What obi keeps, and why

obi is operated by CatalystIQ LLC (“we”). It is a service for running long projects: a house, a renovation, a rental. Questions about this policy go to support@getobi.app.

• Your account. The name, email address and password you sign up with. We store the password only as a hash. Cookies keep you signed in and remember two choices you make in obi: the places you pin as favorites and the overview cards you hide. When you connect an app or agent, we keep a record of it: which app, the workspace and permissions you allowed, and the tokens or keys it uses. Agent keys are stored as a hash, with only their first six characters kept as they are, so you can tell one key from another.
• Your workspace. What you and the people on your roster put into it: tasks, notes, files, calendar entries, and the names and contact details of the people you add. Some of that is other people’s information; you are responsible for having the right to add it.
• Google Calendar, if you connect it. A token that lets obi reach the calendar, and the events obi brings in from it: their titles, descriptions, locations and times.
• Conversations. What your agent reports hearing: the chats it is in, who it saw in them, the messages it files and the files it relays, each marked as the agent’s report. Nothing reaches obi from anyone but your agent; obi holds no address of its own and never messages anyone in a conversation. A conversation obi cannot match to a member of your team is held until you place it.
• Cards in ChatGPT and Claude. When you use obi in ChatGPT or Claude, the cards obi shows there carry tokens: one that lets the card refresh, which lasts a day or, on an approval card, until that approval must be decided or carried out, at most eight days, and one for each button it offers, which lasts ten or fifteen minutes and lets a press count as yours. Only a hash of each token is kept, and it is kept with your account id and the id of the app you connected, the workspace, the card it belongs to, what its button does and to which task or approval, and a fingerprint of what the card showed when it was drawn. It is deleted 24 hours after it expires, or 30 days after it is used. What a press did is kept for those same 30 days, so that pressing the same button again gets the same answer.
• Requests waiting for approval. When an app or agent you connected asks obi for something that needs a person’s approval, obi keeps the request it made: the tool, what it sent (unless that is over 64 KB), and the key the approval is bound to, with the id of the app and the account id of the person who connected it, so that the app can carry the request out once the approval is given. Only that app, for that person, gets the request back; others who see the approval are told whose app asked. That copy is deleted when the approval ends, and at the latest 30 days after it is decided. These requests and card tokens are both deleted with the workspace.
• Operational records. Every change in a workspace is recorded as an event with who made it, when, and how it came in: on obi, by a press in a card in ChatGPT or Claude, by an app or agent you connected (recorded under its name), or by obi itself, such as a calendar sync. We keep server logs for 30 days to run and debug the service. Logs do not carry message bodies, contact addresses or card tokens. They do record the web address of each request, and three kinds of web address carry a secret: an invite link, a calendar feed link, and the code Google returns when you connect a calendar.

We do not run advertising or analytics trackers. obi’s pages, this one included, report errors to Sentry, our error-monitoring provider, and tell it each time a page loads, so that faults can be counted against visits. Nothing records your screen.

• To run your workspace and show it to the people you put on it.
• To read what arrives. Documents, including the files your agent relays, are sent whole, with their file names, to a third-party AI model (Google’s Gemini) to classify them and read the fields your project’s template asks for, such as amounts, dates, parties and reference numbers. Only formats a model can open are sent: PDFs, text and Markdown files, and images, unless your template files images as photos. If an owner turns on meaning-based search, the title and body of each published knowledge base page, and the words of each knowledge base search, are sent to OpenAI’s embedding model so search can match meaning, not just words. It is off until an owner turns it on, and drafts are never sent. No model is trained on your data by us; model providers are reached through Vercel’s AI Gateway under its terms.
• To let the agents and assistants you connect act. One you connect, ChatGPT and Claude included, reads your workspace and writes to it through the same interfaces obi opens to every agent, under the permissions you grant it. This policy covers what obi returns to it. What it, and the company that runs it, does with that data once it has it is covered by your agreement with that company and its own privacy policy, not by this one.
• To keep a calendar you connected in step with the project: obi writes the project’s due dates, deadlines and events to it every fifteen minutes, and brings back the events and changes made there.

If you connect Google Calendar, obi asks for permission to see, edit, share and permanently delete calendars you can access (the calendar scope). It uses that access to make a calendar for your project under your Google account, share it with your team, and keep it in step with the project’s schedule in both directions. It also lists the calendars you can edit, so you can choose a different one for the project in your workspace settings. If you choose one of your own calendars instead, obi reads it, writes to it and shares it with your team in the same way. Beyond that list, it reads no calendar the project does not use, and it only ever removes what it created.

obi shares the calendar at the email address each person signs in to obi with: owners and members can edit it, observers can view it, and vendors and contacts are not given access, nor is anyone whose view of the project leaves out its tasks or calendar entries. Google emails each of them that the calendar was shared with them. obi adds people who join later but never removes anyone, including someone whose view an owner later narrows; to take access away from someone who has left or whose view was narrowed, or to delete the calendar, use Google Calendar.

From that calendar obi reads each event’s title, description, location, and start and end times, for 60 days starting today, and of an event it asks Google for nothing else, such as attendees. It also reads who the calendar is shared with, so it can add people who join later, and keeps none of those addresses. Those events appear in your workspace as calendar entries your team can see. To the calendar obi writes the due dates, deadlines and events the whole project can see, never one shared only with some people: their titles, dates and times, with the note “From obi”. These include events that another member’s connected calendar brought into the project.

obi’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide calendar features you can see in obi, and is not used for advertising, sold, or used to train AI models. It goes to others only where you choose it: the people on your project see the events obi brings in; a calendar feed link an owner creates carries their titles and times; and when you connect ChatGPT, Claude or another agent, the calendar entries it asks for include events that came from your Google calendar, which that company handles under its own terms. Otherwise we disclose it only as the law requires.

You can disconnect at any time from your workspace settings, which removes the stored credential and takes the events obi brought in from that calendar out of your workspace. Deleting a workspace removes the calendar connection too, stored credential included. Either way, the calendar, the entries obi wrote to it and the people it is shared with stay in your Google account until you change them there. You can also revoke obi’s access from your Google account.

The people on your roster, according to their role. Owners and members see everything in the workspace, unless an owner has narrowed what a member sees. A vendor or an observer sees what is shared with the whole project, such as its tasks, records, files and calendar entries, unless an owner has narrowed what they see, plus anything shared with them by name and the conversations they take part in. They do not see its budgets, approvals or knowledge base, though its activity feed shows them when a budget was set, an approval asked for or decided, or a page edited. And the providers we run on, each only for its part:

• Vercel, which hosts the service, stores files, and routes model calls.
• Neon, which hosts the database.
• Sentry, which receives our error reports, from the service and from your browser: what failed, the page or request it failed on, your browser, and what happened just before the error, such as log lines, clicks and page loads. Before a report leaves, obi takes out cookies, sign-in and authorization headers, what was being sent, and the part of a web address after its path, and blanks the code in an invite link. Reports from the connection ChatGPT and Claude use carry no log lines either.
• Google, when you connect a calendar: the project’s name, the titles, dates and times of its due dates, deadlines and events, and the sign-in email addresses of the people obi shares the calendar with.
• The AI model providers reached through the gateway: Google, whose Gemini model reads documents, and OpenAI, whose embedding model indexes knowledge base pages and searches when meaning-based search is on.
• OpenAI, when you connect ChatGPT or another OpenAI app, and Anthropic, when you connect Claude. They receive what obi’s tools return to the app you connected and what obi’s cards show in it. Their models read what the tools return; what a card shows goes to the card itself.
• Any other agent or app you connect, and the company that runs it. It receives what obi’s tools return to it, under the permissions you grant it.
• The address an owner registers for an agent in your workspace settings, and whoever runs it. It receives a signed notice of each change that agent is allowed to see: the kind of change, which records by id, which fields changed by name, and who made it, never what a field holds. A wake address receives only that something changed and where to start reading.
• Anyone with a calendar feed link an owner creates, and the calendar app that subscribes to it: the titles, dates and times of the due dates, deadlines and events the whole project can see, never one shared only with some people.

What a connected app receives is what your role lets you see. ChatGPT and Claude receive only what they ask for; an agent with a registered address is also sent the notices above. What obi’s tools can return: tasks, with their notes, status, due dates and deadlines, tags, who they are assigned to, delegated to or waiting on, the reason an agent gave for acting on them, and comments with who wrote them; projects and their records, such as quotes, invoices and contacts, with their amounts, dates and parties, including the contact details a record holds; documents, with what was read from them, their file names, types and sizes, the text of text files but never the contents of other files, and obi’s link to the file, which opens only for someone signed in to obi; knowledge base pages, with their drafts, earlier versions, proposed changes, who made them, and when a page was last opened; calendar entries, including the events on a connected Google Calendar, with their times, places and notes; budgets and costs; the people on the workspace, including people since removed, by name, role and time zone, never their addresses, though obi tells an app whether an address it reported belongs to someone on your roster; approvals, with what is asked, the amount and payee, who asked and who decided; the conversations your agent filed, with their messages, who said them, any message a person disputed, and any request to stop that your agent reported; the workspace’s projects and how it is set up, such as its templates, schedules and quiet hours; and the workspace’s activity. A card in ChatGPT or Claude shows the approval or the tasks you asked to see: a task’s notes and comments, the names and roles of the people on the workspace, and, for an approval that rests on something someone said, those words. It carries the tokens its buttons press with. OpenAI and Anthropic handle what they receive under your agreement with them and their own privacy policies; this policy does not cover what they do with it.

We do not sell your information. We disclose it when the law requires it, or to protect the service and the people on it.

Data is stored in the United States. It is kept for as long as we run the service. Deleting a workspace hides it from everyone at once, but its record is kept, files included. When you delete a file or a conversation, it disappears from your workspace for everyone at once, but obi keeps the record: a deleted file’s bytes and what was read from it stay stored, and filing the same file again brings it back; a deleted conversation’s messages stay on record. A file your agent relayed in a conversation you disown is removed from storage, unless another conversation still holds it. Copies in backups expire on a schedule, server logs after 30 days, and error reports when Sentry’s retention period ends. Card tokens and the requests obi keeps for an approval go sooner, as above. Ask us to remove your account and we will. What you added to a workspace stays with that workspace, under your name, because the people on it rely on its record.

• You can export what is in your workspace on request.
• Owners and members can delete files, delete a conversation after disowning it, and remove people from a roster. What was removed stays on the record, as described above.
• Owners and members can dispute a message your agent filed, and disown a conversation it reported.
• Owners can redact text from a knowledge base page, including its earlier versions and proposed changes.
• An owner can turn meaning-based search off in your workspace settings. That stops new pages and searches going to the model provider; it cannot recall what has already been sent.
• You can disconnect any agent or calendar you connected.

obi is not directed at children under 13, and we do not knowingly keep their information.

When this policy changes, the date at the top changes with it, and a change that matters is announced inside the product. The current version is always at https://getobi.app/privacy.