Privacy Policy

Who is responsible

Leonardo Bork is the person responsible for your data (the “controller” under Brazil’s LGPD). You can reach me at leonardomerker@gmail.com. I answer personally.

What I collect

• Account: your email address, name, time zone, and language.
• Your content: what you put in Self OS, such as captures, next actions, projects, goals, people, notes, reviews, and tags.
• Sign-in and access: one-time sign-in codes, a session cookie, and the API keys and connector authorizations you create for AI agents. Keys and tokens are stored as hashes.
• Google Calendar, if you connect it: your Google account email, the list of your calendars, and your events (title, time, description, organizer, attendees, meeting links, and recurrence) from the last 90 days to the next 180 days.
• Wispr Flow, if you connect it: the meeting notes and transcripts you choose to import.
• Technical data: IP address, browser or app version, and request logs, kept by the hosting provider for security and troubleshooting.

There are no ads, no analytics or tracking scripts, and no marketing cookies. The only cookie keeps you signed in.

How I use it

• To run the service: show, sync, and organize your items, and keep your account secure.
• To provide the AI features you use, such as capture suggestions, meeting briefings, and the Staff assistant. These run on open models hosted by Cloudflare Workers AI. Your data is sent only to produce the answer you asked for and is not used by me to train any model.
• To send the sign-in codes you request. I do not send newsletters or marketing email.

Legal bases (LGPD): performance of the service you signed up for, your consent for each optional integration, and legitimate interest for security and abuse prevention.

Google user data

Connecting Google Calendar is optional. Self OS requests read-only access (calendar.events.readonly and calendar.calendarlist.readonly, plus openid and email to identify the account). It never creates, changes, or deletes events in Google.

Calendar data is used only to show your agenda inside Self OS, link events to your people, projects, and meeting notes, and generate the meeting briefing you open. It is not sold, not used for advertising, not used to train AI models, and not shared with anyone except the infrastructure provider needed to run the feature. No person reads it unless you ask me to for support, it is needed for security, or the law requires it.

Self OS’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you disconnect Google Calendar in Self OS, the Google credentials and generated briefings are deleted. You can also revoke access at any time in your Google Account permissions.

Who else handles your data

• Cloudflare hosts the site, the app, the database, the AI models, and sign-in email delivery.
• Google and Wispr Flow, only if you connect them, to fetch your data from those services.
• AI agents you connect (for example ChatGPT, Claude, or your own scripts) receive what you authorize through your API keys or connector permissions. Their own privacy policies apply to what they do with it.

I do not sell or rent personal data. I would disclose data only if required by law.

Storage, transfer, and security

Data is stored on Cloudflare infrastructure, which may be located outside Brazil. Connections use HTTPS, credentials for third-party services are encrypted, and API keys are stored as hashes. Each account’s data is isolated from other accounts. No system is perfectly secure; if a breach affects you, I will tell you and the authorities as the law requires.

How long I keep it

Your data stays while your account exists. Sign-in codes expire after 10 minutes. If you ask me to delete your account, I delete your data within 30 days; backups held by the hosting provider expire shortly after. Some records may be kept longer only when the law requires it.

Your rights

Under the LGPD (and the GDPR, if it applies to you), you can ask to access, correct, export, or delete your data, learn who it is shared with, and withdraw consent for an integration. You can export everything yourself from the app in JSON or Markdown and disconnect integrations at any time. For anything else, including deleting your account, email leonardomerker@gmail.com. I will reply within 15 days. You can also complain to Brazil’s data protection authority (ANPD).

Children

Self OS is not intended for people under 18, and I do not knowingly collect their data.

Changes

If this policy changes, I will update the date at the top. For significant changes, I will also tell account holders by email or in the app before they take effect.