MasteryOS Privacy Policy
Effective date: October 9, 2026
Last updated: October 9, 2026
MasteryOS is a learning app and coaching record operated by Outliyr LLC ("Outliyr," "we," "us"). This policy covers the MasteryOS service, its connections to ChatGPT and Claude, and the iPhone app. The outliyr.com website has separate privacy and cookie settings.
The short version
Your learning record is stored on our server. The iPhone app keeps a local record and syncs supported learning data when you connect your account. ChatGPT or Claude supplies coaching through your own AI account. We receive the information the assistant sends to MasteryOS tools, rather than your entire conversation.
We don't sell personal information or show ads in MasteryOS. You can export your server record, delete pursuits, or delete your account. Server deletion, local phone deletion, and iCloud backup deletion are separate actions.
Information we collect
Account information. We store your email address, account ID, account creation time, and linked sign-in methods. Email-code sign-in is supported. Google and Apple sign-in appear when enabled for the service. Provider sign-in also uses a provider identifier to recognize your account. Apple private relay email addresses are accepted.
Learning records. We store pursuit titles, goals and context; skill maps and their versions; practice games and common mistakes; and practice attempts. Attempts include the skill, practice mode, confidence, help received, result, difficulty, notes, source and time. Avoid putting sensitive personal information into goals or notes.
Sign-in and security records. We store hashed sign-in codes, tokens, client secrets and security state, together with expiry and sign-in information needed to authenticate you. Hashing protects the secret values; it doesn't make the associated account records anonymous. Application logs include event names, shortened account or client identifiers, and error references.
Error details may also appear in logs.
Technical information. In-memory request counters use IP addresses and email addresses to limit abuse. They reset when the service restarts. Hosting and network services may process IP addresses and connection information to deliver and protect requests.
On your iPhone. The app stores local practice records and settings. Optional research records stay on the device unless you choose to export or share them. Optional iCloud backup stores a copy of your local record in your private iCloud account. It is separate from server sync.
If you enable automatic practice places, iOS location permission lets the phone associate a chosen place with a general place tag. The location producer doesn't persist or export raw coordinates. Place-related settings and tags can form part of local records and backups; the MasteryOS server sync doesn't send location coordinates or place tags.
How we use information
We use account and learning information to sign you in, synchronize your record, calculate practice recommendations, show progress, and provide export and deletion. We use security records and request counters to prevent abuse and investigate faults.
MasteryOS doesn't send your record to an AI model for training or operate its own paid AI coaching model. What ChatGPT or Claude does with your conversation depends on that provider's policy and your account settings.
Storage and service providers
Our SQLite database is hosted on an OVH virtual server in the United States. Connections to the service use HTTPS. Nightly database backups are retained for 14 days on the same server. Those backups are recovery copies, not an independent off-site backup.
| Provider | Information and purpose |
|---|---|
| OVH | Hosts the server and the account and learning records stored there |
| EmailIt | Receives your email address and sign-in code to deliver sign-in email; email tracking is disabled in our sending configuration |
| Cloudflare | May process connection information when requests pass through its network |
| Apple | Processes Apple sign-in when used and stores optional backups in your private iCloud account |
| Processes Google sign-in when used | |
| OpenAI or Anthropic | Processes the conversation in the AI assistant you choose, including information you ask it to send to MasteryOS |
The AI providers' own privacy policies cover the conversations they hold. Deleting MasteryOS records doesn't delete an assistant's chat history. We may also disclose information when legally required or necessary to protect the service and people's rights.
Retention
| Information | Retention |
|---|---|
| Account and learning records | Until you delete them; inactive accounts aren't automatically deleted |
| Archived pursuits | Kept until deleted |
| Deleted-pursuit sync records | Pursuit ID and deletion time are retained to synchronize deletion, until account deletion |
| Sign-in codes | Valid for 10 minutes |
| Pending sign-in | Valid for 15 minutes |
| Authorization codes | Valid for 60 seconds |
| Access tokens | Valid for 1 hour unless revoked earlier |
| Refresh tokens | Valid for 60 days; replaced when used and subject to revocation |
| Expired authentication records | Removed through request-triggered cleanup; expiry is not an immediate database erasure deadline |
| Container logs | Rotated by size: up to three files of 10 MB each, rather than a fixed number of days |
| Nightly database backups | Retained for 14 days on the same server |
Other hosting and network logs follow the providers' retention practices. The container limit doesn't set retention for those separate logs. Deleted records can remain in existing recovery backups until they expire.
Your controls
Archive or delete a pursuit. Ask your connected assistant to archive or delete a pursuit. Archiving keeps its history. Deletion removes that pursuit's server skill maps and attempts and records the deletion for phone sync. Existing local copies require a successful sync, and old backups aren't rewritten by that action.
Export your server record. Ask your connected assistant to export your MasteryOS data. The export contains account details, linked sign-in methods and emails, active and archived pursuits, every saved skill-map version and practice attempts. It excludes authentication secrets. The authenticated service also provides a JSON export endpoint.
Delete your account. Ask your connected assistant to delete your MasteryOS account and confirm the permanent deletion. This removes the account's active and archived pursuits, skill maps, attempts, linked identities, tokens and associated pending sign-ins from the active server database. Your session stops working.
It doesn't erase your assistant's conversations, a separate local phone copy, or an iCloud backup.
Disconnect an assistant. Remove the connector in the assistant's settings. MasteryOS supports token revocation, including revocation of a refresh-token family. Whether removing a connector invokes that endpoint depends on the assistant. Don't assume removal alone deletes your account or immediately revokes every token. Contact us if you need help ending access.
Manage iPhone copies. The app's raw-data export covers local records, including local research data. Local erasure affects the phone's copy; it doesn't delete your server account or iCloud backup. iCloud backup deletion is a separate action in the app's iCloud backup settings. Turn off automatic places or location permission to stop automatic place updates.
For help with any of these controls, email [email protected]. We may need to verify account ownership before handling a request.
EU and UK privacy rights
Where EU or UK data protection law applies, Outliyr LLC is the controller of the personal information covered by this policy.
We rely on performance of our agreement with you for account access, learning records, synchronization and the service controls you request. We rely on legitimate interests in protecting the service, preventing abuse and diagnosing faults for necessary security processing, subject to your rights.
Optional device features use your choices and permissions; where consent is required, you can withdraw it without affecting earlier lawful processing. Applicable legal obligations may require us to process or retain particular records.
Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent for processing that relies on consent. Email the contact above to exercise these rights. We respond within the time required by applicable law and explain any lawful limits.
Our service processes information on a US server, so using it involves processing outside the EU and UK. US laws and government-access protections differ from those in your country. This policy doesn't claim Outliyr certification under a data privacy framework or that a particular contractual transfer safeguard is in place.
Contact us for information about the arrangements applicable to your information.
Our practice recommendations and mastery labels are automated learning feedback. They don't decide eligibility for employment, credit, education admission or other similarly significant matters.
You can complain to your country's data protection authority, including where you live or work or where you believe a violation occurred. EU authority contacts are available from the European Data Protection Board. In the UK, contact the Information Commissioner's Office.
You don't need to contact us before exercising that right.
Children
MasteryOS isn't directed to children under 13. Sign-in doesn't perform age verification. If you believe a child has provided information to the service, contact us so we can investigate and handle deletion as required by law.
Security and cookies
We use HTTPS, hashed authentication secrets and sign-in rate limits. No service is perfectly secure. Protect the email or provider account used to sign in, and keep your phone secured.
Service sign-in pages use short-lived security cookies to complete authentication. They don't set advertising cookies. The outliyr.com website's own cookie practices are separate.
Policy updates and contact
We update this page when our practices change. The date above identifies the current version. Where applicable law requires notice of a material change, we provide that notice before the change applies.
Outliyr LLC
1500 E Riverside Dr
Austin, TX 78741
Email: [email protected]