, and vice versa), and is only accessible to your team through the DeskCrew dashboard. **What you control on the Install page:** - **Allowed origins** — You specify exactly which domains the widget is allowed to load on. If someone copies your embed snippet to another site, the widget will not activate unless that domain is on your allowlist. This is set in Dashboard → Install → Allowed origins. - **Widget appearance** — Brand color, logo, position. These are cosmetic and don't change the data flow. **What the widget does on your server (zero):** The widget is a client-side script. It does not install anything on your server, does not access your database, and does not modify any files. It's a single `<script>` tag that loads a chat interface in the visitor's browser. **For compliance/DPA needs:** If you need a Data Processing Agreement (DPA) or have specific GDPR/data-residency questions, reach out to the DeskCrew team through support or check the Privacy page linked in the footer. The platform is designed so that the only customer data it holds is the conversation content your visitors choose to send. Hope that gives you the full picture. Let me know if you need more detail on any specific part of the data flow.