What Life OS does with your data

Life OS is yours: it keeps what you give it in your account, and sends something to another company only when a feature needs it. This page says which, and what you can do about it.

What is kept, and where

Your account. Your email and a password (kept scrambled by Supabase, which runs sign-in and holds your data). Everything you build and log lives there as your Life OS: pages, logs, notes, your chat with the agent, settings, and your profile (name, city, and the measurements you choose to give).
This device. A copy of your Life OS is kept in this browser, so it opens fast and works when the connection drops. Signing out removes it when everything has been saved to your account.
How much you use it. A few numbers a day, so we can tell whether Life OS helps people keep going, and whether anything in it starts to do harm: how many times you opened it and for how many minutes you used it; how many things you logged or ticked, how many you missed, and how many of those you picked up again; how many messages you sent the agent, how many of them started a conversation, and how many were sent late at night (from 11 pm to 5 am); how many notifications you opened or acted on, which kinds you turned off, and how many reminders you muted or removed; how many streaks broke and how many you repaired; how many times you were welcomed back; and how many times crisis help lines were shown to you. For each week: how many aims you had and how many you met (prayer and other worship are never counted), and whether you said Life OS helped. Never what you logged or said, which page, any other time of day, or your device. Life OS reads them only as totals across many people, never yours alone, and no analytics company sees them. You can see yours in Settings › Data. They are kept in your account for 400 days and deleted with your data.
Connected accounts (Google Calendar, Microsoft, Fitbit, Strava, Oura, Withings, and apps through Composio), only if you connect them. The keys they give Life OS are kept sealed (encrypted with a key only the server holds), and what is read from them (events, readings) is kept in your account. For an app you connect through Composio, Composio keeps your sign-in and Life OS keeps none.
Groups. If you join a group, its leader sees your name and the progress you send. Progress goes when you send it, or on its own if the group is set up to work that way; you can leave a group at any time.
Reminders. If you switch them on, this browser’s address at your browser maker’s push service is kept, so reminders can reach you when Life OS is closed.
A photo of you, if you add one, and only if you add one.
Photos on a block (before and after, a timeline), only the ones you add. They are made small on your device first and kept in your own private folder in Supabase storage; each is shown through a link that works for ten minutes, never a public one. Deleting a photo deletes its file.
Questions you send out (an invitation, a poll, a sign-up). Anyone with its link can see the question and everyone’s names and answers, except a note about what someone does not eat, which only you see. People who answer need no account; their name and answer are kept with your question, and their browser keeps a key so they can change it. Closing the question stops new answers; deleting your data deletes your questions and their answers.

What leaves Life OS, and where it goes

The agent: DeepSeek, OpenRouter and Liquid AI: When you ask, build or log with the agent, this server sends DeepSeek what you typed or said, any photo you attach, and a summary of your Life OS the agent needs to answer: the names and figures on your pages, your rules and the agent’s memory, and your profile (name, city and country, the coordinates if you saved them, and any body measurements). Never your email or password. DeepSeek runs its own servers, which may be in another country, under its own terms. When DeepSeek cannot answer (its servers are down, or this Life OS’s account with it is out of credit), the same request goes to the same DeepSeek model through OpenRouter, which passes it on to a company that runs that model, under OpenRouter’s terms. What you type in the ask bar, with that summary of your pages and the conversation so far, is also sent through OpenRouter to Liquid AI’s d1-ultra model, which only picks what you asked for (open a page, change a block, a question, a new page) so the agent can answer sooner. When you ask for a new page, your request goes to it too, with the agent’s memory, the titles of your pages and your time and place, to sort it; and when the agent finds pictures, the titles of the page and its blocks and what each picture shows, to pick where one goes. It writes nothing; Liquid AI runs its own servers under its own terms.
Your voice: your browser, or your device: Life OS never receives your audio. By default it uses the speech recognition built into your browser: in Chrome and Edge that is done by a service of Google or Microsoft, and in Safari by Apple, so your audio goes to them. In Settings › Agent, “Listen with › Whisper” turns your speech into words on this device instead, and nothing is sent (the speech model, about 40 MB, is downloaded once from jsDelivr and Hugging Face). Only the words go on to the agent.
Web search: Exa, Tavily, Brave or DuckDuckGo: When a question needs the web, the words the agent searches for go to the search service this server is set up with, and the server reads the pages it finds.
Pictures: Wikimedia Commons, Wikipedia, Wikidata, ExerciseDB, TheMealDB, iNaturalist, Bing Images, Pinterest, DeepSeek and Firecrawl: The name of a dish, place, exercise, plant or everyday thing is looked up to show its picture, and for a place the place its page is about is sent with that lookup so the right one is found. A recipe’s photo, a page’s cover or an everyday thing’s photo may be searched for on Bing Images (only on listed recipe and free stock-photo sites, except for covers), and a recipe site or a place’s Wikipedia article may be searched for with DeepSeek’s or Firecrawl’s web search; only the name is sent. Pictures you ask for from Pinterest are read through Composio: from your own Pinterest when you have connected it, and otherwise from the Pinterest account Life OS keeps for pictures. Only pin images are read that way, and the search words are what is sent. Those photos are checked by the AI model before they are shown. You can switch pictures off in Settings.
Stickers: OpenRouter and OpenAI, only when you turn them on: Stickers are off until you turn them on in Settings › Look. Then the agent reads a page’s blocks to choose one object for each, shown in place of its icon (a tram, a kettlebell), and a sticker Life OS already has is used as it is. A sticker someone else already has for the same object is used as it is, free. A new one is drawn by OpenAI through OpenRouter, sent only those few words naming the object, never your names, numbers or notes; it is kept in your own storage folder and, as it shows only that object, others who need the same object get it too, without knowing it was drawn for you. Your stickers are deleted with your account, except drawings others use, which show only an object and stay.
How an exercise is done: ExerciseDB, and YouTube when you tap it: When you open how a lift is done, its name is looked up on ExerciseDB for its demo, the equipment and the steps; when ExerciseDB does not list it, the agent searches the web for it (above), sending only the exercise’s name. “Watch a video” opens a YouTube search for that name in a new tab when you tap it, and only then.
Place details and map pins: Google Maps, when this server is set up for it: When Google Maps is set up on this server, it sends a place’s name (with the area of the map, or the place the page is about), its Google id when known, or a Google Maps link you paste, to a Google Maps lookup service (google-maps-scraper-l6pc.onrender.com), which reads Google Maps for the place’s rating, reviews, opening hours, photos, address, phone and website; the places a map pins are found there too. Nothing about you is sent with it. The photos load in your browser from Google’s servers (lh3.googleusercontent.com). When it is not set up or does not answer, the services below are used instead.
Place details: OpenStreetMap (Nominatim) and Wikipedia: When you open a place on a map or in a list, this server looks its name up (with the area of the map, or the place the page is about, to pick the right one) to show its address, opening hours, a picture and a line about it. Your browser asks nothing of them itself. “Open in Apple Maps” or “Open in Google Maps” (Apple Maps first on an iPhone, iPad or Mac, Google Maps on anything else), “Directions”, the other of those two, and “OpenStreetMap” go there when you tap them, and only then.
Places, weather and prayer times: Photon, Open-Meteo and Aladhan: When you type a city or a place, or allow your location, this server asks Photon (OpenStreetMap’s search) where it is, sending only the place’s name (or the coordinates, to about 100 metres); your browser never asks Photon itself. The places on a map are found the same way, by this server, once, and saved in the map. For the weather and prayer times, your browser asks Open-Meteo and Aladhan directly, sending the place (or the coordinates) and nothing else. A map block loads its tiles from OpenStreetMap, which sees the area you are looking at. When the agent writes a packing list for a trip, this server asks Open-Meteo for the weather there on the trip’s dates, sending only the place’s name and the dates.
The Quran: quran.ai: When you ask the agent about the Quran, this server asks quran.ai (a quran.foundation service) for the verses, translations and commentary it needs, sending only what is being looked up, never who you are. A verse it quotes links to it on quran.com.
Quran recitations: quran.com: When you tap Listen, an ayah’s number or Hear the word on a portion of the Quran, your browser plays the recording from quran.com’s own servers (verses.quran.com, audio.qurancdn.com, and mirrors.quranicaudio.com for some reciters). Only the recording is asked for; nothing about you is sent with it, beyond what any web request carries.
The mushaf’s fonts: quran.com: When a portion of the Quran is shown in Arabic, your browser loads the King Fahd Complex’s font for each of its pages from quran.com’s font server (verses.quran.foundation), so the ayat look as the printed mushaf has them. Only the fonts are asked for; nothing about you is sent with them, beyond what any web request carries.
Athkar recitations: Hisn al-Muslim: The athkar on an athkar page are kept in Life OS itself. When you tap Listen or Hear it, this server fetches that dhikr’s recitation from hisnmuslim.com by its number, sending nothing about you, and plays it to you.
Typefaces: Google Fonts: Your browser asks Google for the fonts the pages are set in, as any site using them does.
Connected accounts and apps: Only when you connect them, Life OS talks to that service with the keys you approved to read your calendar or readings, and to Composio, which signs in to the apps you connect through it, to let the agent read from them. It reads; it changes something in an app only when you have allowed that app to, and you confirm each change.
Email: Sign-in and reset messages come from Supabase. If you invite someone to a group by email, that address gets one message from Life OS.
Reminders: your browser’s push service: A reminder passes through Google, Apple or Mozilla (whichever made your browser). What it says is encrypted so only your device can read it; they can see that one was sent.

What you can do

Take it with you. Settings › Data › Export a backup gives every page, log, rule and setting as one file.
Delete it. Settings › Data › Delete all your data removes everything in your account (pages, logs, groups you lead, connected accounts and what they brought in, servers and devices) and keeps your sign-in. Delete your account removes the sign-in as well.
Disconnect. Settings › Connections removes a connected account and everything read from it, and tells Google Calendar, Fitbit and Strava to end Life OS’s access on their side too. Outlook, Oura and Withings give Life OS no way to do that, so remove Life OS in their own settings as well; Life OS says so when you disconnect one. Deleting your data or your account does the same for every connected account, and tells you which could not be ended.
Keep the agent out of it. Nothing is sent to the agent unless you ask, build or log with it. Settings › Agent chooses how your voice is turned into words.

Questions about this page go to whoever runs this Life OS.

What Life OS does with your data

Life OS is yours: it keeps what you give it in your account, and sends something to another company only when a feature needs it. This page says which, and what you can do about it.

What is kept, and where

Your account. Your email and a password (kept scrambled by Supabase, which runs sign-in and holds your data). Everything you build and log lives there as your Life OS: pages, logs, notes, your chat with the agent, settings, and your profile (name, city, and the measurements you choose to give).
This device. A copy of your Life OS is kept in this browser, so it opens fast and works when the connection drops. Signing out removes it when everything has been saved to your account.
How much you use it. A few numbers a day, so we can tell whether Life OS helps people keep going, and whether anything in it starts to do harm: how many times you opened it and for how many minutes you used it; how many things you logged or ticked, how many you missed, and how many of those you picked up again; how many messages you sent the agent, how many of them started a conversation, and how many were sent late at night (from 11 pm to 5 am); how many notifications you opened or acted on, which kinds you turned off, and how many reminders you muted or removed; how many streaks broke and how many you repaired; how many times you were welcomed back; and how many times crisis help lines were shown to you. For each week: how many aims you had and how many you met (prayer and other worship are never counted), and whether you said Life OS helped. Never what you logged or said, which page, any other time of day, or your device. Life OS reads them only as totals across many people, never yours alone, and no analytics company sees them. You can see yours in Settings › Data. They are kept in your account for 400 days and deleted with your data.
Connected accounts (Google Calendar, Microsoft, Fitbit, Strava, Oura, Withings, and apps through Composio), only if you connect them. The keys they give Life OS are kept sealed (encrypted with a key only the server holds), and what is read from them (events, readings) is kept in your account. For an app you connect through Composio, Composio keeps your sign-in and Life OS keeps none.
Groups. If you join a group, its leader sees your name and the progress you send. Progress goes when you send it, or on its own if the group is set up to work that way; you can leave a group at any time.
Reminders. If you switch them on, this browser’s address at your browser maker’s push service is kept, so reminders can reach you when Life OS is closed.
A photo of you, if you add one, and only if you add one.
Photos on a block (before and after, a timeline), only the ones you add. They are made small on your device first and kept in your own private folder in Supabase storage; each is shown through a link that works for ten minutes, never a public one. Deleting a photo deletes its file.
Questions you send out (an invitation, a poll, a sign-up). Anyone with its link can see the question and everyone’s names and answers, except a note about what someone does not eat, which only you see. People who answer need no account; their name and answer are kept with your question, and their browser keeps a key so they can change it. Closing the question stops new answers; deleting your data deletes your questions and their answers.

What leaves Life OS, and where it goes

The agent: DeepSeek, OpenRouter and Liquid AI: When you ask, build or log with the agent, this server sends DeepSeek what you typed or said, any photo you attach, and a summary of your Life OS the agent needs to answer: the names and figures on your pages, your rules and the agent’s memory, and your profile (name, city and country, the coordinates if you saved them, and any body measurements). Never your email or password. DeepSeek runs its own servers, which may be in another country, under its own terms. When DeepSeek cannot answer (its servers are down, or this Life OS’s account with it is out of credit), the same request goes to the same DeepSeek model through OpenRouter, which passes it on to a company that runs that model, under OpenRouter’s terms. What you type in the ask bar, with that summary of your pages and the conversation so far, is also sent through OpenRouter to Liquid AI’s d1-ultra model, which only picks what you asked for (open a page, change a block, a question, a new page) so the agent can answer sooner. When you ask for a new page, your request goes to it too, with the agent’s memory, the titles of your pages and your time and place, to sort it; and when the agent finds pictures, the titles of the page and its blocks and what each picture shows, to pick where one goes. It writes nothing; Liquid AI runs its own servers under its own terms.
Your voice: your browser, or your device: Life OS never receives your audio. By default it uses the speech recognition built into your browser: in Chrome and Edge that is done by a service of Google or Microsoft, and in Safari by Apple, so your audio goes to them. In Settings › Agent, “Listen with › Whisper” turns your speech into words on this device instead, and nothing is sent (the speech model, about 40 MB, is downloaded once from jsDelivr and Hugging Face). Only the words go on to the agent.
Web search: Exa, Tavily, Brave or DuckDuckGo: When a question needs the web, the words the agent searches for go to the search service this server is set up with, and the server reads the pages it finds.
Pictures: Wikimedia Commons, Wikipedia, Wikidata, ExerciseDB, TheMealDB, iNaturalist, Bing Images, Pinterest, DeepSeek and Firecrawl: The name of a dish, place, exercise, plant or everyday thing is looked up to show its picture, and for a place the place its page is about is sent with that lookup so the right one is found. A recipe’s photo, a page’s cover or an everyday thing’s photo may be searched for on Bing Images (only on listed recipe and free stock-photo sites, except for covers), and a recipe site or a place’s Wikipedia article may be searched for with DeepSeek’s or Firecrawl’s web search; only the name is sent. Pictures you ask for from Pinterest are read through Composio: from your own Pinterest when you have connected it, and otherwise from the Pinterest account Life OS keeps for pictures. Only pin images are read that way, and the search words are what is sent. Those photos are checked by the AI model before they are shown. You can switch pictures off in Settings.
Stickers: OpenRouter and OpenAI, only when you turn them on: Stickers are off until you turn them on in Settings › Look. Then the agent reads a page’s blocks to choose one object for each, shown in place of its icon (a tram, a kettlebell), and a sticker Life OS already has is used as it is. A sticker someone else already has for the same object is used as it is, free. A new one is drawn by OpenAI through OpenRouter, sent only those few words naming the object, never your names, numbers or notes; it is kept in your own storage folder and, as it shows only that object, others who need the same object get it too, without knowing it was drawn for you. Your stickers are deleted with your account, except drawings others use, which show only an object and stay.
How an exercise is done: ExerciseDB, and YouTube when you tap it: When you open how a lift is done, its name is looked up on ExerciseDB for its demo, the equipment and the steps; when ExerciseDB does not list it, the agent searches the web for it (above), sending only the exercise’s name. “Watch a video” opens a YouTube search for that name in a new tab when you tap it, and only then.
Place details and map pins: Google Maps, when this server is set up for it: When Google Maps is set up on this server, it sends a place’s name (with the area of the map, or the place the page is about), its Google id when known, or a Google Maps link you paste, to a Google Maps lookup service (google-maps-scraper-l6pc.onrender.com), which reads Google Maps for the place’s rating, reviews, opening hours, photos, address, phone and website; the places a map pins are found there too. Nothing about you is sent with it. The photos load in your browser from Google’s servers (lh3.googleusercontent.com). When it is not set up or does not answer, the services below are used instead.
Place details: OpenStreetMap (Nominatim) and Wikipedia: When you open a place on a map or in a list, this server looks its name up (with the area of the map, or the place the page is about, to pick the right one) to show its address, opening hours, a picture and a line about it. Your browser asks nothing of them itself. “Open in Apple Maps” or “Open in Google Maps” (Apple Maps first on an iPhone, iPad or Mac, Google Maps on anything else), “Directions”, the other of those two, and “OpenStreetMap” go there when you tap them, and only then.
Places, weather and prayer times: Photon, Open-Meteo and Aladhan: When you type a city or a place, or allow your location, this server asks Photon (OpenStreetMap’s search) where it is, sending only the place’s name (or the coordinates, to about 100 metres); your browser never asks Photon itself. The places on a map are found the same way, by this server, once, and saved in the map. For the weather and prayer times, your browser asks Open-Meteo and Aladhan directly, sending the place (or the coordinates) and nothing else. A map block loads its tiles from OpenStreetMap, which sees the area you are looking at. When the agent writes a packing list for a trip, this server asks Open-Meteo for the weather there on the trip’s dates, sending only the place’s name and the dates.
The Quran: quran.ai: When you ask the agent about the Quran, this server asks quran.ai (a quran.foundation service) for the verses, translations and commentary it needs, sending only what is being looked up, never who you are. A verse it quotes links to it on quran.com.
Quran recitations: quran.com: When you tap Listen, an ayah’s number or Hear the word on a portion of the Quran, your browser plays the recording from quran.com’s own servers (verses.quran.com, audio.qurancdn.com, and mirrors.quranicaudio.com for some reciters). Only the recording is asked for; nothing about you is sent with it, beyond what any web request carries.
The mushaf’s fonts: quran.com: When a portion of the Quran is shown in Arabic, your browser loads the King Fahd Complex’s font for each of its pages from quran.com’s font server (verses.quran.foundation), so the ayat look as the printed mushaf has them. Only the fonts are asked for; nothing about you is sent with them, beyond what any web request carries.
Athkar recitations: Hisn al-Muslim: The athkar on an athkar page are kept in Life OS itself. When you tap Listen or Hear it, this server fetches that dhikr’s recitation from hisnmuslim.com by its number, sending nothing about you, and plays it to you.
Typefaces: Google Fonts: Your browser asks Google for the fonts the pages are set in, as any site using them does.
Connected accounts and apps: Only when you connect them, Life OS talks to that service with the keys you approved to read your calendar or readings, and to Composio, which signs in to the apps you connect through it, to let the agent read from them. It reads; it changes something in an app only when you have allowed that app to, and you confirm each change.
Email: Sign-in and reset messages come from Supabase. If you invite someone to a group by email, that address gets one message from Life OS.
Reminders: your browser’s push service: A reminder passes through Google, Apple or Mozilla (whichever made your browser). What it says is encrypted so only your device can read it; they can see that one was sent.

What you can do

Take it with you. Settings › Data › Export a backup gives every page, log, rule and setting as one file.
Delete it. Settings › Data › Delete all your data removes everything in your account (pages, logs, groups you lead, connected accounts and what they brought in, servers and devices) and keeps your sign-in. Delete your account removes the sign-in as well.
Disconnect. Settings › Connections removes a connected account and everything read from it, and tells Google Calendar, Fitbit and Strava to end Life OS’s access on their side too. Outlook, Oura and Withings give Life OS no way to do that, so remove Life OS in their own settings as well; Life OS says so when you disconnect one. Deleting your data or your account does the same for every connected account, and tells you which could not be ended.
Keep the agent out of it. Nothing is sent to the agent unless you ask, build or log with it. Settings › Agent chooses how your voice is turned into words.

Questions about this page go to whoever runs this Life OS.