Privacy Policy

Application and operator

Personal Operating System MVP is a private, single-user personal coordination application. It does not offer public signup or multi-user access. Questions about consent or data use may be sent to [email protected].

Google permission and Calendar boundary

The application requests exactly this Google OAuth scope:

https://www.googleapis.com/auth/calendar.events.owned.readonly

That Google permission can authorize read access to events on calendars the account owns. The application applies a narrower product boundary: its server hard-codes the literal primary Calendar and does not offer a Calendar picker, alternate Calendar identifier, or Calendar write operation.

Calendar information used

For a bounded 15-local-date window beginning on the owner’s current local date, the application may receive only these approved event fields from the owner’s primary Calendar:

• event and recurring-event identifiers;
• summary, status, start, end, and location;
• last-updated time and entity tag; and
• a page token used only to finish the same bounded foreground request.

Provider identifiers are hashed before they are stored in the accepted normalized projection. The information is used only to render permitted commitments in the owner’s Today and Schedule views and to report local source health and freshness.

Local storage and credential handling

The Calendar refresh credential is encrypted for storage in the owner’s local application database. Short-lived access credentials are used in memory during a bounded owner action and are not intentionally persisted. The normalized Calendar projection, refresh receipts, freshness state, and sanitized operational metadata are also stored locally for the owner.

When refresh occurs

Calendar reads occur only in the foreground:

• when the owner selects the manual Refresh control; or
• once when the owner opens Today or Schedule while the existing Calendar projection is stale.

Adjacent page opens are coalesced into one refresh. There is no timer, poller, watcher, scheduler, notification agent, autonomous retry, or background refresh. If refresh fails, the last good local projection is retained and freshness moves away from Current.

Owner controls and deletion

The application presents distinct owner controls to disconnect Calendar access, delete the locally encrypted Calendar credential, and delete locally imported Calendar data. The owner may also revoke the Google grant through Google Account settings. Local cleanup does not silently perform a Google project-wide revocation.

Sharing, advertising, and other Google services

Calendar information is not sold, used for advertising, shared publicly, or sent to third-party analytics. This milestone does not send Calendar event content to an artificial intelligence service. The application does not access Google Drive and does not use Google Calendar write permissions.

Retention and security

The local Calendar projection remains available until it is replaced by a successful refresh or deleted by the owner. Locally stored credentials remain encrypted and are removed through the applicable owner control or superseded during a successful reconnection. The application uses bounded requests, exact-owner access checks, request-forgery protection, hashed provider references, and atomic projection replacement to limit exposure and protect local state.

Policy changes

If the application’s Google data use materially changes, this policy will be updated before that change is used. The current policy does not authorize Drive access, another Calendar, Calendar writes, public accounts, or background collection.