Founder OS — Privacy Policy

Founder OS is a single-user application that runs on one Mac. It reads Gmail and Google Calendar read-only, processes everything locally, and sends data to no one.

Last updated 23 August 2026

1. Who this covers

Founder OS is a personal project built and used by Aadwik Malhotra. It has one user, no accounts, and no sign-up. It is not offered as a product or service to anyone else. This policy describes what the application does with data from the Google Account that authorizes it.

2. Google data it accesses

Founder OS requests two Google OAuth scopes. Both are read-only.

• https://www.googleapis.com/auth/gmail.readonly
• https://www.googleapis.com/auth/calendar.events.readonly

It requests no write, send, modify or delete permission of any kind. Founder OS cannot send email, cannot alter or delete messages, and cannot create, change or remove calendar events.

3. What it reads from Gmail

Founder OS does not read the mailbox. It runs one narrow search — messages from the last 30 days, excluding drafts, matching job-search terms such as application, interview, assessment, recruiter and offer — and reads only the matching messages.

For each matching message it retrieves:

• the message and thread identifiers;
• the From, To, Subject and Date headers;
• the short preview snippet Gmail generates;
• label identifiers and the message’s received timestamp.

Messages are requested in metadata format. Full message bodies are never requested, received, or stored. Attachments are never accessed.

4. What it reads from Google Calendar

Events on the authorizing account’s own calendar, in a window from four days before today to roughly eight weeks ahead. Recurring series are expanded into individual occurrences so that a specific upcoming meeting can be identified.

For each event it retrieves:

• the event and recurring-series identifiers;
• title, start and end time, and status;
• the organizer’s name and email address;
• the number of attendees, and the authorizing user’s own RSVP response — never other attendees’ identities or responses;
• location, conference link, and event type where present.

5. Where data is stored

On the user’s own computer, and nowhere else. Google data is fetched directly from Google’s APIs to that machine, normalized into local JSON files, and used to derive notes in a local Obsidian vault on the same disk.

There is no Founder OS server, no hosted database, no cloud storage, and no backend. No Google data is transmitted to this website, to its hosting provider, or to any other system. This page is a static document and receives nothing.

6. How the Google credential is stored

Authorization produces an OAuth refresh token. That token is stored in the macOS login Keychain, under the service name com.aios.founder-os — encrypted at rest and protected by the user’s macOS login. The OAuth client identifier and secret are stored the same way.

The refresh token is never written to a source file, a configuration file, the Obsidian vault, a log, a diagnostic report, or any version-controlled repository. Every diagnostic message the integration produces is passed through a redaction step that strips credential-shaped strings before the message can be printed or saved. Short-lived access tokens are held in memory for the duration of a single refresh and never persisted.

7. How the data is used

Solely to present the authorizing user with their own state: which conversations are awaiting a reply from them, which are awaiting a reply from someone else, what is scheduled, and what has gone stale. The processing is deterministic and runs locally.

Google user data is not used for advertising, not used to train any machine learning or AI model, not used for analytics or profiling, and not used to build any credit, identity or scoring product.

8. Sharing and sale of data

Google user data is never sold. It is never shared, transferred or disclosed to any third party — no service provider, no analytics vendor, no advertiser, no AI or machine learning provider, and no human other than the authorizing user. Because the application has no server, there is no mechanism by which such transfer could occur.

9. Limited Use

Founder OS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Retention and deletion

Local evidence files hold only what the searches above return, and each refresh replaces the previous contents for that source. Data persists on the user’s machine until they delete it, which they can do at any time by removing the local files or the application.

Access can be withdrawn at any time, in either direction:

• revoke Founder OS at myaccount.google.com/permissions, which invalidates the refresh token immediately; and
• run pnpm google:auth --revoke, which deletes the stored credential from the macOS Keychain.

After revocation Founder OS can no longer read anything, and reports the source as unavailable rather than presenting stale data as current.

11. Security

All communication with Google uses HTTPS. Credentials live only in the macOS Keychain. Free-text content read from any source is scanned for credential patterns before storage, and any record containing what appears to be a secret is discarded rather than saved. The application is read-only with respect to every Google service it touches.

12. Children

Founder OS is not directed at children and has no users other than its author.

13. Changes

If what the application reads or stores changes, this page changes with it, and the date at the top is updated.

14. Contact

Aadwik Malhotra — aadwikmalhotra@gmail.com. See also the Founder OS homepage.