Data Retention & Disposal Policy

Personal OS is a private, single-user application; the account owner is the only data subject. This policy describes what is stored, how long it is kept, and how it is disposed of.

What is retained

• Integration tokens (Microsoft 365, Plaid, etc.) — encrypted at rest; kept only while that integration is connected.
• Records the user enters (prescriptions, notes, personal memory, uploaded documents) — kept until the user deletes them.
• Assistant conversation history — kept until the user deletes the conversation.
• Audit logs — kept to preserve tamper-evident integrity; may be purged by the owner.

What is NOT retained

Raw bank data obtained via Plaid (account balances and transactions) is fetched live per request and not stored. OneDrive files remain in Microsoft's storage and are read on demand, not copied into the app.

Retention period

Data is retained only as long as it is needed for the application to function, or until the user removes it. Data the user deletes, or that belongs to an integration the user disconnects, is not retained.

Deletion & disposal

• Disconnecting an integration immediately revokes and clears its stored token.
• The user can delete individual records — prescriptions, conversations, memories, and documents — at any time.
• On decommissioning, the database and the underlying storage volume are destroyed, permanently disposing of all data.

Data-subject rights

The owner can access, export, and delete their data at any time, consistent with applicable data-privacy laws (including rights of access and erasure).

Review

This policy is reviewed by the owner at least annually and whenever the application's data handling changes.

Contact

Questions: icomike@gmail.com. See also the Privacy Policy.