Privacy Policy

Last updated: October 27, 2026

The short version

Moss is software you run on your own computer or server. The Moss project does not run a service that stores your data, and it does not receive your notes, email, calendar, or conversations. The person who installs Moss controls where the data lives.

This policy covers the Moss software, this website (meetmoss.com), and the Google sign-in that Moss offers.

This website

The website is a static page. It has no accounts, no cookies, no analytics, and no advertising. Our web host and Cloudflare, which delivers the site, may keep ordinary server logs such as IP address and page requested, for security and reliability.

What Moss stores, and where

Moss keeps its database, files, notes, and settings on the machine where it is installed. Data is private to each user by default and is shared only when a user explicitly shares it. Administrators of an installation can configure it but cannot read other users' private data. Passwords are stored as hashes. Connector and AI credentials are encrypted at rest.

Google user data

If you choose to connect a Google account, Moss asks Google for access to the following, and only for the features you turn on.

• Gmail (read and modify mail): so Moss can read messages, search them, show them to you, and help you act on them, such as labeling or archiving. Moss only sends mail when you ask it to.
• Google Calendar: so Moss can show your upcoming events and, when you ask, create or change events.
• Basic profile and email address: so Moss can identify the account you are signing in with.

Moss uses this data only to provide those features to you inside your own installation. Google data is stored on your installation, encrypted credentials included, and is not sent to the Moss project, sold, or used for advertising. It is not used to train generalized AI models.

AI providers. Moss is a bring-your-own-AI assistant. When you ask Moss a question that needs email or calendar content, the relevant pieces are sent to the AI provider you configured (for example Claude, Codex, or Gemini) so it can answer. That provider's own terms and privacy policy apply to what it receives. Moss does not let humans at the Moss project read your Google data.

Limited Use. Moss's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

Google data stays in your installation until you remove it. Disconnecting a Google account in Moss Settings stops all access and removes the stored credentials. You can also revoke Moss's access at any time from your Google Account's third-party access page. Deleting your installation's data volumes removes everything Moss stored.

Other services

Features such as weather, news, and sports fetch information from outside sources on your behalf. Those requests go from your installation to those services, which have their own policies.

Children

Moss is not directed at children under 13.

Changes

We will post changes here and update the date above.

Contact

Questions or requests: open an issue on GitHub.