r-os

Privacy Policy

Last updated 18 October 2026

r-os (“r-os”, “we”) is a personal operating system that runs in your browser at r-os.online. It brings your email, calendars, tasks, news and other services into one private desktop, with an optional voice assistant. This policy explains what data r-os handles, why, and the choices you have.

Data we collect

  • Account data: your name, email address and password hash, plus optional passkeys (Face ID, Touch ID, Windows Hello) and an unlock PIN, stored as a one-way hash.
  • Connected account data: when you connect a Google, Microsoft or IMAP account, r-os stores the access tokens or credentials needed to reach it, and syncs your email messages, folders and labels, and calendar events.
  • Content you create: tasks, notes, reminders, desktop layout, settings, news feeds you follow, saved locations, API connectors you set up and conversations with the assistant.
  • Technical data: basic request logs, needed to run and secure the service, and push-notification subscriptions if you enable notifications.

How we use your data

  • To show your email, calendars and other information inside your r-os desktop, and to let you act on it: read, reply, send, archive, create tasks from emails, add calendar events and set reminders.
  • To run features you request, such as summaries, drafts and answers from the assistant.
  • To keep the service secure, prevent abuse and fix problems.

We do not sell your data. We do not use your data for advertising. We do not use your data to train AI models.

Google user data

If you connect a Google account, r-os requests access to Gmail (to read, organise and send email on your behalf), Google Calendar (to show and manage your events) and your email address. This data is used only to provide the features you see in r-os, and only for your account.

r-os’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • Google user data is not transferred to others except as needed to provide the features you use (see “Service providers”), to comply with law, or as part of a merger or acquisition with notice to you.
  • Google user data is never used for advertising, never sold, and never used to build or improve general AI or machine-learning models.
  • No person reads your Google data unless you give explicit permission for a specific message (for example for support), it is needed for security, or it is required by law.

Microsoft user data

If you connect a Microsoft account (Outlook.com, Hotmail or Microsoft 365), r-os uses Microsoft Graph with the permissions you approve (mail, sending mail, calendars and your basic profile) only to provide the same features, under the same rules as Google data above.

AI processing

When you ask the assistant a question or request a summary or draft, the relevant text is sent to our AI provider, Groq, to generate the answer. This includes an email you ask about, or the result of a tool the assistant runs for you. It is sent only for that request. Groq processes it under its API terms and does not use it to train models. Where your browser supports on-device AI, some tasks run locally and never leave your device.

Storage and security

  • Data is stored on our servers in the European Union (Contabo, Germany), in a PostgreSQL database.
  • Sensitive data, including OAuth tokens, mail passwords, email bodies, task notes, connector secrets and assistant conversations, is encrypted at rest with AES-256-GCM using a key unique to your account.
  • Each account is isolated from every other at the database level (row-level security). All traffic uses HTTPS.

Service providers

  • Contabo GmbH: server hosting.
  • Groq, Inc.: AI inference for assistant requests.
  • Open-Meteo: weather forecasts, using only the coordinates of places you save.
  • Your browser’s push service (Google, Apple or Mozilla): delivers notifications if you enable them. It receives notification text only.
  • Google, Microsoft and your mail provider: the accounts you choose to connect.

Retention and deletion

  • You can disconnect any account at any time in Settings → Accounts. Its tokens are deleted immediately, and its synced mail and calendar data are removed.
  • You can revoke r-os’s access from your Google account permissions or Microsoft app permissions page.
  • To delete your r-os account and all its data, email ravindu.lokumanna@gmail.com. We delete it within 30 days. Backups expire within a further 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to or restrict processing. Contact us to exercise these rights.

Children

r-os is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we will update the date above and, for significant changes, notify you in the app.

Contact

Questions or requests: ravindu.lokumanna@gmail.com.