Privacy

What this is

Personal OS keeps a journal, a health log, a ledger and a contact book for one person: you. Everything below is about the account you sign in to, and with one exception nothing in it is shown to other people who use the app.

The exception is chat. A room you join is shared on purpose: the people in it see your name, your picture and everything you write there. Nothing else crosses over — your journal, your ledger, your health log and your contacts stay yours, and being in a room with somebody gives them no way to see any of it.

What is collected

From your Google account, when you sign in: your email address, your display name and your profile picture. Nothing else — no contacts, no calendar, no files.

What you type in: daily logs, journal entries, habits, goals, projects, health measurements, learning notes, career records, and a ledger of accounts, transactions and budgets. If you use the contact book, whatever you record about the people in it, which can include phone numbers, email addresses, birthdays and bank account details.

Pictures you upload, if you add any.

What you write in a chat room, if you use one. The message itself, when it was sent, and which room it was in. It is kept in the MongoDB database — the same one as the record below, not the main one — and unlike that record it does not expire: a conversation that quietly deleted itself would be a bug, not a policy.

Everyone in the room can read it for as long as the room exists. Taking somebody out of a room does not unsend what they already read. You can recall one of your own messages, which removes the text for everyone; that the message was there stays visible.

What a room sends to Google is small, but it is not nothing. Rooms update by themselves through a Firebase service. What travels there is a counter and a clock, addressed by a key that is not the room's name — enough to say "this room changed" — and, while you are typing, your account id and the moment, so the others see that someone is writing. That key is replaced whenever somebody is removed from a room.

Notifications carry a preview. If the people in a room have notifications on, a new message reaches their phones as the sender's name and up to its first 140 characters. On the way it passes through Firebase Cloud Messaging (Google) and the push service of the browser receiving it — Apple, Google or Mozilla. Turn notifications off and nothing is sent this way.

Sticker packs you upload can be shared. Anyone you share a pack with sees its name and pictures, and can pass it on. The pictures are kept by Cloudinary and the pack by MongoDB. If you report a pack, which pack and that it was you are kept so the report can be looked at.

GIFs and stickers from GIPHY, if you search for them. The words you search for go from this app's server to GIPHY. The pictures then load in your browser straight from GIPHY, which therefore sees your IP address and browser, as any site serving an image does.

Link previews. When a message contains a link, this app's server opens that page once to draw a preview. The site sees a request from the server, not from you.

Weather, if you let the app use your location. Your position, rounded to about a kilometre, is sent from the server to Open-Meteo to read the current weather. It is not stored.

Paying a contact. The transfer link puts the account number, the amount and the note into an address at VietQR, which hands them to your bank's app.

Limits against abuse. To stop somebody hammering sign-in or flooding a room, a counter keyed by your IP address or your account id is kept in Upstash. It expires on its own within an hour.

Error reports. When something breaks, a report — what failed, on which page, and a request id — goes to a Telegram chat read by whoever runs this. If deleting an account does not finish, that report carries the account's id and sign-in name so the rest can be removed by hand.

Cookies. One cookie keeps you signed in. Firebase sign-in, and Analytics where it is on, keep their own entries in your browser. There are no advertising cookies.

A record of what changed, if this deployment keeps one: the moment, what kind of change it was — a transaction deleted, a person added — which row it was about, and, for the fields it follows, what they held before and after. Each time you signed in or out is in there too, with the browser and system you used — "Chrome · Windows", read from what your browser tells every site it visits and kept only in that shortened form — and roughly where from, as a city and a country. That place is worked out from your IP address while the request is arriving, and the address itself is not kept in this record: what stays is "Hà Nội, VN" and nothing narrower. Both are there so that a sign-in you did not make is something you can spot, which needs the device and the place to be nameable. The rest is kept so you can see what happened to your own data, which is the point of showing an amount going from one figure to another.

What it follows is a fixed list per kind of record: amounts, dates, names, categories, and the like. It never holds the text of a journal entry, a note or your daily log, and a bank account number appears only as its last four digits. This record lives in a MongoDB database rather than the main one, it expires on its own after 90 days, and deleting your account erases it.

How the pages are used, if this deployment has measurement switched on. Three things measure, and they are not alike.

Google Analytics for Firebase records which pages were opened, and it does so under an identifier it stores in your browser. That identifier is what lets it tell one visit from the next, so unlike a plain page counter it does build a profile across visits — which pages, how often, from roughly where (worked out from your IP address), on what kind of device. Google is the one holding it, under their own terms. It cannot see anything you typed: a page address, never the contents of a journal entry or a transaction.

Vercel Speed Insights records how quickly pages loaded. It uses no identifier, builds no profile and sees nothing you typed.

Firebase Performance Monitoring records how long each page took to appear and how long each request took. It sends the page address and the request address, not anything typed into a page, and it leaves the query string off. Google holds those timings.

Where measurement is off, nothing is sent and no script is loaded.

What you write in, if you use the contact form. The note, the page you were on, and either your account name or the address you gave for an answer, are passed to a Telegram chat read by whoever runs this. Nothing is stored here: the note is forwarded and no record of it is kept in the database. Don't put a password in it — nothing ever needs one.

Nothing else. There is no advertising, nothing sold to anyone, and no third-party script reading what you write.

Where it is kept

• The database is hosted by Neon, in the United States.
• Chat, sticker packs and the record of what changed are held by MongoDB Atlas.
• The app runs on Vercel.
• Abuse-limit counters are held by Upstash.
• Pictures are stored by Cloudinary.
• Page measurements, where they are on, go to Google.
• Speed measurements, where they are on, go to Vercel.
• Page and request timings, where they are on, go to Google.
• Notes sent through the contact form, and error reports, go to Telegram.
• Sign-in is handled by Google Firebase, which verifies who you are. Your password, if you have one with Google, is never seen by this app.
• Notifications pass through Firebase Cloud Messaging and your browser's push service.
• GIF searches go to GIPHY; weather lookups go to Open-Meteo.

What you write in a chat room is locked before it reaches that database. It is encrypted with a key the app holds, so a copy of the database on its own — a backup, an export, or whoever runs the machines it sits on — reads as nothing.

Because the app holds the key, this is not end-to-end encryption: whoever runs this app can read what you write in a room. If that matters for something you were about to say, do not say it here.

Data therefore leaves Vietnam and is processed in the United States.

The AI features

When you use the capture box, the review chat or the assistant, the text you wrote is sent to a separate service run alongside this app, which passes it to a language model to be read and turned into entries. Only the text you typed for that request is sent — not your ledger, not your health log, not your journal.

If the AI features are switched off for this deployment, nothing is ever sent anywhere for this purpose and every screen still works by hand.

How long it is kept

Until you delete it. There is no automatic expiry and no archive: a deleted transaction is gone from the database, and a deleted account takes everything with it.

Chat is the one exception, and it is worth reading twice. What you wrote in a room stays in that room after you delete your account, because it is part of somebody else's conversation and taking it out would leave holes in a record that was never only yours. Your name comes off it — nothing points back at you any more, and it can no longer be found by looking for you — but the words remain. If that is not what you want, recall those messages before you delete the account; recalling removes the text for everyone.

What you can do

• Take it with you. Settings → Data exports everything as JSON or CSV, at any time, without asking anyone.
• Delete it. Settings → Delete this account removes the account and every record under it — including the pictures held by Cloudinary — and takes your name off anything you wrote in a chat room. Your sign-in record at Google Firebase (your email, name and picture) is not part of this app's data and stays with Firebase. You are signed out at once and the erasure runs straight after, usually within a minute or two. If any part of it fails, whoever runs this is told exactly what is left and removes it by hand. It cannot be undone. See above for what chat keeps.
• Correct it. Every record in the app can be edited in the app.

Getting in touch

Exporting your data and deleting your account are both in Settings and need nobody's permission, so most of what this page grants you is already a button. For anything else — a question about the above, or a request you cannot carry out yourself — there is no channel set up on this deployment yet. Whoever runs it has to add one.