Privacy

Mihaly is made and operated by Ilya Gindin, an individual based in Georgia (“we”). For privacy questions or deletion requests, contact [email protected].

• Your tasks, plans, rituals, notes and settings are stored on your Mac. Mihaly has no account and no cloud copy of them.
• The Mihaly app has no analytics, no tracking, no advertising and no crash reporting. This website counts visits with Google Analytics, as described in This website.
• Google Calendar is read and written by your Mac directly with Google. Google Calendar data never goes to our servers, to anyone else, or to any AI model.
• Health data from WHOOP or Oura is fetched by your Mac, held in memory and never written to disk or sent to our servers. We never sell it. Only WHOOP data can be shared with the AI assistant, and only after you turn that on; Oura data never goes to AI.
• Data leaves your Mac for the services listed below: Google if you connect Google Calendar, the health service you connect, Apple for weather, the AI tools you have installed (Claude Code or Codex), focus partners if you join them, MeetCal if you connect it, and update and music downloads.

Mihaly stores its data in files in your user folder and in the app's own browser storage. Nothing here is uploaded.

• Your workspace: tasks, backlog, channels, objectives, rituals, highlights, comments, focus sessions and settings. ~/Library/Application Support/Mihaly/workspaces/
• Calendar, weather place and site blocker: which calendars Mihaly reads and writes, your weather location rounded to about a kilometre, and the list of sites you block during focus.
• Assistant and agent files: the AI assistant's memory, mail results, agent runs and the log of which Claude Code and Codex sessions belong to which task. ~/Library/Application Support/Mihaly/ and ~/.mihaly/
• Downloaded music packs for focus sound.
• Keychain: your Google Calendar sign-in tokens, Google account email and calendar choice, your WHOOP or Oura sign-in tokens, a random installation ID used by our sign-in service, and your focus partners sign-in. These Keychain items stay on this Mac and do not sync through iCloud.

Connecting WHOOP or Oura is optional. You connect in Settings → Connections → Health or during onboarding, and you sign in on WHOOP's or Oura's own page in your browser.

What Mihaly reads

• WHOOP (permissions read:sleep, read:recovery, read:cycles, read:workout and offline): sleep start and end, time in bed and awake, naps, sleep need from sleep debt, sleep consistency, recovery score, day strain, and workouts with their sport name, start and end.
• Oura (permissions daily and workout): sleep periods with start, end and total sleep time, the daily readiness score, and workouts with their activity name, start and end.

Mihaly asks for these records only, for the last 56 days. The answers from WHOOP and Oura also carry other fields, such as heart rate; Mihaly drops them on arrival and does not use or keep them. It never reads your profile or body measurements and never writes to your WHOOP or Oura account.

Why

To show your sleep, recovery or readiness and strain next to your plan, mark workouts on your calendar, estimate your energy across the day, and help you plan a day that fits how you slept. Health data is used for nothing else.

How it travels and where it is kept

• Your Mac requests the data directly from WHOOP (api.prod.whoop.com) or Oura (api.ouraring.com).
• To finish sign-in and to renew access, the app sends the one-time sign-in code or the renewal token to Mihaly's sign-in service, which adds the app's secret, asks WHOOP or Oura for tokens and passes them back to your Mac. The service stores no tokens and no health data. To limit abuse it uses your IP address and the random installation ID, in memory only. Its hosting provider, Supabase, keeps ordinary request logs.
• Tokens are stored in your Mac's Keychain, on this Mac only.
• Health records are held in the memory of Mihaly's helper process on your Mac and refreshed from WHOOP or Oura. They are never written to disk by Mihaly and are gone when you disconnect or quit the app.
• The AI assistant's memory refuses health numbers, so they are not stored there either.

Who receives it

We do not receive your health data on our servers, sell or rent it, or use it for advertising. Sharing with the AI assistant is limited to the choice described below.

The AI assistant can read a short summary of WHOOP data for a day or a week (recovery, sleep times, sleep debt, strain, workout types and times, and the energy estimate), only when WHOOP is your primary health service and you explicitly turn on the assistant’s health access in Settings → Connections → Health. This access is off by default. The assistant runs through Claude Code or Codex on your Mac, under your own Anthropic or OpenAI account, so that summary is sent to Anthropic or OpenAI under their terms with you. You can turn this access off at any time in the same settings. Oura data is never sent to the AI assistant, including Oura workouts when both services are connected.

Disconnect and delete

• Disconnect in Settings → Connections → Health. Mihaly deletes the tokens from the Keychain and drops the health records from memory.
• WHOOP: on disconnect Mihaly also asks WHOOP to revoke its access.
• Oura: Oura offers apps no way to revoke access, so after disconnecting, remove Mihaly from the connected apps in your Oura account to withdraw access fully. Mihaly tells you this when you disconnect.
• Delete everything in Settings → Privacy also disconnects WHOOP and Oura.

Mihaly does not store a server-side copy of your health data, so there is no such copy for us to delete. Write to [email protected] with any question about it.

Mihaly reads Apple Calendar through macOS on your Mac, with your permission. If you turn calendar writing on, it adds its own time blocks to the calendar you choose. Apart from what the AI assistant reads (below), Mihaly sends nothing about your Apple Calendar anywhere; your calendars sync the way you have set them up in macOS.

Connecting Google Calendar is optional. You connect in Settings → Calendars → Google Calendar, and you sign in on Google's own page in your browser. Mihaly never sees your Google password.

What Mihaly reads and writes

• Your Google account email (permissions openid and email), to show which account is connected.
• The list of your calendars (calendar.calendarlist.readonly): each calendar's name, color, and whether it is your primary calendar or shown in Google Calendar, so you can choose in Settings which calendars appear in Mihaly.
• Events on the calendars you choose (calendar.events), for the days you look at: title, start and end, all-day or not, whether it is marked busy or free, whether you declined it, whether it repeats, and its link in Google Calendar. Mihaly does not keep descriptions, locations, attendees or attachments.
• Writing, only if you turn it on. With «Write timeboxes to a calendar» on, Mihaly creates, moves and deletes the time blocks it made for your tasks. If you add a meeting to your task list with the plus button and then move or rename that task in Mihaly, Mihaly moves or renames the meeting in Google Calendar to match. Mihaly never deletes an event it did not create.

Why

To show your meetings in your day and week next to your tasks, to let you turn a meeting into a task, and to put your timeboxes back into Google Calendar if you ask for it. Google Calendar data is used for these features you can see in the app and for nothing else.

How it travels and where it is kept

• Your Mac talks to Google directly (accounts.google.com, oauth2.googleapis.com, www.googleapis.com) over HTTPS. Sign-in uses Google's recommended method for desktop apps: your browser and a one-time local address on your Mac, protected with PKCE. No Mihaly server takes part.
• The sign-in tokens, your account email and your calendar choice are stored in your Mac's Keychain, on this Mac only, not synced through iCloud. They never reach the app's page, and Mihaly does not write tokens or event contents to its logs.
• Events are held in the app's memory while Mihaly is open, and the calendar list for five minutes. Mihaly does not keep a copy of your Google Calendar on disk.
• When you add a meeting to your task list, the task you create keeps the meeting's title, time and event ID in your workspace on your Mac, like any other task, until you delete it.

Who receives it

Nobody. We do not receive your Google Calendar data, and we do not sell, rent, share or transfer it to anyone, use it for advertising, or let any person read it.

Google Calendar data is never sent to an AI model. That includes the AI assistant, agents, session reading and the Mihaly tools that Claude Code and Codex use: none of them receive your events, their titles or times, your busy and free time, or tasks you made from meetings, whatever you allow in Settings. Mihaly does not use Google Calendar data to create, train or improve any AI or machine learning model.

Disconnect and delete

• Disconnect in Settings → Calendars → Google Calendar. Mihaly asks Google to revoke its access and deletes the tokens, your account email and your calendar choice from the Keychain, even when your Mac is offline. Events disappear from Mihaly.
• You can also remove Mihaly's access at any time in your Google Account under Security → Your connections to third-party apps and services.
• Delete everything in Settings → Privacy also disconnects Google Calendar and deletes your workspace, including tasks you made from meetings.
• Time blocks Mihaly wrote into Google Calendar are ordinary events in your calendar; disconnecting does not remove them, and you can delete them in Google Calendar.

Because no copy of your Google Calendar data exists outside your Mac and your Google account, there is nothing for us to delete on our side. Write to [email protected] with any question about it.

Google API Services User Data Policy

Mihaly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Mihaly has no AI service of its own and holds no AI keys. Everything AI runs through Claude Code (claude) or Codex (codex) installed on your Mac and signed in to your own subscription. What Mihaly passes to them goes to Anthropic or OpenAI under your account and their terms.

• AI assistant: the short notes in planning and review. It receives what the note is about: the moment of the day, linked task titles, your objectives, things it remembered, Apple Calendar event times, Apple Calendar event titles only if you allow it in Settings, and health only as described above. It never receives Google Calendar data.
• Agents: when you hand a task to an agent, it receives the task's title, notes, subtasks and comments, and works in its own copy of the folder you chose. A task made from a Google Calendar meeting cannot be handed to an agent.
• Session reading: to keep tasks up to date, Mihaly reads your recent Claude Code and Codex sessions on this Mac (~/.claude and ~/.codex) and sends short excerpts with your task titles (never tasks made from Google Calendar meetings) to the engine you pick in Settings → Agents, which says which task a session belongs to. This runs whenever Claude Code or Codex is installed.
• Mail: if you turn mail on, Mihaly reads Gmail read-only through the gog tool on your Mac and passes messages to Claude Code or Codex to find what needs a task. Mihaly never sends, deletes, archives or labels mail.

Focus together is in early access and works only after you join by invite. Its data lives on Mihaly's server, hosted by Supabase, because other people need to see it:

• your display name, city if you add it, and preferred session lengths;
• the communities you belong to, who invited you, and a random device ID;
• sessions you book or join: times, length, who took part, when you joined and left, and late cancellations;
• chat messages in a session and whether the company helped;
• for invite links, a record of attempts with the IP address, to stop abuse.

Other members of your community see your display name, city, session count and the sessions you share. Delete everything signs you out on this Mac but does not remove this data from the server. To delete it, write to [email protected].

• Weather: Apple WeatherKit receives your location, rounded to about a kilometre, to return the forecast.
• MeetCal: if you connect it, Mihaly reads your public booking pages from api.meetcal.cc by your MeetCal username. No password or token is involved.
• Updates: once an hour the app checks mihaly-updates.vercel.app for a new version, and downloads updates from GitHub. The check sends no system profile.
• Music packs: focus sound is downloaded from sound.mihaly.app or its GitHub mirror, with no cookies and no identifiers.
• Videos you paste into a task play from youtube-nocookie.com.

Like any web server, these hosts see your IP address and what was requested.

Export in Settings → Privacy saves your tasks, backlog, rituals and settings as one JSON file.

Delete everything in Settings → Privacy disconnects Google Calendar, WHOOP and Oura, signs you out of focus partners, removes the time blocks Mihaly added to Apple Calendar, forgets your weather place and site blocker list, and deletes your workspace, the AI assistant's memory, mail results, agent runs, the session log, the MeetCal connection and downloaded music from this Mac.

It keeps your own events in Apple Calendar and Google Calendar, recaps of days you chose to publish, and your focus partner data on the server until you ask us to delete it. Deleting the app alone does not remove its files; use Delete everything first.

mihaly.app counts visits with Google Analytics 4, to learn which pages people read, where they come from and how many download the app. Google receives the page address, the referring page, your browser and device type, your IP address (from which it derives an approximate location) and clicks on the download buttons, under the Google Privacy Policy.

• In the EU, the EEA, the UK and Switzerland Google Analytics runs without cookies: it stores nothing on your device and sends only cookieless measurements.
• Elsewhere it sets the Google Analytics cookies _ga and _ga_H9Q9KVC3Z9, which keep a random ID for up to two years so that repeat visits count once.
• Advertising features, ad personalisation and Google signals are off. We do not sell this data or use it for advertising.
• The Mihaly app never loads Google Analytics, and neither do invite pages (mihaly.app/<community>/<code>).

To opt out, block cookies for mihaly.app or use the Google Analytics opt-out add-on. The site is served by Cloudflare, which sees your IP address and the pages requested, as any web server does.

When this policy changes, the date at the top changes with it.

Questions, deletion requests and anything else about privacy: [email protected].