Privacy
This policy explains how the OpenPets website, desktop application, and optional plugins handle information.
Last updated: July 23, 2026
The OpenPets website does not require an account. Like most websites, our hosting and delivery providers may process standard request and hosting data, including IP address, browser, device, referring page, and timestamps, for security, debugging, and delivery.
The desktop application and optional plugins are local-first. User-supplied plugin content, such as reminders, moods, timer state, and optional questions, stays on your device unless you explicitly enable a connected service.
Calendar Airmail is optional. You start a Google OAuth connection, which requests only the https://www.googleapis.com/auth/calendar.events.readonly scope.
The app reads the title and start/end time of timed events from your primary calendar, expands recurring instances, and ignores all-day events. It uses this information only to create local reminders 10 minutes before an event and at its start. It cannot create, modify, delete, or share calendar events.
Event schedule data stays local in a rolling upcoming 30-day window and is refreshed every 10 minutes. OAuth sessions, tokens, and credentials are encrypted at rest in plugin-scoped secret storage.
Security procedures are in place to protect the confidentiality of your Google Calendar data: all communication with Google APIs is encrypted in transit (HTTPS/TLS); Calendar Airmail runs in the host sandbox with access gated by approved permissions; network requests are limited to Google OAuth and Google Calendar API endpoints; and Calendar error diagnostics redact token-like values and URLs.
The plugin contacts only Google OAuth and Google Calendar API endpoints; no Calendar data is sent to an OpenPets server or another third party. You can disconnect in the app to immediately clear the locally stored Calendar event schedule, delivery metadata, pending reminders, and Google session.
Google user data - whether raw, aggregated, anonymized, or derived - is not sold, is not used for advertising, is not transferred to data brokers, and is not used to develop, improve, or train generalized (non-personalized) AI and/or ML models, nor transferred to any third-party AI or ML tools. OpenPets' optional coding-tool integrations are separate features and never receive Google user data. OpenPets' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Spotify Buddy is an optional community plugin that connects to Spotify through OAuth to read current playback and, if you choose, control playback. To find lyrics, it may send the current track title, artist, and duration to LRCLIB (lrclib.net). It does not send Spotify OAuth tokens or account identifiers to LRCLIB. Its reset or clear-connection action removes the local Spotify cache, lyrics, and connection state.
OpenPets may use or link to third-party services, including hosting and CDN providers, GitHub, package registries, Google, Spotify, and coding-assistant products, where applicable. Their own privacy policies apply when you use them. No Google user data is shared with any of these services.
Local plugin data remains on your device until you clear it through the relevant plugin action, disconnect a connected service where applicable, or remove the plugin. Disabling a plugin alone does not delete all of its data.
For rights owner requests, pet removal requests, corrections, sensitive privacy concerns, or deletion requests, email admin@openpets.dev. For non-sensitive bugs, use GitHub issues. Do not include secrets, private data, tokens, or vulnerability details in public issues.
by Alvin