ProgressOS

Legal and support

Privacy Policy

This Privacy Policy explains how ProgressOS handles information used for goal tracking and user-authorized platform connections.

Effective 2026-07-18 · Last updated 2026-08-08

Information users provide

  • authentication email and optional name supplied either through ChatGPT Sites identity headers or a Google sign-in session, depending on deployment
  • profile settings, timezone, date format, onboarding and eligibility confirmations, and notification preferences
  • goal names, descriptions, categories, values, units, dates, notes, milestones, manual progress, and privacy setting
  • a temporary in-browser voice recording and transcript only when the user presses the microphone control to request a voice-assisted goal draft
  • job or application workflow entries and authenticated privacy-request categories
  • CSV or JSON files, mappings, and numerical values the user explicitly imports

Optional connected-service information

Third-party connections are optional and user-initiated. Every external provider is disabled by default and becomes available only when its explicit enable flag, readiness gate, and required server-side configuration permit it. An implemented adapter is not evidence of provider approval or a live connection.

When a user authorizes an enabled connection, ProgressOS may store:

  • provider account identifiers and display labels
  • requested and granted OAuth scopes or capabilities
  • the user-selected resource identifier, resource label, metric, and synchronization rules
  • derived numerical progress snapshots, timestamps, and bounded calculation or diagnostic metadata
  • encrypted access and refresh credentials plus expiry metadata while a connection remains active

ProgressOS is primarily read-only: provider information is read to calculate a number for a goal. The two provider permissions that are technically broader than the operations ProgressOS uses, and Apple's full-access permission model, are explained below.

Provider-by-provider data practices

YouTube

Data accessed: The authorized channel identifier and title; uploaded video identifiers, titles, descriptions, publication timestamps, and availability shown during selection; subscriber count, total channel views, uploaded-video count; and view and like counts for a selected video.

Why: To let the user track subscriber, channel-view, uploaded-video, or selected-video view and like goals for the channel they authorized.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Read-only. ProgressOS cannot post, upload, edit, delete, comment, message, advertise, or access watch history through this connection.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Implemented but disabled under the current operator freeze; implementation is not Google or YouTube approval.

Technical permissions
  • https://www.googleapis.com/auth/youtube.readonly

Gmail

Data accessed: Label identifiers, names, and types, plus aggregate total and unread message and thread counts for a selected label. It does not request message bodies, subjects, addresses, attachments, drafts, or search results.

Why: To track numerical inbox or label-count goals without reading message content.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: The gmail.labels permission can technically modify labels, but ProgressOS makes only GET requests and contains no Gmail label mutation, compose, send, or delete behavior.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Availability depends on operator enablement, Google API configuration, and any required verification.

Technical permissions
  • https://www.googleapis.com/auth/gmail.labels

Google Calendar

Data accessed: Calendar identifiers, labels, primary status, and access role, plus bounded event identifiers, event type, status, start time, and end time. Titles, descriptions, and attendees are not requested in event queries.

Why: To calculate ended-event counts, scheduled-event counts, and scheduled hours within seven-day windows.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Read-only. ProgressOS does not create, edit, delete, invite, or manage attendees or calendars.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Availability depends on operator enablement and completed Google application configuration.

Technical permissions
  • https://www.googleapis.com/auth/calendar.calendarlist.readonly
  • https://www.googleapis.com/auth/calendar.events.readonly

Google Sheets

Data accessed: Identifiers and names for Sheets explicitly opened or selected for ProgressOS and values in one bounded user-configured cell or range.

Why: To calculate a selected numeric value, row count, sum, average, minimum, maximum, match count, or completion percentage.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived. The configured range and bounded cell-type/count evidence may also be stored with a snapshot; the complete sheet is not copied into ProgressOS.

Provider changes: The drive.file permission can technically modify files the user authorizes, but ProgressOS makes only Drive and Sheets GET requests and contains no file-edit, delete, share, or permission-changing behavior.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: The per-file Picker selection workflow and operator enablement must be complete before general availability.

Technical permissions
  • https://www.googleapis.com/auth/drive.file

Google Classroom

Data accessed: Active course identifiers and names, published coursework identifiers and due timing, and only the authenticated student's own submission state and late flag. It does not read rosters, other students' work, private comments, attachments, materials, assignment text, or grades.

Why: To calculate open, due-soon, overdue, completed, missing, and completion-percentage coursework goals.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Read-only. ProgressOS does not create or grade coursework, manage classes or rosters, or change submissions.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Availability depends on operator enablement, Classroom API configuration, and any required Google approval.

Technical permissions
  • https://www.googleapis.com/auth/classroom.courses.readonly
  • https://www.googleapis.com/auth/classroom.coursework.me.readonly

Google Sign-In / Identity

Data accessed: Google's stable OpenID Connect subject identifier, verified email address, and optional profile name.

Why: To authenticate the ProgressOS account and display the user's name; it does not authorize Gmail, Calendar, Sheets, Classroom, or YouTube access.

What is stored: ProgressOS stores the stable Google subject as the linked-account identifier and stores the verified email and optional name in the local account. The authentication session is managed by Auth.js. No connected-provider credential record is created for Google Sign-In itself, and raw identity responses are not archived.

Provider changes: Identity-only. Google Sign-In cannot modify Google account or connected-service data.

Disconnect and deletion: Signing out ends the ProgressOS session. Account deletion removes the local linked identity and account data; removing the Google account's authorization is a separate control in Google account settings.

Availability: Used only in deployments configured for Google authentication and kept separate from every Google data-provider authorization.

Technical permissions
  • openid
  • email
  • profile

Discord

Data accessed: The authorized Discord account identifier and username, owned guild identifiers and names, and approximate member counts for a selected owned guild.

Why: To track an aggregate server member-count goal.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Read-only. ProgressOS requests no bot access, messages, member lists, voice activity, privileged intents, moderation, or guild administration.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Implemented; current operator checklist still records final reconnection and denial validation as pending.

Technical permissions
  • identify
  • guilds

Twitch

Data accessed: The authorized broadcaster identifier, login and display label, total follower count, live/offline state, and current viewer count when live.

Why: To track follower, live-state, and live-viewer goals for the authorized broadcaster.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Read-only. ProgressOS does not access subscriptions or revenue and cannot write chat, whisper, moderate, edit the channel, or control broadcasts.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Disabled until an authorized operator completes Twitch application and callback configuration.

Technical permissions
  • moderator:read:followers

Strava

Data accessed: The athlete identifier and display label, plus visible activity identifiers, activity type, distance, moving time, and elevation gain within a bounded window.

Why: To calculate activity count, distance, moving-time, and elevation totals for selected activity categories.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived. It may store the bounded time window and counts of activities/pages read, but not precise route or map payloads.

Provider changes: Read-only. ProgressOS does not request access to Only Me activities and cannot upload, edit, delete, or add social interactions.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Disabled until an authorized operator registers and configures the Strava application.

Technical permissions
  • read
  • activity:read

Fitbit

Data accessed: Authorization is provided through Google OAuth and data is retrieved through the Google Health API. ProgressOS reads the Health account identity, daily activity totals (steps, distance, calories, active energy, active minutes, Active Zone Minutes, floors), exercise sessions, and sleep duration/session summaries within a bounded window. No intraday (per-minute) datasets, GPS/location, heart-rate detail, nutrition, or other health categories are requested.

Why: To calculate step, distance, calorie, active-minute, workout, and sleep totals for the time window used by a goal.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived. It may store the bounded time window and aggregated daily totals, but not per-minute samples, routes, or raw health records.

Provider changes: Read-only. ProgressOS does not request any Google Health write scope and cannot log, edit, or delete activity, sleep, or any other data.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Available once an authorized operator configures the dedicated Google Health OAuth application.

Technical permissions
  • https://www.googleapis.com/auth/googlehealth.activity_and_fitness.readonly
  • https://www.googleapis.com/auth/googlehealth.sleep.readonly

FatSecret

Data accessed: The delegated FatSecret profile authorization; bounded food-diary entries; meal type and diary date; calories, carbohydrate, protein, fat, and optional fiber, sugar, and sodium values returned by FatSecret.

Why: To calculate user-requested calorie, macro, nutrient, meal, food-entry, and food-logging-day goals from the connected FatSecret diary.

What is stored: The FatSecret OAuth access token and secret are storable under FatSecret's rules and are encrypted server-side while connected. ProgressOS does not archive raw diary responses, food names, or descriptions. Non-storable derived numeric values and bounded evidence are deleted within 24 hours; provider-returned diary identifiers are not currently persisted.

Provider changes: Read-only. ProgressOS calls only profile validation and food-diary read endpoints and cannot create, edit, copy, or delete FatSecret diary entries.

Disconnect and deletion: Disconnect removes the encrypted FatSecret access token and token secret plus cached resources immediately, stops synchronization, and deletes FatSecret-derived goal history; retaining that history is not offered. FatSecret does not expose a revocation operation used by this adapter, so the user may also need to withdraw access through controls or support made available by FatSecret.

Availability: Available once an authorized operator configures the FatSecret OAuth1 consumer application and exact callback path. This does not imply FatSecret endorsement.

Technical permissions
  • food_diary.read

Notion

Data accessed: Workspace, page, and data-source identifiers and labels explicitly shared with ProgressOS; created and edited timestamps; selected checkbox, status, or select values; and direct child-block presence needed for counts.

Why: To calculate accessible page/data-source counts, edited or created counts, row counts, selected-property matches, and direct child-block counts.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived. Selected property names and comparison values may be stored as metric configuration; page, row, and block contents are not retained as an archive.

Provider changes: Read content only. ProgressOS does not insert or update content, change properties, or write comments.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Disabled until the operator configures the Notion dashboard for Read content only, with user-information, insert, update, and comment capabilities disabled.

Technical permissions
  • read_content

Slack

Data accessed: Workspace and authorized-user identifiers and labels, joined channel identifiers and names, and search results sufficient to count messages authored by that user in a bounded time window and optional selected channel.

Why: To track joined-channel counts and bounded counts of messages authored by the connected user.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived. Search result text and attachments are not retained; only the derived count and bounded calculation metadata are stored.

Provider changes: Read-only user-token flow. ProgressOS cannot post, react, manage channels, administer the workspace, or access files through the requested permissions.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Disabled until an authorized operator registers, configures, and reviews the Slack application.

Technical permissions
  • channels:read
  • groups:read
  • search:read
  • users:read

TikTok

Data accessed: An app-scoped open_id plus follower count, following count, total likes received, public-video count, the authorized user's public-video titles/descriptions and posting dates, and view, like, and comment counts for a selected public video.

Why: To track four aggregate account statistics and read-only engagement counts for a public TikTok video explicitly selected by the user.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Read-only. ProgressOS does not request video.list, expanded profile data, publishing, uploads, messages, advertising, research, portability, commerce, or account-write access.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Testing/Sandbox configuration exists, but production review and real OAuth validation remain incomplete.

Technical permissions
  • user.info.basic
  • user.info.stats
  • video.list

GitHub

Data accessed: The authenticated public account identifier and login; owned public repository identifiers and names; public follower and repository counts; and public stars, forks, open and closed issues, published releases, commits, and merged pull-request counts.

Why: To track public account and public owned-repository goals, including bounded commit, issue, and pull-request counts.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Public-data access only with no additional OAuth scope. ProgressOS cannot access private repositories, private email, organization administration, or modify repository content.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Implemented; any live grant cleanup or reconnection remains an operator-controlled action.

Technical permissions

No additional OAuth scope is requested.

Reddit

Data accessed: The account identifier and username, post and comment karma totals, moderated-subreddit identifiers and names, and public subscriber count for a selected moderated subreddit.

Why: To calculate combined account karma or a moderated community's subscriber count.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived.

Provider changes: Read-only. ProgressOS cannot submit, edit, vote, save, message, or perform moderation actions and does not retain post or comment bodies.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. ProgressOS also attempts provider-side revocation and reports a failure instead of treating it as successful.

Availability: Unavailable because commercial API access was rejected; no approval or partnership is claimed.

Technical permissions
  • identity
  • mysubreddits
  • read

Shopify

Data accessed: The shop identifier, permanent myshopify.com domain, shop label and currency; product identifiers, titles, status, inventory-tracking state and total inventory; and non-test order counts, current totals, fulfillment status, current line-item quantities and product associations within the ordinary recent 60-day window.

Why: To calculate catalog, inventory, order, fulfilled-order, revenue, average-order-value, store-unit and selected-product-unit goals.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived. Customer profiles and raw order records are not retained. Product resource identifiers, titles, status and inventory metadata can be cached for resource selection; derived evidence may include currency, window length, orders or pages read, and the selected product identifier. Mandatory privacy webhooks process deletion requests and bounded identifiers needed to remove affected data.

Provider changes: Read-only GraphQL operations. ProgressOS cannot modify products, orders, fulfillment, customers, payments, or marketing data and does not request read_all_orders.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. The provider does not expose a revocation operation used by this adapter, so the user may also need to remove ProgressOS in the provider's account settings. Shopify uninstall and mandatory privacy webhook paths also remove local credentials and affected shop or customer-linked data where applicable.

Availability: Provider review remains pending; implementation does not imply Shopify approval.

Technical permissions
  • read_orders
  • read_products

Depop

Data accessed: Seller/shop identifier, display name and country code; selected product identifiers and labels; product and shop insight counts including likes, bag adds, offers, clicks, impressions, ratings and listings; and bounded order counts, quantities, values, fees, refunds, and fulfillment status.

Why: To calculate the implemented product, shop-insight, offer, order, sales, fee, refund, and fulfillment goals.

What is stored: The provider account identifier and display label, requested and granted permissions, selected resource identifier and label, metric configuration, derived numeric progress snapshots, timestamps, and bounded calculation evidence may be stored. Access and refresh credentials and expiry metadata are encrypted server-side while the connection is active. Raw API response payloads are not archived. Derived evidence can include product ID, environment, bounded time window, pages read, currency, and provider-delay markers; buyer personal information and raw API payloads are not stored.

Provider changes: The Partner API client makes authenticated GET requests only and requests no product, order, offer, purchase, message, follower, rating, or other write permission.

Disconnect and deletion: Disconnect removes the encrypted local credential and cached resources immediately. Provider-derived history is deleted by default; retaining it is available only where the operator has explicitly enabled that option and the user chooses it. Account deletion removes the connection, credentials, selected-resource records, and derived history from active application storage. The provider does not expose a revocation operation used by this adapter, so the user may also need to remove ProgressOS in the provider's account settings.

Availability: Disabled with Partner access required; the existing Depop application has not been resubmitted or represented as approved.

Technical permissions
  • shop_read
  • products_read
  • orders_read
  • offers_read

Apple Calendar

Data accessed: On the paired Mac, EventKit reads events within today or a user-selected bounded date window and optionally a selected calendar, then counts matching events.

Why: To send an event-count measurement for an Apple Calendar goal.

What is stored: The server stores a hashed companion credential, device identifier and name, revocation/last-seen timestamps, metric key, numeric event count, measurement time, optional calendar resource identifier, request identifier, and derived goal snapshots. Event titles, descriptions, attendees, locations, and raw EventKit objects are not sent or stored.

Provider changes: Apple provides no separate read-only EventKit permission for this use, so macOS grants full Calendar access. ProgressOS contains no event create, save, update, or delete behavior.

Disconnect and deletion: Revoking the paired device prevents future submissions but does not change the Mac's EventKit permission; the user controls that permission in macOS settings. Account deletion removes paired-device records, observations, and derived snapshots from active storage.

Availability: Available only after the user explicitly pairs a Mac and grants Calendar access in the companion.

Technical permissions
  • EventKit Calendar full access

Apple Reminders

Data accessed: On the paired Mac, EventKit reads the set of incomplete reminders and counts it.

Why: To send an open-reminder-count measurement for an Apple Reminders goal.

What is stored: The server stores a hashed companion credential, device identifier and name, revocation/last-seen timestamps, metric key, numeric reminder count, measurement time, request identifier, and derived goal snapshots. Reminder titles, notes, lists, due dates, and raw EventKit objects are not sent or stored.

Provider changes: Apple provides no separate read-only EventKit permission for this use, so macOS grants full Reminders access. ProgressOS contains no reminder create, save, update, complete, or delete behavior.

Disconnect and deletion: Revoking the paired device prevents future submissions but does not change the Mac's EventKit permission; the user controls that permission in macOS settings. Account deletion removes paired-device records, observations, and derived snapshots from active storage.

Availability: Available only after the user explicitly pairs a Mac and grants Reminders access in the companion.

Technical permissions
  • EventKit Reminders full access

YouTube API Services

ProgressOS uses YouTube API Services only when a user chooses to connect YouTube. The separate connection is read-only and uses youtube.readonly for the channel authorized by that user.

Relevant Google and YouTube policies:

How information is used

ProgressOS uses information to authenticate a workspace, create and display goals, import user-selected files, synchronize selected numerical metrics, maintain history and milestones, prevent abuse, troubleshoot failures, and carry out export, disconnection, and deletion requests.

When a signed-in user explicitly starts voice goal creation, microphone audio is recorded temporarily in the browser, transcribed on that device with a locally running speech model, and interpreted there by deterministic rules into an editable draft. ProgressOS does not upload or retain the recording or standalone transcript for this operation. The user must review and explicitly create the goal before normal goal fields are sent to ProgressOS and stored.

ProgressOS does not use connected-platform data, imported files, goal content, voice recordings, or transcripts to train a ProgressOS or general-purpose artificial-intelligence model. Voice transcription and draft interpretation run locally in the browser and do not use a cloud AI service.

OAuth-token handling

OAuth state and credentials are processed server-side. Access and refresh credentials are stored in encrypted credential records and are excluded from ordinary browser responses and user exports. The separate public information Worker stores no credentials and performs no token exchange.

Cookies and authentication sessions

ProgressOS supports two authentication modes. Sites deployments read identity headers supplied by ChatGPT Sites only after the production trust-boundary flag is verified. Render deployments use Google Sign-In through Auth.js, which manages the application session. Authentication providers may process account and session information under their own terms and privacy practices.

Application code stores the progressos-theme preference in localStorage. After a user starts voice recognition, the browser may also retain the same-origin speech model in Cache Storage for later local transcription; recordings and transcripts are not placed in that cache. No application analytics, advertising pixel, or third-party error-monitoring SDK was found.

Service providers and subprocessors

ProgressOS supports two application-storage paths. Sites and Cloudflare Worker deployments use D1 for application records and R2 for user-selected raw CSV/JSON uploads. Render deployments use PostgreSQL for application records and Cloudflare R2 through its S3-compatible interface for raw uploads. The separate progressos-public Worker has no database, object-storage, secret, authentication, or analytics binding.

A connected provider receives authorization and API requests selected by the user. Contract status, processing locations, international transfer safeguards, platform logs, and backup behavior require operator evidence and are not inferred from public documentation.

Data sharing, sale, and targeted advertising

Information is sent to authentication, hosting, storage, and selected connection providers only as needed for the implemented request. The reviewed code contains no advertising SDK, ad-targeting workflow, data-broker integration, analytics SDK, payment system, or code path that sells personal information. The operator confirms that ProgressOS does not sell personal information and does not use personal information for targeted advertising.

Security practices

  • OAuth credentials are encrypted server-side with AES-GCM using versioned 32-byte keys.
  • OAuth flows use one-time state; providers use PKCE where their documented web flow supports it.
  • Authenticated mutation routes apply ownership checks, same-origin validation, typed input validation, and bounded rate limits where implemented.
  • Application responses apply configured content-type, frame, referrer, permissions, and content-security protections.

Application and security events use correlation identifiers, outcome categories, error types, and bounded metadata. Keys associated with tokens, credentials, cookies, email, names, files, payloads, descriptions, and notes are redacted before console logging.

These are scoped implementation details, not a guarantee that a security incident cannot occur.

Data retention and deletion

  • Provider credentials and raw provider payload archives have a configured post-disconnect retention of 0 days; credentials and resource caches are removed from active storage during disconnect, and provider adapters do not archive raw API responses.
  • Provider-derived progress history is deleted on disconnect by default. Retention is allowed only for a provider the operator has explicitly approved and only when the user selects retain; retained history remains until the user later deletes it, the goal, or the account.
  • FatSecret is a stricter exception: raw diary responses, food names, and descriptions are not persisted; derived numeric measurements, snapshots, sync activity, and sync jobs are deleted by a mandated cleanup tier at a 22-hour cutoff that runs on an hourly in-process schedule regardless of the discretionary retention-policy approval flags, keeping every derived value inside FatSecret's published 24-hour cache limit; and retained history is never offered.
  • Active goal-deletion paths remove the goal and its history immediately. The separate policy configuration lists 30 days for deletion-related goal-history retention, so any backup or other non-active copy must not exceed that target and still requires infrastructure verification.
  • Completed or failed synchronization jobs are configured for cleanup after 30 days. Read and unread notifications are configured for 90 days, activity records for 365 days, completed deletion tasks for 30 days, and security events for 90 days.
  • A content-free account tombstone is kept for 24 hours to block recreation from a stale session. The separate policy configuration sets a 30-day deleted-account backup target, but infrastructure backup expiry still requires deployment-specific configuration and verification.
  • The cleanup schedule is not yet marked approved for destructive production execution. ProgressOS therefore does not claim that unverified cleanup jobs or infrastructure backup deletion have already occurred.

Signed-in users can request a confirmed JSON export. Goal, dataset, connection, and account deletion paths enforce ownership, attempt provider revocation where supported, remove encrypted credentials, delete active application-database records, verify object-storage cleanup, and report pending failures rather than treating them as complete. Deleting ProgressOS data does not delete information independently retained by a connected provider or authentication service.

Removing provider access

The in-app disconnect control removes local credentials even if a provider-side revocation request fails or is unsupported. Users can also review or remove authorization directly with the provider:

Apple Calendar and Reminders permissions are controlled in macOS Privacy & Security settings. Revoking a paired ProgressOS companion device stops future server submissions but does not itself change those macOS permissions.

Access, correction, export, and deletion

Signed-in users can edit supported account settings and goal data, download a confirmed JSON export, delete goals or uploaded datasets, disconnect providers, and request account deletion. The public contact for privacy requests is mohammedzabbasi@gmail.com.

International processing

Infrastructure and connected providers may process requests outside a user’s location. ProgressOS does not represent that all providers or infrastructure process information only in the user’s country.

Children’s privacy

ProgressOS is intended only for users who are at least 16 years old. The current application does not request an exact birthdate.

Changes, contact, and effective date

This policy may be updated when the service or its information practices change. The effective date shown on this page will be updated when a revised policy is published.

Legal/policy operator: Sana Abbasi, operating ProgressOS personally in New Jersey, United States of America.

Developer / technical contact: Mohammed Abbasi (mohammedzabbasi@gmail.com). Privacy and technical questions may be sent to that address. Effective date: 2026-07-18.

The operator has described ProgressOS as a personal, not registered-company operation. This policy describes the current pre-production application; it is not legal advice, a security certification, or evidence that any listed provider has approved, endorsed, certified, sponsored, or partnered with ProgressOS.