Privacy Policy

• The manager app keeps data on your computer, in an encrypted database. The server keeps what you and your team share, to sync it and to power the portal.
• Private notes never leave your computer and never go to the AI. Their backup, if you turn it on, is end-to-end encrypted with a code only you have.
• AI starts switched off. It only works after the organization's owner or an admin consents, and it only sends anything when someone clicks to prepare.
• Connecting Google Calendar is optional. Google data is used only to show your calendar and to put one-on-ones on it. No selling, no advertising, no AI training.
• We don't sell data. We don't use trackers or ads.
• You can export everything and delete your account from inside the app or the portal.

O³Track is built and run by Petrus Evangelista, an independent developer in Brazil, who is the controller of the personal data processed in the service under Brazil's General Data Protection Law (Law No. 13,709/2018, “LGPD”).

• Privacy and requests about your data (data protection contact): privacidade@o3track.com.br
• Subscription and billing: assinatura@o3track.com.br

It applies to anyone using the O³Track desktop app (macOS and Windows), the portal at app.o3track.com.br and this website:

• Managers: use the desktop app, invite their team and prepare one-on-ones.
• Reports: get an email invitation and use the portal, for free.
• Owners and admins of an organization: manage members, the subscription and AI.
• Visitors to this website.

When a company uses O³Track for its teams, the company decides what the organization's one-on-one content is for. In that case we process that content to provide the service to the company, following its instructions. Requests about that content can also be sent to your company.

Account and sign-in

• Name, email, language, the organizations you belong to and your role in each.
• Invitations: the invited person's name, email and job title, typed by whoever invites.
• 6-digit sign-in codes sent by email (there is no password). We store only a cryptographic signature (HMAC) of the code, never the code; it is valid for 10 minutes and once.
• Sessions: the client type (desktop app or portal) and when the session began. On the portal, an essential session cookie (o3_session, not readable by scripts).

One-on-one and goal content (synced with the server)

• One-on-one series and meetings, agendas, shared intentions and preparations, shared notes, agreements and their due dates, closing questions.
• Goals, numbers (targets and actuals), updates and requests for support.
• Events in O³Track's internal calendars and the video call link you enter.
• What a report writes in the portal is stored on the server as their draft, visible only to them, until they share it.

On your computer (desktop app)

• The app works on a local encrypted database (SQLCipher), with its key in the operating system's vault (Keychain on macOS, Credential Manager on Windows). It works offline.
• So you don't lose the database if the vault loses the key, the server keeps a copy of that key, encrypted with the service's master key and bound to you and that computer. The database file itself never goes to the server.
• Private notes live only in that local database: they don't sync, don't go to anyone else and never go to the AI. If you turn on notes backup, they are encrypted on your computer with a recovery code shown once; the server stores only the encrypted package and nobody can open it without the code, not even O³Track.

Calendar

If you connect Google Calendar, we process the data described in Use of Google data.

Subscription and billing

• Account status (trial, active, payment pending, read-only, suspended), trial dates, number of manager seats, charges (amount, period, status) and notice emails sent.
• Courtesy codes: we store only a cryptographic signature (HMAC) of the code.
• We don't receive or store card data. Today, charges are issued manually by O³Track.

AI and help

• The organization's AI consent (who turned it on, when and the terms version), usage counts, and the suggestions generated with whether they were accepted or dismissed.
• In help (Ask), only counts and ratings; the text of questions and answers is not stored or logged.

Technical data

• Server operation logs with identifiers, error codes and metrics, without the content of agendas, notes or goals.
• IP address, used on the spot to limit sign-in attempts and protect the service. The hosting provider may log network data to run its infrastructure.
• The desktop app sends no telemetry or usage reports. It checks for updates on GitHub Releases, which sees the IP address of whoever downloads.

We use data only to provide O³Track and protect it. The legal bases are those in article 7 of the LGPD:

We don't build advertising profiles and we don't make automated decisions about people: the AI only suggests, and a person decides.

• Off by default. The owner or an admin turns it on in Settings → AI and accepts the terms on behalf of the organization; we record who, when and the terms version. Turning it off takes effect immediately and deletes nothing.
• Only on request. Even when on, nothing goes to the provider until someone clicks Prepare suggestions or Build with the assistant.
• What goes in a preparation: only from that one-on-one, the shared intentions and preparations, the agenda, open agreements, summaries of the series' last 3 conversations, the person's goals with their last 2 updates and radar topics. In the room, See what went in shows the exact list.
• What never goes in: private notes, anyone's; drafts the report hasn't shared; data about other people or series; numeric goal values; calendar event data, including Google's.
• Goal assistant: sends the text, spreadsheet or image you provide yourself. Avoid including what doesn't need to go.
• Reports always know: with AI on, they see a notice that the preparation uses AI and the list of what goes in.
• Provider: today, DeepSeek, via API. Processing happens outside Brazil and, today, there is no specific data processing agreement with this provider; requests follow its API terms. The provider in use is shown in Settings → AI. If we change providers, we update this page and that screen.
• Help (Ask) is separate: it sends the provider only the product documentation and your question, never data from your account, and doesn't keep the text.
• O³Track does not use your content to train AI models.

Connecting is optional. It only happens when you click Connect Google Calendar (in the desktop app or the portal) and authorize on Google's own screen.

Scope we request

• https://www.googleapis.com/auth/calendar.events: view, create, change and delete events on your calendars. It is the only Google scope O³Track requests.

What it is for

• Showing your calendar in O³Track's Calendar, next to your one-on-ones, even with your computer off.
• Putting one-on-ones on Google Calendar: the one-on-ones you schedule in O³Track become events on your primary calendar, and rescheduling one there changes the time here.
• Letting you promote a Google event to a one-on-one.

What we read and what we store

• From your primary calendar, starting 30 days back: title, start and end, whether it's all-day, time zone, event identifiers and the video call link (Meet, Zoom, Teams and others). We store this on the server and in the app, visible only to you unless you promote the event to a one-on-one.
• To find the video call link we read the event's description and location, but we don't store those fields. Google's response also includes attendees; we neither store nor use them.
• We store the identifier of your primary calendar (usually your Google email) and a refresh token, encrypted on the server with AES-256-GCM under the service's master key. The token never goes to the app, to logs or to other people.

What we write to Google

• For each one-on-one: the title 1:1 · person's name, date and time, the report as an attendee (Google may send them an invitation, depending on your Google account settings), the video call link in the Location field and a link to the agenda in the portal. Agendas, notes and goals never go to Google.

What we never do with Google data

• We don't sell or rent it.
• We don't use it for advertising, for profiling or to assess creditworthiness.
• We don't use it to train AI models, ours or anyone else's, and we don't send it to the preparation AI.
• We don't transfer it to third parties, except to the hosting that runs the service, when needed to comply with the law, or in a possible merger or acquisition, with prior notice.
• People don't read your Google data, except with your explicit consent for a specific case (for example, a support request), when needed for security (investigating abuse or an incident) or to comply with the law.

How to disconnect and revoke

• In O³Track: in the desktop app, under Settings → Calendars (or in the Calendar itself), or in the portal, under Reminders, appearance and account, click Disconnect. Immediately, we delete the connection and the token, stop syncing and the imported events disappear from O³Track. Your one-on-ones stay in O³Track, and the events we already created on your Google calendar stay there, because they are yours.
• At Google: revoke access at any time at myaccount.google.com/permissions. From then on O³Track can no longer read or write your calendar and shows reconnect to sync again.

Deleting Google data

• When you delete your account, we permanently delete the connection, the token, the imported events and the links to Google.
• When you disconnect, the token and the connection are deleted immediately. Imported events are marked as deleted and are no longer shown or synced, but the title and time of those records remain in the server database until the account is deleted. To have them erased sooner, write to privacidade@o3track.com.br.
• Revoking only at Google does not delete what was already imported. For that, disconnect in O³Track or delete your account.
• In a read-only or suspended account, the Disconnect button is unavailable. You can still revoke at Google, delete your account or request deletion through the privacy email.

Within the organization, each person sees what their role allows: a manager and a report see what is shared between the two of them; drafts and private notes stay with whoever wrote them. O³Track's back office shows accounts, counts and charges, never the content of one-on-ones, notes or goals.

Vendors that process data on our behalf, only to provide the service:

We may also share data when the law or a court order requires it. We don't sell personal data.

The server and database are in the United States, and some vendors process data in other countries (see the table above). These transfers rely on the grounds in article 33 of the LGPD, such as performing the contract with you and, for AI, the organization's consent. We require vendors to have security measures consistent with this policy.

• As long as the account exists. Without payment, the account becomes read-only and nothing is deleted.
• When you delete your account (immediate and irreversible): we delete organizations where you are the only person, sessions, computer keys, notes backup, calendar connections, unshared preparations and intentions, AI suggestions and preferences, and anonymize your record. In organizations with other people, shared content stays with them, with authorship changed to Deleted account. In the desktop app, the account's local database is wiped.
• Sign-in codes expire in 10 minutes and their record is deleted after 7 days; failed attempts, after 24 hours.
• Billing records may be kept for as long as the law requires.
• Deleted data may remain for a limited time in the hosting provider's backups, until they are overwritten.

Under article 18 of the LGPD, you can ask for: confirmation that we process your data and access to it; correction; anonymization, blocking or deletion of what is unnecessary; portability; deletion of data processed based on consent; information about who we share it with; and withdrawal of consent.

• Export (portability): Export my data produces a .zip with everything you see in O³Track. In the desktop app it is under Settings → Account and includes your private notes from that computer; in the portal it is under Reminders, appearance and account. It works even in a read-only account.
• Delete your account: under Danger zone → Delete my account, in the desktop app (Settings → Account) or in the portal. You see beforehand what will be deleted and confirm by typing your email. For security, it requires a recent sign-in. If you are the only owner of an organization with other people, make someone else an owner first.
• Correct: name and language are edited in the app itself; other content, where it was written.
• Withdraw consent: turn AI off in Settings → AI or disconnect the calendar.
• For any other request, write to privacidade@o3track.com.br. We reply within 15 days. We may ask you to confirm the email is yours.

You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

• Connections always over HTTPS (TLS).
• Encrypted local app database; Google tokens and key copies encrypted on the server (AES-256-GCM); sign-in and courtesy codes stored only as HMACs.
• Isolation between organizations in the database itself (Row-Level Security), on top of the application's rules.
• A separate back office, with restricted access and a second factor, that doesn't read content.
• Logs without the content of agendas, notes or goals.

No system is infallible. If a security incident may cause significant risk or harm, we will notify the ANPD and the people affected, as the law requires.

O³Track is a work tool for people aged 18 and over. It is not aimed at children or teenagers and we don't accept them as users. If we learn that an account belongs to someone under 18, we will delete it.

• No cookies, no analytics and no trackers. Fonts are served from here.
• The theme and language you choose are stored only in your browser.
• The home page reads only the trial length and the contact email from our server, with no cookie and without sending any of your data.
• Your computer's operating system is detected in the browser itself, only to highlight the right download.

O³Track is in beta and this policy may change. The effective date at the top always shows the version in force. If a change is significant, for example a new vendor that receives content, we will notify you by email or in the app before it takes effect.

This English version is provided for convenience; if it differs from the Portuguese version, the Portuguese version prevails.

Petrus Evangelista, responsible for O³Track.

• Privacy: privacidade@o3track.com.br
• Subscription: assinatura@o3track.com.br

See also the Terms of Service.