Privacy Policy

1. Overview

MyOwnLifeOS ("we," "our," or "the Service") is a consent router for cross-app intelligence. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

Core principle: MyOwnLifeOS is not a data store. We do not store your emails, meeting notes, diagrams, transcripts, code, calendar events, or any content from the applications you connect. We store only the minimum routing metadata needed to enable cross-app features.

2. Information We Collect

2.1 Account Information

When you sign in via Google OAuth, we receive and store:

• Your Google account identifier (a unique, opaque "sub" claim)
• Your email address
• Your display name
• Your profile picture URL

This information is used solely to identify you within the Service and is never shared with third parties.

2.2 Connection Metadata

When you choose to link an application (e.g., inbox0, Summarizer, DrawmaticAI) to MyOwnLifeOS, we store:

• The name of the connected application
• The endpoint URL of the connected application
• A cryptographic hash of the API key used for app-to-app authentication
• The timestamp when the connection was established

We never store the plaintext API key — only its SHA-256 hash. Connections are opt-in and default to OFF. You can sever any connection at any time.

2.3 Session Data

We maintain server-side sessions to keep you signed in. Session tokens are SHA-256 hashed before storage. Sessions expire automatically after a period of inactivity.

2.4 Invite Tokens

If invite-only signup is enabled, we store invite tokens associated with specific email addresses. These tokens expire after 7 days and are single-use.

2.5 Analytics

We use Amplitude for basic page-view analytics (page URL, page title, and app identifier). No personally identifiable information is sent to Amplitude beyond what is inherent in a page-view event. You can block this by using a browser extension or content blocker.

3. What We Do NOT Collect

MyOwnLifeOS does not collect, store, or process:

• Email content or metadata from inbox0
• Meeting notes, transcripts, or summaries from Summarizer or OwnScribe
• Diagrams or diagram XML from DrawmaticAI
• Code or code reviews from owncodereviewer
• Calendar events from Almanac
• Weekly review content from Weekly
• Gopher search queries or results
• Pomodoro timer session content
• Any content generated by or stored within connected applications

4. How We Use Information

We use the limited information we collect exclusively for:

• Authenticating your identity and maintaining your session
• Routing cross-app queries between applications you have explicitly connected
• Enforcing invite-only signup (when enabled)
• Basic operational analytics (page views)

We do not use your information for advertising, profiling, automated decision-making, or any purpose beyond operating the Service.

5. Cross-App Queries

When you use a feature that queries connected applications (e.g., the Pomodoro timer fetching suggested tasks), MyOwnLifeOS acts as a real-time relay:

• We query the connected application on your behalf using a short-lived JWT token
• The response is forwarded to you immediately
• We do not cache, store, or log the content of these queries
• Each query is ephemeral — forgotten as soon as the response is delivered

6. Data Storage and Security

All data is stored in a local SQLite database on the server that hosts MyOwnLifeOS. The database uses WAL (Write-Ahead Logging) journal mode for reliability.

We implement the following security measures:

• All connections require HTTPS (enforced via HSTS)
• Session tokens are SHA-256 hashed before storage
• API keys are stored as SHA-256 hashes, never in plaintext
• Cross-app authentication uses signed JWT tokens with short lifetimes
• CSRF protection via double-submit cookie pattern
• Content Security Policy headers on all pages
• OAuth state parameter verification to prevent CSRF during login

7. Data Retention

• Account data: Retained until you request deletion or your account is removed
• Connection metadata: Retained until you unlink the application
• Session tokens: Automatically deleted upon expiry or logout
• Invite tokens: Automatically expire after 7 days; marked as used upon redemption
• Cross-app query content: Never stored — ephemeral by design

8. Your Rights

You have the right to:

• Access the personal data we hold about you (via the /api/whoami endpoint or by contacting us)
• Request deletion of your account and all associated data
• Unlink any connected application at any time
• Decline to connect any application (all connections are opt-in, default OFF)
• Use any connected application independently without MyOwnLifeOS

To exercise these rights, contact us at the email address listed in Section 10.

9. Third-Party Services

MyOwnLifeOS integrates with the following third-party services:

• Google OAuth: Used exclusively for sign-in. We request only openid, email, and profile scopes. Google's privacy policy applies to the OAuth flow itself.
• Amplitude: Used for anonymous page-view analytics. Amplitude's privacy policy applies to data processed on their platform.
• Google Fonts: We load IBM Plex Sans and JetBrains Mono fonts from Google Fonts CDN for page rendering.
• jsDelivr CDN: Used to load Mermaid.js for ecosystem diagrams.

We do not sell, rent, or share your personal data with any third party.

10. Contact

For privacy-related inquiries, data access requests, or account deletion requests, contact:

Email: [email protected]

Operator: Ovais Quraishi

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via a notice on the Service. Continued use of the Service after changes constitutes acceptance of the updated policy.