Octavian Interface is a private workspace. What you put in it, and what it reads from accounts you connect, is yours. We do not sell it, we do not show ads, and we do not let anyone else use it. We store it so the app can show it back to you and run the features you turn on.

Your account: the email address and display name you sign up with.

What you add: tasks, journal entries, contacts, goals, deals, meetings, notes, uploads, and settings.

What the app reads from accounts and services you connect: messages, meetings, and transcripts, kept in your workspace as your records.

Personal connector credentials, such as Fieldy keys and calendar links, and platform-managed AI credentials are encrypted with AES-256-GCM before they are stored, and never shown again beyond a short hint. The sign-in tokens for accounts you connect are encrypted the same way.

A log of the AI requests the app made using platform credentials: model, token counts, and cost — so the budget page can be honest with you.

Push notifications: if you turn them on in the iPhone app, the token that lets the app reach your phone, and a log of what was sent to it.

If you connect a Gmail or Google Calendar account, Octavian asks only for read-only access (gmail.readonly, calendar.events.readonly) plus your email address so it can label the connection. It never writes to a Google account.

Outlook asks for more, because Microsoft offers nothing narrower for the two things the app can write: Mail.ReadWrite and Calendars.ReadWrite, plus User.Read to label the connection and offline_access to stay connected. What the app does with that access is limited by the app itself, and each kind of write stays off until you turn it on in Settings, Connectors.

Mail: the app can save a draft in your own Drafts folder, when you ask for one or accept a suggested message. It never sends, moves, flags, or deletes a message. You open the draft and send it yourself.

Calendar: the app can place its own blocks on your calendar (time held for planned work, meeting prep, or a day off) and book a meeting you accept from a suggestion. Every event it creates is marked as its own and recorded, and the only events it ever removes are ones it created. It never changes or deletes an event it did not create. When a meeting you accept has guests, Outlook sends each of them an invitation, as it does for any meeting.

What we do with what we read: show your messages and meetings inside your own workspace, and find the work in them. Notes and tasks it finds are filed into your workspace on their own, each task left without a day for you to choose, and each one is listed under Activity in the Inbox. Everything else is a suggestion you accept or reject yourself. Nothing in a connected account changes except through the writes above, and only once you have turned them on.

What we never do with it: sell it, use it for advertising, or let a human read it — except with your permission, for security, or when the law requires it.

Octavian Interface's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is not used to develop, improve, or train any generalized artificial intelligence or machine learning models — ours or anyone else's.

AI uses credentials managed and funded by the platform owner. You do not need a personal AI provider account. A feature sends the content it needs to the selected provider: mail, documents, journal entries, transcripts, and records used for an answer or report. Anthropic handles private recordings and coaching. When enabled, Typesafe Jev handles bounded decisions and Together handles eligible business analysis. Automated AI features remain off until you enable them.

The platform owner can view usage and spending across eligible accounts. Shared billing does not grant other users access to your private records. Fieldy and other personal source connections remain separate from AI billing.

Scout, which is off until you turn it on, researches people and companies already in your records. It asks Anthropic's web search about them, billed to the platform account, and reads their own public website directly.

The spoken brief is optional too. Its text is sent to ElevenLabs to be read aloud using the platform account.

Stripe processes subscription payments when you choose a paid plan. An account reference associates the purchase with you. Stripe collects the contact and payment details you enter at checkout. We store customer and subscription references, payment status, plan and billing dates. Payment details are entered on Stripe's pages; Octavian does not receive your full card number.

Data is stored in a Postgres database hosted by Supabase, which also handles signing in, with row-level security separating every account from every other. The app and its scheduled jobs run on Vercel. Push notifications are relayed to the iPhone app by Expo, which sees the text of the notification and the token for your device. Traffic is encrypted in transit, and credentials are encrypted at rest.

AI providers use the platform account; source services use the personal connections you authorize:

Anthropic: the AI features and Scout's web searches, as above.

Typesafe Jev and Together: eligible decisions and business analysis when enabled.

ElevenLabs: the text of a spoken brief.

Google and Microsoft: your mail and calendars, as above.

Fieldy: with an API key you paste, the app pulls in your conversations and their transcripts.

Your webhook and forwarding addresses: whatever you, or a mail service you set up, send to the private address the app gives you arrives as a document in your workspace.

These providers process data only to run the service and the features you turn on. No one else receives it.

Disconnect a mailbox or calendar and its sign-in tokens are removed at once; copies already synced into your workspace stay until you delete them, because they are your records.

To delete your whole account, open Settings, Account, and Close this account. You confirm by typing your own email address, and then everything goes at once — tasks, journal, companies, people, deals, goals, meetings, captures, uploads, proposals, the AI usage record, and every key and connector you stored. It is removed, not archived, and it cannot be undone or recovered afterwards.

Closing the account also withdraws the Google sign-ins it holds, before the records of them are deleted. Microsoft publishes no way for an app to withdraw these permissions on your behalf, so an Outlook or Microsoft account has to be disconnected on Microsoft's own page — the app tells you which page, while you can still read it. You can revoke Google's access yourself at any time at myaccount.google.com/permissions.

If you would rather we did it, email us and we will — the result is the same.

If this policy changes in a way that matters, the date at the top changes and the app will say so. Questions, or a deletion request: matt@braceyskyway.com.