OpptiOppti Privacy Policy
Effective date: October 25, 2026
Controller: Bernardo Moreno, doing business as Oppti · support@oppti.app
The short version
- Your emails, Slack messages, calendar events, and tasks never leave your Mac. Oppti reads them on-device to build your list. We have no servers that receive them, and we can't see them.
- Login tokens for your linked accounts are stored in your macOS Keychain. Your task list is stored encrypted on your Mac.
- We collect only what we need to sell you a membership: your email address and payment details (handled by our payment processor) and your license key.
- No ads. No selling or sharing of data. No tracking or analytics in the App.
1. Information processed on your device (we never receive it)
When you link an account, the App connects directly from your Mac to that provider:
| Source | What the App reads | Access level |
|---|---|---|
| Gmail | Message headers (from, to, subject, labels, date) and the short preview snippet of recent inbox threads | Read-only (gmail.readonly); the App can't send, delete, or change mail |
| Slack | Recent direct messages, group DMs, and messages that @mention you; names of the people who sent them | Read-only user scopes |
| Outlook / Microsoft 365 | Sender, recipients, subject, flags, importance, and the short preview of recent inbox messages | Read-only (Mail.Read) |
| Apple Calendar & Reminders | Upcoming events and reminders that are due soon (including Google or Outlook calendars you've added to macOS) | macOS permission you grant; stays local |
| GitHub | Your notifications: review requests, @mentions, and assignments | A personal access token you create, limited to notifications |
| Linear | Open issues assigned to you | A personal API key you create (read access) |
| Email linked with an app password (Gmail, iCloud Mail, Yahoo, or any IMAP provider) | Sender, recipients, subject, flags, and the first few lines of recent inbox messages; and, from your Sent folder, only which conversations you replied to | An app password you create, used over an encrypted connection. The mailbox is opened read-only, so nothing is marked read, moved, or deleted |
| Calendly | Your upcoming booked meetings (name and time) | A personal access token you create |
| Other apps you link (for example Canvas, Trello, Jira, Zendesk, Asana, TrackHS, or any app through a calendar link or "Custom API") | Only what that link or key returns: typically items assigned to you or on that calendar, with their title, due date, and link | The key, token, or calendar link you provide. Oppti only reads; it never changes anything in those apps |
Tokens, API keys, and private calendar links you paste are stored only in your macOS Keychain and sent only to the service they belong to, over an encrypted (https) connection. Oppti refuses unencrypted http:// connections.
From these, the App creates tasks (a short title, a snippet of up to ~140 characters, a link back to the original, and the reasons it was ranked). Tasks, your preferences, and a local record of which senders you tend to act on are stored on your Mac, encrypted with AES-256. The encryption key is kept in your Keychain.
Completed and dismissed tasks are deleted automatically after 30 days. Open tasks with no due date are archived after 14 days, and meeting-prep tasks are removed once the meeting starts. You can erase everything, including the encryption key and all linked accounts, at any time in Settings › Privacy › Erase all Oppti data. Uninstalling the App and deleting ~/Library/Containers/app.oppti.mac also removes it.
2. Information we collect
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Email address, name, billing country, and payment details — collected and processed by our payment processor | To sell and manage your membership, send receipts and renewal reminders, and comply with tax law | Contract; legal obligation |
| License key and a random activation ID per Mac, sent to our licensing provider when you activate and about once a day | To confirm your membership is active | Contract |
| Messages you send to support | To help you | Legitimate interest |
We don't receive card numbers; the payment processor does.
3. Slack sign-in helper
Slack requires an app secret to finish connecting an account, and that secret can't safely be put inside a desktop app. So, once, at the moment you connect Slack, the App sends the one-time authorization code to a small service we run at auth.oppti.app. That service exchanges the code with Slack and passes the resulting access token straight back to your Mac. It doesn't store or log the code or the token, and it never sees your messages. All later Slack requests go directly from your Mac to Slack.
4. Google API disclosure
Oppti's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to provide the App's user-facing prioritization features; it isn't transferred to us or anyone else; it isn't used for advertising; it isn't used to train AI or machine-learning models; and no human reads it.
5. Sharing
We don't sell or rent personal information, and we don't share it for cross-context behavioral advertising. We share the limited data in Section 2 only with:
- Our payment processor — payments, tax, and license validation
- Apple (iCloud Mail) — hosts our support@oppti.app inbox, if you email us
- Cloudflare — hosts the Slack sign-in helper and our website
- Authorities, when required by law
6. Retention
Billing records are kept as long as tax law requires (typically 7 years). License records are kept while your membership is active and for 12 months afterward. Support emails are kept for 24 months. On-device data stays on your Mac under your control.
7. Your rights
Depending on where you live (including the EU/UK under GDPR, California under CCPA/CPRA, and other U.S. states), you may have the right to access, correct, delete, or port your personal information, to object to or restrict processing, and to not be discriminated against for exercising these rights. Email support@oppti.app and we'll respond within 30 days (45 days for California requests). EU/UK residents can also complain to their local data protection authority.
Since your linked-account content is only on your Mac, you can delete it yourself instantly using the erase button described above.
8. Security
OAuth tokens are kept in the macOS Keychain (this device only, not synced). Local data is encrypted with AES-256-GCM. The App runs in Apple's App Sandbox, is code-signed and notarized by Apple, and only requests read-only access. No system is perfectly secure; if we learn of a breach affecting your data, we'll notify you as the law requires.
9. Children
Oppti isn't directed at children under 16, and we don't knowingly collect their information.
10. International transfers
Our service providers may process billing data in the United States and elsewhere, under Standard Contractual Clauses or other lawful transfer mechanisms.
11. Changes
If we make a material change, we'll notify you by email or in the App before it takes effect.
12. Contact
The fastest way to reach us is email: support@oppti.app. We answer every message, usually within a day.
Postal address for formal legal or privacy notices: Bernardo Moreno, doing business as Oppti, 1401 21st Street, Suite R, Sacramento, CA 95811. Please don't send support requests, returns, or packages to this address; it doesn't handle them.