Privacy Policy

MySphere is a personal life operating system. Your data is the product you pay us to hold, not the product we sell to anyone else. This page explains what we store, how we use it, and the controls you have over it.

What we collect

The data you create inside MySphere: tasks, goals, habits, budget entries, health entries, meals, journal entries, calendar events, and related records. Account information (email, name, authentication credentials). Basic usage signals to power recommendations and the AI assistant for your own account.

How we use it

• To provide the features you signed up for.
• To generate personalized insights, reminders, and AI answers scoped to your own data.
• To secure your account (rate limiting, fraud detection, audit logs).
• To communicate with you about account, billing, and service updates.

What we do not do

• We do not sell your data. Not in aggregate, not anonymized, not ever.
• We do not use your personal data to train third-party AI models.
• We do not run third-party advertising, and we do not use cross-site advertising trackers. We do use Google Analytics and Sentry, described below.
• We do not share your data with other users outside the sharing controls you explicitly configure (Household, granted-to lists).

Third-party services

MySphere uses a small number of operational vendors to function:

• Self-hosted MongoDB: your records live in a database we operate ourselves, not a third-party managed cluster.
• AI assistant: runs on Bialkowned's own private AI server. Your prompts, and the slice of your own data needed to answer them, are processed there and are not sent to an outside AI company.
• Google Analytics: measures how the website is used (pages viewed, referring site, browser and device type, approximate location). It sets Google Analytics cookies in your browser. It does not receive the contents of your MySphere account.
• Sentry: error monitoring. When a page fails, it records the error, the page address, and your browser and device type so we can fix it. It is set to report errors only, not to track your activity.
• Stripe: payment processing for paid plans. Card details never touch our servers.
• Resend: transactional email (verification, password reset, family invites).
• Integration providers: Google, Microsoft, Fitbit, Plaid, etc., only when you explicitly connect them in Settings.

Google user data

If, and only if, you connect a Google account in Settings → Integrations, MySphere requests the narrowest scope that makes each feature work. Nothing is read before you complete the Google consent screen, and every sync below is read-only except Google Tasks.

• Calendar (calendar.readonly): reads your events so they appear on the MySphere calendar and feed your daily briefing. We never create, edit or delete Google events.
• Tasks (tasks): two-way sync, so a task you complete in either place is complete in both. This is the only Google scope we write with.
• Drive (drive.file): a per-file scope: we see only files you have explicitly created or opened with MySphere, never your wider Drive. We index the name and link, and do not download file contents.
• Classroom (classroom.courses.readonly, classroom.coursework.me.readonly): reads your courses and their materials so they appear in the Education module.
• YouTube (youtube.readonly): reads your liked videos and your own playlists so they can be saved as Resources.
• Fitness (fitness.activity.read, fitness.sleep.read): reads activity and sleep figures to populate the Health module.
• Email address (email): identifies which Google account a connection belongs to, so you can tell two connected accounts apart.

Google data is stored in your own account's records in our database, is covered by the same retention and deletion rules as everything else on this page, and is never sold, never used for advertising, and never used to train any AI model. It is not transferred to anyone except the operational vendors named above, and only where required to run the service. You can revoke access at any time from Settings → Integrations, or from your Google Account permissions page; disconnecting deletes the stored tokens immediately.

MySphere's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your rights and controls

• Export: request a full export of your data from Settings → Import & Restore at any time.
• Delete: delete your account and associated records from Settings → Profile. Account deletion is hard-deletion; audit log entries required for legal compliance may be retained per the retention schedule below.
• Correction: edit or remove any record you created.
• Sharing: every record has explicit visibility controls (private / family / granted-to) that you set.

Retention

Account and user-content data is retained for as long as your account is active. After deletion, data is removed from live databases; automated backups may retain copies for up to 30 days before expiry. Audit log entries required for compliance (sign-in events, permission changes, billing events) are retained separately for up to 24 months.

Security

Passwords are stored as salted hashes (never in plaintext). Authentication uses short-lived JWT access tokens with httpOnly refresh cookies. Integration credentials are encrypted at rest. All traffic between your device and MySphere runs over HTTPS. In the event of a data breach materially affecting your account, we will notify affected users without undue delay and, where required, within the timeframes mandated by applicable law.

Cookies and local storage

MySphere uses the minimum necessary cookies and browser storage to operate: an httpOnly refresh-token cookie for authentication, and localStorage keys for UI preferences (theme, enabled modules, onboarding state). We do not use third-party advertising cookies or cross-site tracking pixels. Google Analytics sets its own cookies to measure website usage, as described under Third-party services. We do not sell the contents of your browser storage to anyone. MySphere currently does not respond to browser "Do Not Track" signals because it does not engage in the cross-site tracking those signals are designed to opt out of.

Children's privacy

MySphere is not directed to children under 13. We do not knowingly collect personal information from a child under 13 as an independent account holder. Household plans allow an adult account holder to create child profiles for minors under 13, in which case the adult is responsible for obtaining any consents required by applicable law (including, in the United States, the Children's Online Privacy Protection Act). If you believe a child under 13 has created an independent account, contact us and we will remove it.

AI-assisted features and automated processing

MySphere uses automated processing (including large language model output from a model running on Bialkowned's own private AI server) to generate insights, reminders, correlations, and recommendations scoped to your own account data. These outputs are informational and are never used to make decisions that produce legal or similarly significant effects on you. You can disable AI features entirely from Settings → AI Assistant at any time. No automated decision we make affects your access to the Service or to your own data.

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect about you, to request a copy of that information, to request deletion, and to correct inaccurate information. You also have the right to opt out of the sale or sharing of personal information. Note that MySphere does not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of, but the right is disclosed here as required. We will not discriminate against you for exercising any of these rights. Exercise them by emailing [email protected] from the email address on your account.

EEA, UK, and Swiss residents (GDPR / UK GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, MySphere acts as the data controller for the personal data you provide. Our legal basis for processing is (a) the performance of the contract between us (your account), (b) your consent where you have opted into specific features, and (c) our legitimate interests in securing and improving the Service. You have the right of access, rectification, erasure, restriction, objection, and data portability, and the right to lodge a complaint with a supervisory authority. MySphere is operated from the United States; by using the Service you acknowledge that your data may be transferred to and processed in the United States, and we rely on standard contractual clauses or equivalent safeguards where our processors are engaged to process EEA/UK/Swiss personal data.

Contact and data protection requests

For questions about privacy, data, or this policy, or to exercise any rights described above, contact [email protected]. Please send requests from the email address associated with your account so we can verify your identity.

MySphere is operated by Bialkowned, LLC. This policy may be updated as the product evolves; material changes will be announced in-app and the "Last updated" date above will reflect the revision.