Welcome to osmos (the "App"). osmos is an AI-powered personal assistant application for iOS that helps you manage your daily life by connecting to the services you already use. This Privacy Policy explains how Brightboard AI LTD ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our App and related services (collectively, the "Services").
By downloading, installing, or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please do not use the Services.
osmos's core value is integrating with your existing tools. When you connect a third-party service, we access only the data necessary to provide the requested functionality.
Background scanning: osmos is a proactive assistant. Once you connect an account, osmos scans it continuously in the background — not only when you ask — to surface bookings and tickets, flag messages that need a reply, and prepare your briefings. This includes your email, calendar, and recent Slack and WhatsApp messages. Connecting an account is your instruction to do this; disconnecting it (Tool Manager, anytime) stops the scanning and removes the cached data for that service. You can also exclude an individual source from background scanning — without disconnecting it — in Routines → Pulse → Sources; osmos will then only read it when you ask.
The main ones are:
| Integration | Data accessed |
|---|---|
| Email (Gmail, Outlook) | Email metadata, subject lines, message bodies, and attachments necessary to display, search, and draft emails on your behalf. |
| Calendar (Google, Apple, iCal) | Calendar events, attendees, locations, and scheduling data to display your agenda and create events. |
| Reminders / Tasks | Task titles, due dates, completion status, and associated notes. |
| Slack | Workspace identity, channel lists, and message content to read, draft, and send Slack messages. |
| Message content, sender names and numbers, media captions, group names, and your contact list, so osmos can surface messages needing a reply and send messages you ask it to send. Message content is deleted automatically after 7 days; contacts are kept until you disconnect or delete your account. | |
| Your osmos address | If you claim an osmos email address, we operate that mailbox for you: we receive, store and send mail through it, including senders and recipients, subjects, message bodies and attachments. Unlike a connected mailbox, there is no copy held elsewhere — we are the mailbox. |
| Travel (rail, hotels, flights) | Your traveller profile — name, date of birth, nationality, contact and billing details, loyalty numbers, and passport number where an operator requires it — plus trip details. We send the operator or property whatever they need to issue the booking. |
| Wallet / Payments | Booking and ticket details osmos extracts from your email — passenger names, booking references, seat and ticket details, and travel-document numbers — plus, if you use agent payments, your card's brand, last four digits and expiry, and a record of each approval. If you open an osmos wallet, we create a custodial account with our wallet provider and record its public blockchain address. |
osmos can also connect to a wider catalogue of services — project trackers, document stores, developer and design tools and others — through our integration partner. For those, the partner holds the authorisation you grant and calls the service on osmos's behalf.
We access this data via OAuth tokens or secure API connections that you explicitly authorise. You can disconnect any integration at any time through the Tool Manager in the App's Core section. Disconnecting stops osmos accessing the service and deletes what it had cached. For directly connected mailboxes and calendars this also deletes the authorisation itself; for apps connected through our integration partner, the grant remains registered with them until you delete your account, and you can also revoke it in that service's own settings.
We use the information we collect for the following purposes:
osmos uses artificial intelligence to understand your requests, draft communications, summarise information, and take actions on your behalf. When you ask osmos to perform a task (e.g. draft an email reply, create a calendar event, or send a Slack message), the AI processes the relevant context from your connected accounts to generate a response or action.
We do not sell your personal data. We may share information in the following limited circumstances:
We keep different things for different lengths of time.
Deleted automatically: cached message bodies from a connected mailbox (days); WhatsApp message content (7 days); cached calendar events (90 days); mirrored email details such as sender, subject and preview (12 months); and expired travel price quotes (24 hours).
Kept for as long as your account exists: the things osmos creates with and for you — your chats, AI memory, tasks, routines, notifications, briefings, the tickets and bookings it extracts, your travel profile, your sent mail, your WhatsApp contact list, and all mail sent to and from your own osmos address — for that address we are the mailbox, not a cache, so there is no other copy and we do not expire it. These are the product: deleting them on a timer would take away what you came for. You can delete individual items in the App, or everything at once by deleting your account.
When you disconnect an integration, we stop accessing new data from that service and delete what it had cached. WhatsApp is the exception: messages expire on their usual seven-day cycle and the contact list stays until you delete your account.
You can delete your account at any time in the app (Settings → Delete Account). This immediately and permanently deletes your data from our systems — including chats, AI memory, extracted tickets and uploads — and deletes the access tokens we hold for your connected accounts. We also ask our providers to erase what they hold: your connected-app authorisations, your AI memory bank, your WhatsApp session, your osmos email address and your uploaded files. If one of those providers is unreachable at that moment we complete your deletion anyway and record the failure so we can finish the job.
Three things do not disappear. Your billing and subscription records stay with Apple and our payment providers, because we are required to keep financial records. If you opened an osmos wallet, the blockchain account itself is public and outside our control. And backups made before you deleted your account age out on their own retention cycle rather than being edited.
We implement industry-standard technical and organisational measures to protect your data: encryption in transit (TLS 1.2+) and at rest (AES-256), application-layer encryption with per-user keys for sensitive fields (such as travel documents, connected-account credentials, and cached message content — a set we are actively expanding), strict access controls, and internal security review of our systems. Where a mailbox or calendar is connected through our integration partner, the authorisation stays with them and never reaches us. Where osmos connects to Gmail or Outlook directly, we hold the authorisation ourselves, encrypted at the application layer with a key unique to your account and decrypted only for the moments a request needs it. No method of transmission or storage is completely secure. If you become aware of a security vulnerability, please contact us immediately at help@meetosmos.com.
Depending on your jurisdiction, you may have the following rights:
To exercise these rights, please contact us at help@meetosmos.com. We will respond within 30 days (or as required by applicable law).
To provide the Services, your personal data may be transferred to and processed in countries outside the United Kingdom, including the United States, where our AI infrastructure and certain cloud service providers are based.
Where we transfer personal data from the UK to the United States, we rely on the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework) where our US-based service providers are certified under the Data Privacy Framework with the UK Extension. We verify each provider's active certification status on the Data Privacy Framework List (dataprivacyframework.gov) and monitor it on an ongoing basis.
Where a US-based provider is not certified under the Data Privacy Framework, or where we transfer data to recipients in other countries outside the UK, we put in place appropriate safeguards as required by UK GDPR, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to EU Standard Contractual Clauses. These safeguards ensure that your personal data receives a level of protection equivalent to that afforded under UK data protection law.
You have the right to request details of the safeguards we have in place for any specific international transfer of your personal data. To make such a request, please contact us at help@meetosmos.com.
The Services are not directed to individuals under the age of 16. When you create an account you confirm that you meet that age requirement; we do not ask for your date of birth and we do not otherwise verify it. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at help@meetosmos.com.
The App integrates with third-party services (e.g. Gmail, Google Calendar, Slack). Your use of these services is governed by their own privacy policies and terms of service. We encourage you to review the privacy practices of each service you connect. osmos is not responsible for the data practices of third-party services.
We use a mobile analytics SDK (PostHog, hosted in the EU) to record usage events — feature usage, screen views, and technical metadata — for performance monitoring and improvement. These events are linked to your account. They never include the contents of your messages, emails, or documents.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email. Where practicable we will do so before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.