Scuffed OS Privacy Policy

Effective date: October 6, 2026

Scuffed OS is a personal assistant application operated by Dylan Schempp (“we,” “us”). It combines tasks, calendar, habits, nutrition, notes, email, school coursework, finances, a personal CRM, and connected health data behind a single AI assistant. Scuffed OS is a self-hosted application: in the current deployment, the operator and the sole user are the same person, and there are no third-party user accounts.

This policy describes what data Scuffed OS stores, how it is used, and which service providers process it. It applies to the Scuffed OS application and any data obtained through connected services such as WHOOP, Gmail, Moodle, Plaid, and macOS Contacts.

1. Information we collect

Information you enter directly. Tasks and reminders, calendar events, habit definitions and completions, nutrition logs (meals and water), notes and “second-brain” memories, file attachments, and your messages to the assistant (typed or dictated).

Derived information. Whenever memory is enabled (it is on by default, in every domain, with no separate opt-in), every assistant turn is passed through a memory pipeline: your message and the assistant’s reply are embedded as vectors, a model extracts short factual “memories” from them (for example, a stated preference or goal), and those memories are stored with embeddings of their own so the assistant can recall relevant context later. Stored memories are searched and pasted into the assistant’s context on every subsequent turn. The assistant’s tool results, meaning the domain rows it read to answer you, are not put through this pipeline; what you typed and what it wrote back are. Section 3 names the providers this reaches. Conversation history with the assistant is also stored so conversations can resume.

Connected service data (with your consent). Scuffed OS reads data from an outside service only if you connect that service yourself. Each one is covered in full in its own section below.

WHOOP. If you connect a WHOOP account, Scuffed OS retrieves your WHOOP data via the official WHOOP API after you authorize access through WHOOP’s OAuth flow. Depending on the scopes you grant, this may include basic profile information, recovery scores, sleep data, strain and workout data, and related physiological measurements such as heart rate. See Section 4.

Gmail. If you connect a Gmail account, Scuffed OS reads your inbox messages via the Gmail API after you authorize access through Google’s OAuth flow (read plus the modify/send scopes); it stores email metadata (sender, subject, snippet, and an AI-derived category and summary) but never the message bodies. Beyond reading, Scuffed OS acts on your mailbox only when you take an explicit action: sending, replying, forwarding, moving a message to Trash, starring, marking read/unread, or applying a label. See Section 4a.

Moodle. If you connect a Moodle (school learning-management) account, Scuffed OS reads your course information via the Moodle web-services API after you sign in to your school’s Moodle site in your browser, using Moodle’s own mobile-app sign-in handoff, which passes only web-service tokens back to the app (only the access token is stored, and Scuffed OS uses it read-only); or after you paste in an access token you obtain from that site. Either way, Scuffed OS never sees your school username or password. Access is read-only, and it stores course names, assignment due dates, assignment and grade metadata, and short announcement and notification summaries, but never assignment files or the full text of course content. See Section 4b.

Plaid (banks & Coinbase). If you connect a bank or Coinbase account, Scuffed OS retrieves your financial data read-only through Plaid after you authorize each institution through Plaid’s own hosted link flow; it stores account names/masks/types, balances, transaction metadata, and investment holdings (including crypto), plus recurring subscription and bill streams; liabilities (loan and credit-card statement balances, minimum payments, next-payment due dates, and APRs); and investment transaction history. It never stores your bank/Coinbase credentials. See Section 4c.

macOS Contacts. If you enable macOS Contacts, Scuffed OS reads your local Contacts (AddressBook) database read-only after you grant the app Full Disk Access and acknowledge the storage disclosure; it stores contact names, phone numbers, email addresses, organization and job title, and contact photos. It never writes back to your Contacts, and sends Contacts to no third-party Contacts API; contact fields reach Anthropic when something you ask the assistant makes it look someone up or edit their CRM entry, and conversation text about a contact also passes through the memory pipeline described above. See Section 4d.

What we do not collect. Scuffed OS contains no advertising, no third-party analytics, and no tracking technologies. Scuffed OS does not collect data about anyone other than the user of the app except the contact details you choose to import from your own macOS Contacts (names, phone numbers, email addresses, organization/title, and photos) if you enable that connector. Those describe people you already have in your own Contacts, and are used only to power your CRM, to answer your own assistant requests about those people, and (in a future slice) messaging features. We do not sell, share, or otherwise use imported contact data for any purpose beyond your own use of the app.

2. How we use information

Data is used solely to provide the app’s features:

• Displaying and managing your tasks, calendar, habits, nutrition, and health data.
• Powering the AI assistant: answering questions, taking actions you request, and personalizing responses using stored memories.
• Generating short coaching cards from deterministic fitness signals.
• Generating local reminders and notifications on your device.

We do not sell personal data, share it for advertising or marketing, or use it for any purpose beyond operating the app.

3. Service providers

Scuffed OS sends data to a small set of service providers, each for a specific function:

Anthropic and OpenAI process API data under their published API data-usage policies, which (as of the effective date) state that API inputs and outputs are not used to train their models.

If you use voice dictation, audio is processed by your browser’s built-in speech recognition, which may involve the browser vendor’s speech service under that vendor’s privacy policy. Only the resulting text transcript reaches Scuffed OS.

File attachments and the memory change-history database are stored locally on the machine running the app, not with any cloud provider. Notifications are generated locally on the backend host.

4. WHOOP data

If you choose to connect WHOOP:

• Data is retrieved only after you explicitly authorize Scuffed OS through WHOOP’s OAuth consent flow, and only for the scopes you grant.
• WHOOP data is used solely to display your health metrics within Scuffed OS and to let the assistant answer your questions about them. It is never sold, never shared with third parties for their own purposes, and never used for advertising.
• WHOOP data may be included in assistant context sent to Anthropic when you ask the assistant about your health data (Section 3). Separately, after a scored recovery sync, Scuffed OS may send the deterministic facts for fired fitness rules (for example, recovery percentage, sleep duration, strain, or a computed delta) to Anthropic to phrase short coaching cards. Raw snapshot rows are not sent as a bulk dataset, and local template wording is used if the model is unavailable.
• Memory, and the one other provider. Your synced WHOOP rows go to no provider other than Anthropic, but a conversation about them does not end with that turn. Every assistant turn runs through the memory pipeline described in Section 1 and Section 3: the text of your message is embedded by OpenAI before the reply, and your message together with the assistant’s reply is embedded by OpenAI again afterwards and passed to Anthropic for fact extraction. The health rows the assistant read are not part of this (tool results never reach the memory pipeline), but a recovery score, a sleep duration, or anything else about your health that appears in what you typed or in what the assistant wrote back does reach OpenAI as text to embed, and can be extracted into a stored memory that is sent to Anthropic again on a later, unrelated turn.
• You can revoke Scuffed OS’s access at any time from your WHOOP account settings or by disconnecting WHOOP within Scuffed OS. Upon disconnection or request, stored WHOOP data and access tokens are deleted within 30 days.

Scuffed OS is an independent application and is not affiliated with, endorsed by, or sponsored by WHOOP.

4a. Gmail data

If you choose to connect Gmail:

• Access is granted only after you explicitly authorize Scuffed OS through Google’s OAuth consent flow, and covers read plus the modify/send scopes (gmail.readonly, gmail.modify, gmail.send). You can review and revoke this access at any time from your Google Account’s security settings.
• Scuffed OS reads your inbox messages to display them and to triage them. For each message, the sender, subject, preview snippet, and a bounded plain-text body excerpt (~2 KB) are sent to Anthropic to classify the message (needs-reply vs. FYI) and generate a short summary. Only the derived category and summary (never the message body) are stored.
• Message bodies are not stored. The inbox list and AI summaries live in the database; the full body of a message is fetched live from the Gmail API only when you open that message, and is never written to disk.
• Beyond reading, Scuffed OS acts on your mailbox only on your explicit action. You can send a new message, reply, or forward; move a message to Trash; star or unstar it; mark it read or unread; and apply or remove labels. Every one of these actions happens only when you click the corresponding control; nothing is automated.
• AI-drafted replies are generated only when you ask for one, using the instructions and any notes you type into the compose box at that moment. A draft is never generated automatically (not on opening a message, not on sync). Draft text is never stored server-side; it exists only in your compose box until you send it or discard it.
• Outbound mail is sent through Gmail itself. When you send, reply, or forward, Scuffed OS submits the message to the Gmail API using your own authorized account; Gmail delivers it, and it appears in your Gmail Sent folder exactly as if you had sent it from Gmail directly.
• Memory, and the one other provider. Asking the assistant about your mail (“summarize this thread,” “draft a reply saying I can’t make Thursday”) is an assistant turn like any other, so it runs through the memory pipeline described in Section 1 and Section 3: the text of your message is embedded by OpenAI before the reply, and your message together with the assistant’s reply is embedded by OpenAI again afterwards and passed to Anthropic for fact extraction. The messages and drafts the assistant fetched are not part of this (tool results never reach the memory pipeline, which is why the promises above about bodies and drafts hold), but a sender, a subject, or anything else about your mail that appears in what you typed or in what the assistant wrote back in the chat does reach OpenAI as text to embed, and can be extracted into a stored memory that is sent to Anthropic again on a later, unrelated turn.
• Gmail data is never sold, never shared with third parties for their own purposes, and never used for advertising.
• You can disconnect Gmail within Scuffed OS at any time. On disconnect, stored email metadata and your Google OAuth tokens are deleted, and Scuffed OS revokes its Google access token. As with all deletions, this is honored within 30 days.

Scuffed OS is an independent application and is not affiliated with, endorsed by, or sponsored by Google.

4b. Moodle data

If you choose to connect Moodle:

• Access is read-only and is granted only after you either (a) sign in to your school’s Moodle site in your browser, using Moodle’s own mobile-app sign-in handoff: you authenticate on your school’s own pages (for NC State WolfWare, Shibboleth SSO), and Moodle passes only web-service tokens back to the app, of which only the access token (a wstoken) is stored, and Scuffed OS uses it read-only; or (b) explicitly paste in an access token you obtain from that site (for WolfWare, from the Security-keys page after signing in). Either way Scuffed OS never sees your school username or password; only the resulting token is stored, server-side, and it is never exposed to the client.
• Scuffed OS reads your course data to display it in the School section. It stores your course names, assignment due dates, assignment and grade metadata (title, status, points), and short announcement and notification summaries.
• Scuffed OS does not request or store course files or the full body text of assignments or course pages. Links back to Moodle let you open source material there.
• Assignment deadlines from Moodle are projected into your Calendar and Tasks locally so they appear alongside your own events and to-dos. These projected entries are read-only markers derived from Moodle data: they are not copied into your calendar or task tables and cannot be edited or deleted through Scuffed OS; changing them happens in Moodle.
• Moodle data reaches Anthropic when you ask the assistant about your school (for example, “what’s due this week?”), and, through the memory pipeline below, can reach it again later. Moodle data is never sold, never shared with third parties for their own purposes, and never used for advertising.
• Memory, and the one other provider. Your synced Moodle rows go to no provider other than Anthropic, but a conversation about school does not end with that turn. Every assistant turn runs through the memory pipeline described in Section 1 and Section 3: the text of your message is embedded by OpenAI before the reply, and your message together with the assistant’s reply is embedded by OpenAI again afterwards and passed to Anthropic for fact extraction. The course rows the assistant read are not part of this (tool results never reach the memory pipeline), but a course name, a deadline, or a grade that appears in what you typed or in what the assistant wrote back does reach OpenAI as text to embed, and can be extracted into a stored memory that is sent to Anthropic again on a later, unrelated turn.
• You can disconnect Moodle within Scuffed OS at any time. On disconnect, all stored Moodle data and your access token are deleted. As with all deletions, this is honored within 30 days.

Scuffed OS is an independent application and is not affiliated with, endorsed by, or sponsored by Moodle, Moodle Pty Ltd, or North Carolina State University.

4c. Plaid data (banks & Coinbase)

Scuffed OS can link your financial institutions through Plaid so the Finance screen shows real balances, transactions, net worth, and investment holdings (including Coinbase crypto). This is read-only: the app never moves money, initiates a transfer, or writes anything back to your bank or Coinbase.

• How it connects. You link an institution through Plaid’s own hosted flow. Plaid handles your bank/Coinbase login. Scuffed OS never sees your credentials. Plaid returns an access token that lets us read your data; that token is stored server-side only and never sent to the browser.
• What is stored: institution and account names/masks/types, balances, transaction metadata (date, amount, merchant, Plaid category), and investment holdings + securities (including crypto). Also stored: recurring subscription and bill streams (merchant, cadence, amount); liabilities: loan and credit-card statement balances, minimum payments, next-payment due dates, and APRs; and investment transaction history (buys, sells, and other investment activity). Budgets you set are stored only in the configured Scuffed OS database and are never sent to Plaid, your bank, or Coinbase; net worth is computed by Scuffed OS.
• What is not stored: your bank/Coinbase credentials (Plaid holds those), and full statements/documents.
• Anthropic, and the memory pipeline. Your financial rows reach Anthropic only when you ask the assistant about your money, in which case the relevant figures transit to generate the reply, and, through the memory pipeline, can reach it again later. Every assistant turn runs through the memory pipeline described in Section 1 and Section 3: the text of your message is embedded by OpenAI before the reply, and your message together with the assistant’s reply is embedded by OpenAI again afterwards and passed to Anthropic for fact extraction, and each fact extracted is embedded once more and stored. The account, balance and transaction rows the assistant read are not part of this (tool results never reach the memory pipeline), but a figure that appears in what you typed or in what the assistant wrote back does reach OpenAI as text to embed, can be stored as a memory, and can then be sent to Anthropic again on a later, unrelated turn. Apart from Anthropic, OpenAI, and the database itself, your financial data goes to no provider other than Plaid and the institution you linked. The assistant can edit local budget limits on your instruction; it can never move money.
• Disconnect. Disconnecting an institution removes it at Plaid and deletes all of its data from Scuffed OS within 30 days.

Scuffed OS is not affiliated with Plaid, Coinbase, or your bank.

4d. macOS Contacts data

Scuffed OS can import your local macOS Contacts so the People (CRM) screen shows your real contacts instead of sample data. This is read-only and one-way: Scuffed OS never writes back to Apple Contacts.

• Consent, gated twice. Nothing is read until you explicitly enable this connector and grant Scuffed OS Full Disk Access in macOS System Settings; both are required. Enabling also requires acknowledging a storage disclosure that explains where the data goes before the first sync runs.
• What is read. Only fields you already have in Contacts: names, phone numbers, email addresses, organization and job title, and photos. Your Contacts database is read read-only; Scuffed OS never modifies it.
• Where it is stored. Contact names, phone numbers, email addresses, and organization/title are written to the configured PostgreSQL database (which may be remote, in which case the data is transmitted over TLS; see Section 5). Contact photos are not put in the database; they are stored as files on the backend host running the app.
• No third-party Contacts API. The assistant, when you ask. Contacts data is sent to no third-party Contacts API, and nothing about your contacts is uploaded in the background: syncing writes to your own database and stops there. Contact data reaches Anthropic when a request you make to the assistant causes it to use one of its People tools: searching your contacts, opening one, adding someone by hand, editing what you know about them, or logging that you were in touch. What can transit then: the person’s name, nickname, organization and job title; how you know them, your strength rating, whether they’re pinned, when you last spoke, and your notes (capped at 200 characters in a search result); plus the row’s Scuffed OS id and whether the entry came from your macOS Contacts or was added by hand. Whenever a tool touches one specific person, meaning opening them, or any of the three writes (adding someone, editing what you know about them, logging that you were in touch), the result also carries that person’s phone numbers and email addresses and up to 1,000 characters of your notes. So “I called mom today” sends back mom’s full numbers, addresses and notes, not just her name; only a search across many people stays on the shorter row. A search also reports how many contacts you have in total. Contact photos are never sent (the assistant sees only a yes/no has-photo flag), and neither are the normalized matching forms of phone numbers and email addresses or the identifiers linking a row back to Apple Contacts. There is no separate opt-in for this: enabling the Contacts connector is the only choice you make, and from then on the assistant’s People tools are always available to your requests. What the assistant can change is narrower than what it can read: your own CRM fields (relationship, strength, notes, pinned, last-contacted) plus adding a person by hand. It cannot edit the name, phone numbers, emails or organization on an imported contact, and it has no tool to delete anyone.
• Memory, and the one other provider. A conversation about a contact does not end with that turn. Every assistant turn runs through the memory pipeline described in Section 1 and Section 3: before the reply, the text of your message is embedded by OpenAI to search your stored memories; after it, your message together with the assistant’s reply is embedded by OpenAI again and passed to Anthropic for fact extraction, and each fact extracted is embedded once more and stored. Tool results are not part of this, so the contact rows the assistant read are never handed to the memory pipeline, but anything about a contact that appears in what you typed or in what the assistant wrote back does reach OpenAI as text to embed, and can be extracted into a stored memory. And because stored memories are searched and pasted into the assistant’s context on every turn, a fact learned from a People conversation can be sent to Anthropic again later, on an unrelated turn. Apart from Anthropic, OpenAI, and the database itself, contacts go to no other provider; they are never sold, never shared with third parties for their own purposes, and never used for advertising.
• Revocation. You can revoke access by turning off Full Disk Access for Scuffed OS in System Settings, and/or by Disconnecting the connector in-app (stops future syncing but keeps your existing CRM data, including relationship notes and pinned contacts, intact, and the assistant’s People tools can still read what is kept), or by using Forget imported data (deletes the imported contacts, their handle index, and their photos; a contact carrying any CRM-native data, such as a relationship, a strength, notes, a pin, or a last-contacted date, is converted into a manually-owned entry that keeps their name and that history rather than losing it).
• Retention. Imported contact data persists until you Forget it or delete an individual manually-owned entry. If access is revoked (Full Disk Access turned off) without disconnecting or forgetting, Scuffed OS shows the connector as stale and preserves your existing rows rather than deleting them.

Scuffed OS is an independent application and is not affiliated with, endorsed by, or sponsored by Apple.

5. Data storage and security

• App data is stored in the configured PostgreSQL database, which may run locally or on a remote/self-hosted server; attachments, the memory history file, and imported contact photos are stored on the backend host running the app.
• Traffic to external service providers uses TLS. A non-loopback (remote) database connection requires TLS (sslmode=require or stronger); the packaged app’s managed local database instead uses a user-local Unix socket and is not exposed on the network. Connection strings and credentials are never written to logs.
• API credentials and OAuth tokens are stored server-side, never in the client. Static API keys come from server-side configuration; OAuth tokens obtained when you connect a service (such as WHOOP) are stored in the server-side database and are never exposed to the client.
• In the packaged desktop app, API keys and provider client credentials are stored on your Mac in an AES-256-GCM encrypted vault (secrets.enc). The encryption key is a random 256-bit key generated on your Mac the first time the app runs and stored only in your macOS login Keychain; it is not derived from your hardware or any other identifier. If that Keychain item is unavailable, the vault stays locked: the app does not fall back to a weaker key or create a replacement. A vault created by an earlier version, whose key was derived from your Mac’s hardware identifier, is moved to the Keychain key when the updated app first opens it. Provider access/refresh tokens remain in the app-managed local PostgreSQL database and are never exposed to the client. These credentials do not leave your machine except when sent to the service they authenticate with.
• Access to the database and the machine running the app is limited to the operator.

No system is perfectly secure, but as a single-user, self-hosted application, Scuffed OS’s exposure surface is intentionally small.

6. Data retention and deletion

Data is retained until it is deleted. Scuffed OS provides in-app deletion controls for many local records plus integration-specific Disconnect and Forget actions; the operator can also delete any record, or all data, directly from the database. Disconnecting WHOOP triggers deletion of synced WHOOP data and tokens as described in Section 4; disconnecting Gmail likewise deletes stored email metadata and Google OAuth tokens; disconnecting Moodle likewise deletes all stored Moodle data (courses, deadlines, assignments, grades, announcements, notifications) and your Moodle access token. Connected-institution data is deleted within 30 days of disconnecting a bank or Coinbase account linked through Plaid. Disconnecting macOS Contacts is not deletion: it stops future syncing but keeps your already-imported contacts and CRM data; use Forget imported data within Scuffed OS to delete the imported contacts, handle index, and photos (see Section 4d). For any deletion request, contact us at the address below and it will be honored within 30 days.

7. Your rights and choices

You can access, correct, or delete data through the in-app controls and assistant tools available for each domain; the operator can also export or delete records directly from the database. You can decline to connect WHOOP, Gmail, Moodle, Plaid, or macOS Contacts (the rest of the app works without any of them), disable voice dictation by simply not using the microphone, and disconnect any integration at any time. For macOS Contacts specifically, use Forget imported data (Section 4d) to delete previously-imported contact data, not just Disconnect. The memory pipeline (Section 1 and Section 3) is on by default and has no in-app opt-in, but because Scuffed OS is self-hosted you can turn it off entirely in the server’s configuration (MEMORY_ENABLED=false); the assistant still answers, without recall or capture, and nothing is embedded by OpenAI.

8. Children

Scuffed OS is not directed at children and is not intended for use by anyone under 13 (or the minimum age required in your jurisdiction).

9. Changes to this policy

If the app’s data practices change (for example, when new integrations are added), this policy will be updated and the effective date revised. The current version is always available at the URL where you are reading it.

10. Contact

Questions, or a data access/deletion request? Email contact@scuffedcorporation.com.