Privacy policy

Overview

This policy explains what the Mou desktop app for macOS and Windows and the website at mou.one do with your information. In short:

• Mou runs on your computer. Your notes, tasks, chat history and settings are stored in a folder you choose on your own machine.
• There is no Mou account. You sign in with Google only when you choose to connect your Google account, and you can disconnect at any time.
• Mou uses an AI provider that you choose and pay for with your own key. Your data goes to that provider only when a feature you use needs it.
• Shared Projects are the one place Mou uses a cloud database. Only what a Project needs goes there, and only project members can read it.
• Mou shows you no ads, does not sell your data and does not use it to train AI models.
• Mou drafts, you review. No email, event, document or message is sent or created on your behalf until you approve it.

The rest of this page gives the details, including the full list of Google permissions Mou asks for and why.

Scope

This policy covers the Mou desktop app and the website at mou.one. It does not cover the services you connect to Mou, such as your Google account or your AI provider. Each of those has its own terms and privacy policy, and your relationship with them is governed by those documents.

“Mou”, “we” and “us” mean the developer of Mou.

Data stored on your computer

Mou keeps your working data in a single data file inside a folder you choose when you first set it up. The default location is C:\Mou on Windows and Documents/Mou on macOS. The file contains:

• your notes, tasks and the comments and history attached to them;
• your chat history with Mou;
• your settings, including the AI provider and model you picked;
• a cache of your inbox: up to the 50 most recent messages from your inbox, excluding Google’s promotions, social and forums categories. For each message Mou keeps the sender, subject, date, labels and category, and the short preview snippet that Google supplies;
• AI summaries of emails and Drive documents you attached to tasks or chats;
• cached triage labels that Mou’s inbox triage assigned to messages.

Some things to know about this file:

• Mou does not encrypt it. We recommend turning on full-disk encryption on your computer (FileVault on macOS, BitLocker on Windows) so that everything on the disk, including this file, is protected at rest.
• The export and backup features in Mou copy this file but leave out your keys and tokens.
• Uninstalling Mou does not delete the folder. Delete it yourself if you want the data gone.
• Settings has a “Clear AI context cache” action that removes the cached summaries and triage labels.
• Disconnecting your Google account removes the Google token from your computer but keeps the cached inbox snapshot, triage labels and summaries until you clear them.

Keys and tokens

Three kinds of secrets are stored on your computer: the Google refresh token that keeps you signed in, the API keys for your AI provider, and, if you use shared Projects, the session that keeps you signed in to the Projects database.

Mou stores them encrypted with the operating system’s secure storage: Keychain on macOS and the Data Protection API on Windows, through Electron’s safeStorage. The Google token and the Projects session live in small files in the app’s own settings folder, separate from your data file. Your AI keys are stored, in their encrypted form, inside your data file, so the file itself contains them in encrypted form (the export and backup features leave them out). If the operating system’s secure storage is unavailable on your machine, Mou stores these values encoded but not encrypted, and if encrypting a key fails Mou keeps that key in plain text. In either case anyone with access to your user account on that computer could read them, which is another reason to keep your disk encrypted.

Your AI keys are only ever sent to the provider they belong to. Mou keeps a fixed list of the providers’ own hosts and refuses to send a key anywhere else.

Mou does not call Google’s revoke endpoint when you disconnect. To revoke Mou’s access to your Google account entirely, visit your Google Account permissions and remove Mou.

Google data: what Mou reads and writes

Mou talks to Google’s APIs directly from your computer. There is no Mou server in between. Data is accessed only when you use the related feature.

What Mou reads

• Gmail: the list of your most recent inbox messages (up to 50, excluding promotions, social and forums) with the sender, subject, date, labels and Google’s preview snippet; the full body of a message when you open it; and the file names of its attachments.
• Calendar: events on your primary calendar and your own free and busy times.
• Drive: the list of your files, search results and file details; and the text of Docs, Sheets and Slides that you open, exported from Google.
• Contacts: search results (names and email addresses) while you type a recipient or guest. They are shown and then discarded; Mou does not store them.
• Google Tasks: all of your task lists.

What Mou writes

Writes fall into two groups. It is worth reading both.

Only after your one-click approval. Mou prepares these and shows them to you first. Nothing in this group happens until you approve it:

• sending an email;
• creating, updating or deleting a calendar event, including the invitations that go with it;
• creating a Doc, Sheet, Slides file or other file in your Drive when you ask for one.

Housekeeping writes that are part of a feature you turned on. These happen as part of the feature, without a separate review step for each one:

• creating a Mou folder tree in your Drive, and one folder per shared Project;
• sharing a Project’s folder with the members of that Project as writers (Google does not send a notification email for this);
• writing AI-generated summaries of files and tasks into the Mou/Mou User Context folder in your Drive, and into a Mou Project Context folder inside each shared Project’s folder;
• publishing your busy blocks to the members of a Project when availability sharing is on;
• two-way sync with Google Tasks, which inserts, updates and deletes the tasks you sync;
• Gmail label changes when you mark a message read or unread, archive it, or report it as spam.

Mou never deletes mail and never sends an email without your approval.

Why Mou asks for each Google permission

When you connect Google, the consent screen lists nine permissions. Here is what each one is for and what Mou does with it. Scopes are shown by their short names. Apart from openid and email, each one is https://www.googleapis.com/auth/ followed by the name shown.

Mou accesses Google data only when you use the feature that needs it. That includes the features you leave switched on that run on their own when you open a view, such as inbox triage when you open Mail and the morning pass and auto-draft sweep the first time you open Home each day, which are described under “Your AI provider”.

Google API Services User Data Policy

Mou’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

In practice this means:

• Mou uses Google user data only to provide or improve features that you can see and use in the app.
• Mou transfers Google user data only to the AI provider you selected, and only to provide those features; otherwise only for security purposes or when required by law.
• Mou does not use Google user data for advertising.
• No person reads your Google user data unless you have given your consent, it is necessary for security, it is required by law, or the data has been aggregated and anonymised for internal operations.
• Mou does not use Google user data to develop, improve or train generalised AI or machine-learning models.

Your AI provider

Mou works with three AI providers: OpenAI, Anthropic (Claude) and Google (Gemini). There is no default. You choose a provider and a model, enter your own API key, and pay the provider directly. Your use of the provider is governed by its own terms:

• OpenAI API data usage
• Anthropic commercial terms
• Gemini API terms

Apart from the small on-device model described under “Other network connections”, Mou runs no AI models of its own: the model you choose runs at your provider. Apart from your chat history, the summaries described above and a local count of the tokens you have used, Mou keeps no copy of what you send to a provider, and does not train anything on your data. Whether a provider uses what you send to improve its own models is governed by that provider’s terms, so please read them.

What is sent, and when

• Inbox triage. This is on by default. When you open the Mail view, and once a day during the morning pass, Mou sends the sender, subject, date and category of up to 50 inbox messages, together with Google’s preview snippet of up to 160 characters for each, so the provider can sort and label them. You can turn triage off in Settings.
• An email body. Up to 8,000 characters of a message are sent only after you attach that message to a task or chat and confirm.
• A Drive document. When you attach a Doc, Sheet or Slides file and confirm, Mou sends up to 20,000 characters of its text so the provider can write a short summary, which Mou then stores in your Drive and reuses. When a Drive file is linked to a task and that task is attached, the file’s full text, up to 100,000 characters, is sent with it; the preview shows the size before you confirm.
• Calendar details. When you send a chat message with a day, a week, a month or a single event attached, Mou sends each event’s title, time, attendees and their responses, location, up to 1,500 characters of description and the names of its attachments. Today’s events are also part of the morning pass.
• The morning pass. The first time you open Home each day, Mou sends up to 25 open tasks due within the next seven days (title, status, due date and the first 120 characters of the description), up to 15 of today’s events and the latest mail digest so it can prepare your day.
• Project context refresh. For a shared Project, Mou sends the members’ names and email addresses, the Project’s tasks, summaries of its notes and the events of the next seven days.
• Finding context automatically. This is on by default. When a chat message looks like it needs your data (for example a question, or a mention of your schedule, tasks or mail), Mou first sends the message and a list of the titles of your notes, tasks, events, recent mail (sender and subject), Drive files and Projects to your provider so it can choose which items are relevant, then up to 600 characters of each chosen item’s content. This happens before the preview and before you confirm. You can turn it off in Settings.
• Chat and drafts. Whatever you type in a chat, plus the context you attached, is sent when you send the message. Before a chat message that carries attached context is sent, Mou shows an estimate of the tokens it will use. When you ask Mou to draft from a task, it sends the task’s title, description and due date, the text of the note the task came from, and any instructions, notes or Drive documents you attached in the task editor. When Mou drafts in the background for your review (up to a daily cap you set in Settings, three by default), it sends the task’s title, description and due date and up to 4,000 characters of the note the task came from; it does not send the context attached to the task.

Shared Projects

Everything described so far stays between your computer, Google and your AI provider. Shared Projects are the exception: when you create or join a Project, Mou uses a cloud database so that the members can see the same tasks, notes and events. The database is hosted on Supabase, which provides the Postgres database, sign-in and realtime updates.

For Projects, Mou stores:

• your profile: your email address, and your name and avatar if Google provides them, created when Mou signs you in with your Google ID token;
• the email addresses of people invited to a Project, until the invite is accepted or revoked;
• the Project’s tasks and notes;
• the Project’s events, with their Google event IDs, attendee email addresses and Meet links;
• each member’s accepted or declined response to a Project event, and any note or alternative time they proposed;
• a short clean-up record (the Google event ID, title and Project name) for Project events that must be removed from members’ calendars;
• the busy blocks of each member who shares availability. This is on by default. Turning it off removes your blocks from the database;
• while you have a Project open, a live presence signal so that other members can see who is in the Project. It is not kept after you leave;
• the IDs of synced Google Tasks and the ID of the Project’s Drive folder;
• the AI drafts and results attached to shared tasks (email drafts, event drafts and file plans) and the short AI-written summary of each shared task.

Access is limited to the members of the Project by database rules (row-level security that denies everything by default). Your personal notes, your mail and your files never go there. As the operator of the database, we can access it to run it. We do not read your content except to troubleshoot with your permission, for security reasons, or when the law requires it. To have your profile or a Project’s data deleted, email contact@mou.one.

Other network connections

Besides Google, your AI provider and the Projects database, the app connects to a few other services. Each of them sees your IP address and handles it under its own privacy policy.

• GitHub. On launch and every four hours Mou checks for new releases. The check is anonymous. Nothing is downloaded until you accept an update.
• Hugging Face. The first time it is needed, Mou downloads a small language model (about 25 MB) that runs on your computer. This happens once.
• Websites you add to the Links card. When you add a link to the Links card on your Home page, Mou fetches that page once to show its title and image.

Mou does not show ads, does not sell your data and does not share it with data brokers.

What Mou does not do

• The app sends no analytics, telemetry or crash reports to us.
• Mou shows no ads and does not share your data for advertising.
• Mou does not sell your data.
• Mou does not use your data to train AI models.

Planned capabilities

We plan to add connected apps such as Slack, Teams, Jira and GitHub, and meeting capture. None of these is active today. Each one will ask for its own consent before it accesses any new data, and this policy will describe it before it ships. Meeting capture will be opt-in for the people being recorded, and in Education deployments it will require the instructor’s opt-in.

This website

mou.one is a static website served by Cloudflare. To deliver and protect the site, Cloudflare processes connection logs such as your IP address and browser user agent under its own privacy policy.

• We use Cloudflare Web Analytics, which is cookieless, does not fingerprint your browser and reports only aggregate page views, referrers and countries.
• mou.one sets no cookies.
• The site uses your browser’s local storage only for interface preferences, such as a dismissed first-visit hint or a motion override. These values never leave your browser.
• Email links open your own email app. The site has no forms.
• Fonts are served from mou.one. The site loads nothing from third-party domains other than the Cloudflare analytics script.

Your choices

• Disconnect Google in Settings to remove the Google token from your computer. This also signs you out of shared Projects on that computer.
• Revoke Mou’s access completely at your Google Account permissions.
• Turn inbox triage off in Settings if you do not want mail metadata sent to your AI provider.
• Clear the AI context cache in Settings to delete cached summaries and triage labels.
• Export your data from Settings. The export leaves out keys and tokens.
• Delete your data by deleting the Mou folder on your computer.
• Uninstall Mou at any time. Remember to delete the folder as well.
• Ask us to delete your Projects profile or a Project’s data by emailing contact@mou.one.

Security

Mou uses HTTPS for every connection to Google, your AI provider, the Projects database and the other services listed above. Secrets are stored with the operating system’s secure storage, with the fallback described under “Keys and tokens”. Your data file is not encrypted by Mou, so we recommend full-disk encryption. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security. If you believe you have found a security problem in Mou, please email contact@mou.one.

Children

Mou is not directed at children under 13, or under the age at which a person can consent to the processing of their data where they live, if that age is higher. Where an institution deploys Mou for Education, the institution administers who may use it.

Changes

We may update this policy as Mou changes. The date at the top of this page shows when it was last updated, and material changes will be noted on this page.

Contact

Questions about this policy or about your data: contact@mou.one.