Privacy Policy

This Privacy Policy explains how CoWork OS handles information when you use the CoWork OS website, desktop app, open-source software, and optional integrations.

CoWork OS is designed as a local-first AI agent workspace. Your prompts, files, connected accounts, generated outputs, credentials, and workspace state generally stay on your device or infrastructure unless you choose to connect external providers, channels, model APIs, or hosted services.

Depending on how you use CoWork OS, the app may process information that you provide directly, information in local workspaces you select, and information from connected services you authorize.

• Account and contact information, such as your name, email address, support messages, or OAuth account identity.
• Workspace content, such as prompts, documents, source files, notes, tasks, messages, generated artifacts, logs, and configuration.
• Integration data from services you connect, such as email, calendar, chat, repository, storage, payment, or productivity tools.
• Technical data needed to operate the website or app, such as device, browser, IP address, crash, diagnostic, and server log information where hosting or runtime infrastructure records it.

Pulse-enabled versions offer optional usage reporting, disabled by default, through onboarding, Settings → CoWork Pulse, and the cowork telemetry CLI. With your opt-in, the app sends daily aggregate task outcomes, coarse tool categories, reliability counts, a task-duration bucket, app version, operating-system family, architecture, and runtime to pulse.coworkosapp.com. The collector is hosted on Cloudflare Workers with a dedicated D1 database.

Pulse uses a random profile identifier rather than a hardware or account identifier. The server stores an HMAC pseudonym, a deletion-token hash, aggregate rows, and receipt metadata. These records support measurement of useful task completion and return usage across days. Pulse excludes prompts, responses, file names and contents, commands, URLs, workspace/task/session IDs, custom tool names, provider/model routes, account data, and raw errors.

The independent update request sends version, platform, architecture, and surface without a profile identifier and contributes daily request counts even when Pulse usage reporting is off. Pulse application code does not read or store source IP addresses; Cloudflare necessarily processes network requests under its own infrastructure controls.

Daily usage and update-check rows are retained for 24 months. Active profile metadata may remain longer; inactive profile records with no remaining daily rows are removed after 730 days without an update. Non-identifying deletion counters remain. Self-service deletion removes the current profile and its usage from the live database; it does not explicitly purge infrastructure recovery snapshots or separate backups.

Turning Pulse off discards queued packages and stops future collection attempts, but an already running request may finish. Successful remote deletion also disables Pulse locally. Resetting the identifier does not delete previous remote data and replaces its deletion token; delete remote data before resetting if you want the old records removed. Local Usage Insights and operator-configured telemetry are separate from CoWork Pulse.

If you connect a Google account or use Google APIs, CoWork OS requests only the permissions needed for the features you enable. For example, Gmail or Google Workspace integrations may process message, label, attachment, profile, or related metadata needed to summarize, draft, search, organize, or act on your authorized workspace data.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. CoWork OS does not sell Google user data, use it for advertising, or use it to train generalized AI or machine learning models.

Google API data may be sent to model providers, infrastructure, or tools that you explicitly configure or authorize when necessary to provide the user-facing feature you requested. You are responsible for choosing providers and workflows that meet your privacy and compliance needs.

Google API data processed by CoWork OS remains on your device unless you explicitly configure a connected service, such as an AI model provider, that requires transmitting data for the workflow you requested. CoWork OS does not maintain any server-side copy of your Google data. When data is sent to a user-configured provider, it is transmitted only for the duration of the requested operation and is not cached or stored by CoWork OS beyond the local task history on your device.

CoWork OS uses information to provide requested app functionality, run agent workflows, authenticate connected services, save user preferences, support troubleshooting, improve reliability, maintain security, and communicate with users.

The app may also use local logs, task history, and generated outputs so you can review past work, audit agent activity, resume tasks, and understand what actions were taken.

Local CoWork OS data is stored on your device or in locations you configure. OAuth tokens, provider keys, logs, task outputs, memory, and workspace artifacts may be retained so the app can keep working across sessions.

You can delete local app data, revoke connected accounts, remove OAuth grants, rotate API keys, and delete generated outputs using the app, operating system, provider consoles, or source-code configuration. Data handled by third-party services is retained according to those services and your account settings.

CoWork OS shares information only when needed to operate features you choose, comply with law, protect security, or support the project.

• Model and API providers you configure, such as LLM providers, transcription providers, hosting providers, or tool APIs.
• Connected services you authorize, such as Google, Slack, GitHub, calendar, email, storage, messaging, and similar integrations.
• Infrastructure providers used to host the public website, serve downloads, process logs, or deliver support communications.
• Legal or safety recipients when disclosure is required by law or necessary to protect users, the project, or the public.

CoWork OS uses local-first design, scoped integrations, approval-oriented workflows, and documented security controls to reduce unnecessary exposure of sensitive data. No software can guarantee perfect security, especially when users connect powerful third-party services or run agent workflows with broad permissions.

Specifically, OAuth tokens and API credentials are encrypted at rest using the operating system's native secure credential storage.

• macOS: Keychain Services via Electron safeStorage.
• Windows: Data Protection API (DPAPI) via Electron safeStorage.
• Linux: libsecret (GNOME Keyring / KDE Wallet) via Electron safeStorage.
• Fallback: AES-256-GCM encryption with a PBKDF2-derived key unique to the device.

All OAuth authorization flows use PKCE (Proof Key for Code Exchange) with SHA-256 challenges to prevent authorization code interception. Tokens are exchanged directly between your device and Google's servers; no intermediary relay or proxy is involved. Token refresh occurs automatically and locally. Expired or revoked tokens are cleared from secure storage and the user is prompted to re-authenticate.

Use least-privilege scopes, review actions before granting approvals, keep your device secure, rotate compromised credentials, and revoke integrations you no longer need.

You can choose which workspaces, providers, accounts, channels, and APIs to connect. You can revoke OAuth access from your Google Account or provider security settings at any time.

You may contact us to ask privacy questions or request deletion of information that we control. Because CoWork OS is local-first and open source, much of your app data may be stored only on your own device or infrastructure, where you control deletion directly.

For more information about Google's requirements, review the Google API Services User Data Policy and the Google Workspace API user data and developer policy. Third-party services you connect may have their own privacy policies and terms.

We may update this Privacy Policy as CoWork OS changes. When changes are material, we will update the date above and, where appropriate, provide additional notice before the updated policy applies.