Privacy

This Privacy Policy explains what personal data SophionOS collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It is a separate document from our Terms & Conditions and our Marketing & Communications Policy, and you consent to each independently.

SophionOS is a life operating system and system of record for interconnected life domains: areas, goals, projects, tasks, notes, resources, topics, and contacts. In this Policy, "SophionOS", "we", "us" means Taha Aalam, a sole proprietor trading as SophionOS, who operates the SophionOS Cloud service. "You" means the person using it.

This Policy covers the SophionOS Cloud service. A self-hosted instance you operate is governed by the operator's configuration, not by this Policy. See Self-hosted Core vs Cloud in the Terms for what that means for processors and legal basis.

It also covers this website, sophionos.com, where the Founding Cohort signup and the founding-seat checkout happen. The next section sets out what this website collects.

This website collects only what you choose to submit: the email address you enter in the Founding Cohort signup form. If you purchase a founding seat, we also store the payment status and a payment reference from Dodo Payments. We do not use cookies for advertising, tracking pixels, or profiling, and we do not sell or rent any personal data.

Signup records (email and payment status) are stored in Supabase, our database provider, on encrypted infrastructure. Confirmation emails are sent through Resend, our email delivery provider. Resend processes the email address only to deliver the messages we send you, under its own data processing terms. Dodo Payments handles the card payment on its own infrastructure under its own terms; we never receive or store your card number.

This site may use Google Analytics 4 to understand aggregate usage, such as which pages are viewed and where visitors come from. GA4 sets first-party cookies such as _ga and _ga_*, and it runs only after you accept the analytics consent banner. We do not use advertising cookies, tracking pixels, or cross-site profiling. You can disable analytics cookies in your browser settings at any time.

The product demo video on the home page is self-hosted and served directly from this site's own servers. No third parties are involved when you play it, and playing it does not set any cookies.

We keep these records until the Founding Cohort program concludes, or until you ask us to remove you, whichever comes first.

If you later become a user of the SophionOS app, the data you store in your workspace is governed by the sections below, which cover the service in full.

We do not ask for blanket consent. Each document is a separate consent item, and you can consent to them independently:

Two of the three are required because the service cannot function without them. The third is optional and is never pre-ticked.

Every consent decision is recorded in an append-only consent log with a timestamp in UTC, the exact version of the document you decided on, and the network address the decision came from. That log is evidence of what you agreed to and when. It cannot be edited or deleted, not by you, not by us, because a record that can be rewritten is not evidence of anything. This is the one category of data we keep after you delete your account; see section 6.

To withdraw consent, use Settings → Privacy & consent. Withdrawing is exactly as easy as granting, takes effect immediately, and is recorded the same way.

If a document changes materially, we publish a new version and show you a notice asking you to review and accept it. Your previous consent record is kept untouched, so you can always see what you agreed to and when.

We collect the minimum needed to run a personal life-management product. Each row states a distinct purpose. We do not reuse your data for a purpose not listed here; introducing a new purpose triggers a fresh, granular consent prompt before any collection.

Authentication is handled by Clerk. We receive your Clerk user id; we do not receive your password.

This is your data. We do not sell it, and we do not use it to train models.

Raw API key secrets are never stored and never exported. Only hashes are.

The in-app assistant is available to signed-in users. It works only for the purposes listed below, and only for the version of this Policy you consented to.

If the assistant is ever extended to a new data type or a new use, for example using it on content you have not opened, or training anything on your messages, that is a new purpose. It is not added to this list silently: it requires a new version of this Policy and a just-in-time consent prompt inside the chat flow, shown before anything new is collected. Declining leaves the assistant working for the purposes above.

The full register of assistant data purposes lives in CHATBOT_DATA_PURPOSES.md in our published source, so any change to it is visible as a diff.

In the SophionOS app, we do not send your content, notes, contacts, or prompts to any third-party analytics provider. We do collect aggregate, non-content operational metrics about how the service performs.

On this website, we run Google Analytics 4 for aggregate page-view analytics, and only after you accept the analytics consent banner. The previous section has the details.

Payments are processed by Dodo Payments, which sells to you as merchant of record; section 4.1 says exactly what goes to them and what they do with it. Transactional email providers receive your email address and the content of the message being delivered.

The current list of subprocessors is published at the subprocessors page. We will give notice before adding a subprocessor that can access your content, and you may object on reasonable grounds.

We do not share your personal data for advertising. We do not sell it to anyone, in any form.

Who sells to you. Paid plans and the one-time founding seat are sold by "Dodo Payments" (as defined in Dodo Payments' Master Service Agreement: Dodo Payments Inc., Dodope Payments Limited, and Sarvapanchhi Technologies Private Limited, collectively the merchant of record), acting as our merchant of record. Dodo Payments is the seller of record for that purchase: it takes your payment, issues the invoice, applies and remits applicable taxes, and issues any refund to the card you paid with. The contract for the purchase is between you and Dodo Payments, under Dodo Payments' own terms of sale. Your use of the Service itself is governed by the Terms & Conditions, which are between you and Taha Aalam.

What goes to Dodo Payments. At checkout Dodo Payments receives:

• your name and email address;
• your billing details, including your billing address and country;
• the payment record: the amount, the currency, the payment method, the transaction status, and the timestamps of the payment;
• your card details, which go to Dodo Payments and its payment service providers and never reach us. We never see or store them.

Whose privacy policy applies. For that payment data, Dodo Payments acts on its own account: it decides why and how the data is processed, to sell to you and to meet its own legal, tax, and fraud-prevention obligations. Dodo Payments' own privacy policy applies to that data and governs your rights over it: dodopayments.com/privacy-policy. We are the Data Fiduciary for the data you create in the Service (section 15) and for your account data; what comes back to us is only what we need to grant the entitlement: your name and email, the payment and subscription identifiers, and the fact that a payment succeeded.

We use a session cookie to keep you signed in. We use local storage for interface preferences, and a first-party identifier so a logged-out visitor's consent record can be linked to their account when they sign up.

We do not use advertising cookies, cross-site tracking cookies, or fingerprinting.

Two things follow from the backup window, stated plainly rather than hidden: if you delete your account, a snapshot taken up to 30 days earlier may still contain your data until that snapshot ages out of the rotation; and we retain your consent log for as long as we operate the service, because the law requires us to be able to demonstrate what you consented to.

We keep billing, tax, and accounting records for as long as the law requires. We keep security and access logs for at least one year: India requires at least one year for data fiduciaries processing under the DPDP Rules, 2025, and the same window covers our incident investigation needs everywhere.

You have the following rights. Each one has an in-app control, not just a policy paragraph, and each is usable without emailing anyone.

Withdrawing consent to marketing stops every promotional email immediately, with no other effect. Withdrawing consent to the Terms or the Privacy Policy means the service can no longer lawfully operate for you, so it closes your account: the app tells you this before you confirm, and asks you to type to confirm.

The service is not directed at children and is not intended for anyone under 18. We do not knowingly collect personal data from children under 18.

To create an account you declare that you are 18 or older. That declaration is recorded, so we can demonstrate we asked.

If you believe a child under 18 has created an account or provided personal data, contact the grievance officer. We will delete that data on verification and will not hold it while the question is investigated, beyond what we need to verify the report.

We do not knowingly serve advertising to children, and we do not use behavioural advertising at all.

Every Data Principal has the right to lodge a grievance with us and to receive a response.

Grievance Officer

Taha Aalam, a sole proprietor trading as SophionOS, is the designated grievance officer. The mailbox is monitored and the postal address is published, so a grievance can be raised in writing as well as in the app.

What you can expect

Raise a grievance in-app at Settings → Raise a grievance. It creates a trackable record with an identifier you can quote in any follow-up. You can also email the officer directly, or use the prefilled email link in the app, which opens your mail client with the subject and your account identifier already filled in.

When you raise a grievance we will ask only for what we need to investigate it. We will not ask you to send passwords, API keys, or the content of your notes.

We encrypt sensitive fields at the application layer before they reach the database, and use row-level database policies as the primary isolation boundary. We keep an immutable record of consent decisions. Access to production data by staff is limited, logged, and reviewed.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board without delay and tell you what we know about it. Our response procedure is published at docs/breach-response.md. See Security for the full statement of what we do and do not claim.

If a personal data breach occurs, we contain it first, then notify. In the event of a personal data breach, we will notify affected users and relevant authorities without undue delay, in accordance with applicable law.

Where the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to you, we intimate the Data Protection Board of India and each affected Data Principal without delay. We notify on what we know at the time: notification is not gated on finishing the investigation, and we tell the authority what changed afterwards.

Where the GDPR applies to you, we notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, in accordance with GDPR Article 33 (and the equivalent requirement under applicable law where you are). We notify affected users without undue delay where the breach is likely to result in high risk to their rights, in accordance with GDPR Article 34.

For users in the United States, we apply the same 72-hour target, which meets or exceeds the notification deadlines under applicable state breach-notification laws.

Any notice we send describes what happened, what data was involved, what we have done, what we recommend you do, and how to reach a person who can answer questions.

We operate the Service from the United States and use service providers in the United States and the European Union. Your personal information may therefore be processed outside your country of residence, including in a country whose privacy laws differ from yours. Where the GDPR applies, we rely on appropriate safeguards for those transfers: standard contractual clauses, or an applicable adequacy decision. Where India's DPDP Act applies, transfers are made subject to any restrictions the Central Government specifies under Rule 15 of the DPDP Rules, 2025.

Scope. This section applies to you if you are in the European Economic Area, the United Kingdom, or Switzerland (together "Europe"). "Personal information" here means "personal data" as defined by the EU GDPR or UK GDPR. The Service is not established in Europe; this notice addresses European data-protection law as it applies to offering the Service to people in Europe.

Controller. Taha Aalam, a sole proprietor trading as SophionOS, is the controller of the processing described in this Policy. Contact: privacy@sophionos.com. Payment data is the one exception: Dodo Payments sells to you as merchant of record and decides how that data is processed, see section 4.1.

Legal bases. We rely on:

• contractual necessity to provide the Service you asked for: your account, your workspace, export, and deletion;
• legal obligation for tax, accounting, and lawful requests;
• legitimate interests in keeping the Service secure and working, preventing abuse, and improving it, where your rights and freedoms do not override those interests;
• consent where you choose to connect an AI client or enable an optional email. You can withdraw consent at any time; that withdrawal does not affect processing that already happened.

Your rights. You may ask us to give you access to your personal data, correct inaccuracies, delete it where there is no continuing reason to keep it, provide it in a machine-readable format for transfer, restrict our processing, or object to processing we base on legitimate interests (including for direct marketing). Where we rely on consent, you may withdraw it at any time. To exercise a right, email privacy@sophionos.com; we may need to verify your identity and will answer within one month, or tell you why an extension applies. You can also lodge a complaint with the supervisory authority in your country of residence.

If you live in a state with a comprehensive consumer privacy law (California, Colorado, Connecticut, Virginia, and the other states that have enacted one), you have the rights that state grants. For California residents, under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use sensitive personal information beyond what is necessary to provide the Service, so there is nothing to opt out of, but you may still ask us to confirm that.

Categories collected in the last 12 months: identifiers (email, name, account id), internet or network activity (log data), commercial information (subscription and founding-seat payments), and user-generated content (your workspace). Sources: you, Clerk, and Dodo Payments. Disclosed to: the service providers listed in section 4. Retention: section 6.

To exercise a right, email privacy@sophionos.com. We will verify your identity against your account email and respond within the period the applicable law allows. You can use an authorized agent where your state permits it.

This section applies if you are in India, or if the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") otherwise apply to our processing of your personal data.

Who is who. You are the Data Principal. Taha Aalam, sole proprietor trading as SophionOS, is the Data Fiduciary for the personal data you give us and for the workspace content you create here. Our service providers act as our Data Processors. Dodo Payments is the exception: as merchant of record it holds the payment data as a Data Fiduciary in its own right, not as our processor (section 4.1). See Subprocessors.

Consent and notice. We process your personal data only on the basis you give us when you create an account, your consent, to provide the Service. This Policy is the notice the DPDP Rules require: it states the personal data we collect, the purposes of processing, how to withdraw consent, and how to exercise your rights or complain. You can withdraw consent at any time, but withdrawing it ends our ability to provide the Service to you, since processing the workspace is the Service. Withdrawing consent does not affect processing done before the withdrawal.

Your rights as a Data Principal.

• Access: obtain a summary of the personal data we process about you and of our processing.
• Correction and erasure: correct inaccurate or incomplete personal data, and have personal data you have given us erased, in each case as described in section 7.
• Grievance redressal: raise a grievance with our Grievance Officer, in the manner and within the timescales set out in section 9.
• Nomination: nominate a person to exercise the rights above on your behalf in the event of your death or incapacity.
• Withdraw consent: as described in section 2, at any time, with the same ease as giving it.
• Complaint to the Board: complain to the Data Protection Board of India at any time, in addition to or instead of contacting us.

The safeguards we take. Where the DPDP Rules, 2025 apply, Rule 6 requires a Data Fiduciary to take minimum safeguards. We meet them as set out in the table in Security: encryption in transit and at rest, hashed API keys, per-user row isolation, and a global AI disable switch. Rule 14 requires us to publish a grievance process and the contact details of the Grievance Officer: section 9 is that notice. Rule 15 governs transfers out of India, addressed in section 12.

A change is published as a new version with its own version number and effective date. Material changes are surfaced to you in-app before they take effect, and require your acceptance. We will not retroactively apply a new version to consent you gave under an older one.

privacy@sophionos.com, monitored. This is the address for privacy matters and for grievances about this Policy. The operator is Taha Aalam, a sole proprietor trading as SophionOS. See section 9 for the grievance officer.

Terms · Marketing & Communications Policy · Security · Subprocessors · Data & AI · Responsible Disclosure