WaldorfOS Privacy Policy

Public website visitors

This is an informational website, separate from the private application. Its pages do not access private workspaces, perform Google sign-in, or call services on the owner’s Mac.

The site itself includes no analytics scripts, tracking pixels, third-party fonts, advertising, or account forms. Cloudflare Pages hosts and delivers the pages. As the hosting provider, Cloudflare processes network information such as IP addresses and request details to deliver and protect the site under its privacy policy. Local storage of application records does not mean that website traffic is invisible to its hosting provider.

Public business contact is available at hello@waldorfos.com. Messages are used to respond to inquiries and discuss a possible pilot. Email correspondence remains with the receiving provider until manually deleted; provider backups or operational records may retain copies.

Pilot requests and email

No form is active. Email hello@waldorfos.com to discuss pilot interest. We receive your email address and anything you include, use it to respond, and do not add it to a mailing list or use it for advertising.

Messages to this address are forwarded by Cloudflare Email Routing to a business Gmail inbox handled by Waldorf Enterprises LLC. Cloudflare and Google process email under their respective policies. Messages remain until manually deleted; provider deleted-items, backups, and operational records may retain copies. This website does not store an additional lead database or send messages to private applications or storage.

Website choices and audience

The website source contains no cookies, tracking tools, third-party scripts, or analytics. Cloudflare may process request information and keep provider-side operational records, and may apply security protections under its own policies. This release does not claim that provider logs or security cookies are absent.

The website code does not track visitors over time or across other sites, and does not change its behavior in response to browser Do Not Track signals.

This is a business-software information site. It is not directed to children under 13. It provides no account registration. Inquiry handling is described above.

Waldorf Enterprises LLC operates this website and handles its public business inquiries. The website is separate from the private WOI application and its storage. Website operation does not transfer software IP ownership.

Information processed

WOI stores user-created notes, tasks, projects, workspace records, and application settings locally on the computer running WOI.

When the user explicitly connects Google Calendar, WOI retrieves calendar event information to display an upcoming-events view. The locally cached Calendar snapshot can include:

• event titles, dates, and times;
• event identifiers and recurrence details;
• event links; and
• refresh metadata.

Event descriptions and attendee information are not included in the cached snapshot.

The information the Gmail integration processes is described in Personal Gmail integration.

How Google Calendar data is used

Google Calendar data is used to display the account holder's upcoming events and calendar views inside WOI. This connection is configured under the app name “WOI Personal Calendar”.

Calendar access requests https://www.googleapis.com/auth/calendar.events.readonly and is read-only. WOI cannot create, edit, or delete Google Calendar events.

WOI retrieves Calendar events immediately after the user explicitly connects Google Calendar and completes Google's consent screen. After that, refreshes happen only when the user requests one manually. WOI does not synchronize Calendar data at startup or periodically in the background.

Each retrieval normally covers the upcoming 30 days of events. This 30-day window describes what WOI retrieves; it is not a retention or deletion deadline (see Data retention). Cached calendar information can remain visible when offline and may become stale until refreshed.

Personal Gmail integration

Optional, read-only. WOI’s Personal Gmail integration is designed for one designated personal Gmail account, with access explicitly authorized by the account holder. The Google connection is configured under the app name “WOI Personal Gmail”. Visiting this website does not connect an account.

Consent and permission

Gmail access requires the account holder to choose Connect in WOI and complete Google's consent screen. WOI requests a single permission, https://www.googleapis.com/auth/gmail.readonly, which allows reading Gmail but not changing it. WOI is configured for one designated personal Gmail account and reads that account's email address from Gmail to confirm the expected account was connected.

WOI cannot send, delete, archive, label, or otherwise modify original Gmail messages.

When WOI contacts Gmail

WOI contacts Gmail only in response to explicit user actions:

• connecting, which includes one check of recent message metadata immediately after consent;
• choosing Refresh;
• running a search against Gmail;
• opening the text of a specific message; or
• disconnecting, which asks Google to revoke WOI's authorization.

Checking connection status, navigating within WOI, or searching the local cache does not contact Google. WOI does not synchronize Gmail at startup, poll it in the background, or check it on a schedule.

What is cached locally

WOI keeps a local cache of message metadata, not full messages. For each cached message, this can include:

• message and conversation identifiers;
• the received date;
• Gmail labels and categories, such as Inbox, Unread, or Promotions; and
• these message headers: From, To, Cc, Subject, Date, Message-ID, In-Reply-To, References, List-ID, and List-Unsubscribe.

The cache also holds synchronization state and any local follow-up flags or exclusions the user creates in WOI. Messages in Spam and Trash are not cached.

Cache limits

The cache is a small rolling sample, not a mailbox copy. It holds the metadata of at most 25 messages. Each explicit check (Connect, Refresh, or a Gmail search) retrieves the metadata of up to 25 of the most recent messages from approximately the last 30 days, excluding Spam and Trash, and then replaces the previous sample with the new one in a single step. A Gmail search replaces the sample with up to 25 matching messages from the same window. Messages the user has excluded are not added back, so the sample can hold fewer than 25.

If a check fails or is cancelled, the previous sample is kept unchanged. Because checks happen only when the user asks, the 30-day window is not an automatic deletion schedule: until the next successful check, or until the user clears the cache or disconnects with cache removal, the previously cached metadata stays on the computer, even if it is older than 30 days. WOI is not an email archive and shows only part of the mailbox.

Message text and attachments

Message text is retrieved only when the user explicitly opens a specific cached message. It is held only in memory for display while that message is open and is never written to the cache, to WOI's records, or to WOI's backups. WOI shows plain-text content up to a size limit; it does not render HTML, so some messages may show no text.

Attachments are not downloaded or saved, and WOI does not use Gmail's attachment download function. When a message is opened, Google's response can still include small inline parts of the message, such as embedded non-text content; WOI discards these rather than storing them.

Clearing, disconnecting and revocation

These actions have separate effects:

• Clear cache removes locally cached Gmail metadata. It does not disconnect Gmail or revoke Google's authorization. Local exclusions are kept unless the user chooses to reset them.
• Disconnect stops further Gmail retrieval, removes WOI's locally stored Gmail credentials, and asks Google to revoke WOI's Gmail authorization. By default, Disconnect keeps the cached metadata; the user can choose to remove the cache and exclusions at the same time.
• Removing or excluding a message affects only WOI's cache. The original message in Gmail is unchanged.

WOI reports the result of remote revocation and local credential cleanup separately. Either can fail, and an unconfirmed revocation is not treated as success. The user can also revoke WOI's access at any time from their Google Account permissions.

Removal in WOI is logical and is not a secure erase of the underlying storage. Operating-system backups, cloud backups, and snapshots may retain historical copies.

Separation from Calendar

Gmail credentials are stored separately from Calendar credentials. The Gmail integration uses its own OAuth client in a separate Google Cloud project from the Calendar integration, and WOI refuses to run Gmail and Calendar with the same client. Each has its own authorization: disconnecting Gmail does not disconnect or revoke Google Calendar.

Storage and security

The WOI dashboard currently runs locally on the user's own computer; it is not publicly hosted, and there is no public WOI application server. Application records are stored in local files and databases. The Calendar snapshot is stored locally in the SQLite database of WOI's Personal workspace.

Google Calendar credentials are stored in local files with owner-restricted permissions. The application relies on the device’s storage protections; file permissions are not equivalent to macOS Keychain isolation and do not protect credentials from every process running as the same macOS user.

WOI does not separately encrypt the Calendar cache or WOI's own backup sets.

Gmail credentials and cached Gmail metadata are stored in separate local files with owner-only permissions. WOI checks that FileVault is enabled when it loads the Gmail configuration, but does not monitor it continuously. WOI does not separately encrypt Gmail credentials or cached metadata, and, as with Calendar, this does not protect them from other software running as the same macOS user. Gmail credentials and cache are kept outside WOI's own record backups and exports, but operating-system or cloud backups may still copy them.

No security measure guarantees absolute protection. Local backups or operating-system backups may retain copies of information.

Sharing and third parties

WOI communicates with Google to perform explicitly authorized Calendar and Gmail operations. The current Calendar integration does not send calendar contents to an external AI model, and the Gmail integration does not send Gmail data to an AI model. WOI does not sell Google user data or use it for advertising. This public informational website does not itself connect to the WOI application or expose the user's private workspace records.

Google API Services User Data Policy

WOI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

This commitment applies equally to Google Calendar data and Gmail data.

Calendar control, disconnection and deletion

The user can disconnect the Calendar integration within WOI. Disconnect:

• stops further Calendar retrieval;
• removes WOI's locally stored Calendar credentials; and
• attempts to revoke WOI's authorization with Google.

Remote revocation with Google or local credential cleanup can fail. The user can also revoke WOI's access at any time from their Google Account permissions.

Disconnect alone does not delete the cached Calendar snapshot. The separate Clear cache action logically removes the current snapshot within WOI; it is not a secure erase of the underlying storage. Historical WOI backups and operating-system backups may retain older copies.

User-created WOI records can be managed within the application. Gmail controls are described in Personal Gmail integration.

Data retention

Locally stored workspace records remain until the user removes them or manages the relevant local storage.

The cached Calendar snapshot is not deleted on a 30-day schedule. It is retained after Disconnect and is removed from WOI's current data when the user uses Clear cache. Historical WOI backups and operating-system snapshots may retain older copies under their own retention periods.

The cached Gmail sample of at most 25 messages' metadata remains until the next successful explicit check replaces it, or until the user clears the cache or disconnects with cache removal. Message text is not retained. Operating-system backups, cloud backups, and snapshots may keep older copies under their own retention periods.

Other integrations

W Opportunities is a developing opportunity-discovery and qualification service; WaldorfOS Proposal Studio is planned. Neither is a generally released public service. The Local AI Bridge remains a development direction. This policy does not describe development previews or company-specific procurement tools as public products. Any future external AI connection will require separate authorization and disclosures describing its actual data access and processing before it is offered. Google account data is not sent to an AI model by the Google integrations described here.

Contact and policy updates

Privacy questions may be sent to hello@waldorfos.com. Material changes to live integrations or data handling will be reflected in an updated policy.

Last updated: October 31, 2026