Privacy Policy

Flathead EXO (“EXO”, “we”, “us”) is a private, invite-only internal application operated by Flathead Forge for its members and approved collaborators. EXO is a personal knowledge and relationship workspace — a “second brain” — that helps each member organize information they choose to bring in. We are not an advertising business and we do not sell data.

EXO only accesses third-party data when you explicitly connect a source and grant permission through that provider’s standard consent screen. Depending on which sources you connect, this may include, on a read-only basis:

• Google — Gmail messages and metadata, Google Calendar events, and Google Drive files (scopes: gmail.readonly, calendar.readonly, drive.readonly).
• Microsoft — Outlook mail, calendar, and OneDrive files via Microsoft Graph, read-only.
• Dropbox — file and folder metadata and contents you choose to sync, read-only.

We also store the account information you provide directly (your email address) and content you create inside EXO (notes, memos, CRM entries).

Connected data is used solely to provide EXO’s features to you: indexing and organizing your information into your own searchable knowledge base, surfacing relevant people and documents, powering search and research you initiate, and maintaining your CRM. Your data is visible only to you and to the specific people you deliberately choose to share an item with inside the app.

We do not use your connected data for advertising, and we do not sell it or transfer it to third parties except as needed to operate the service for you (for example, our hosting and database providers acting on our behalf), or as required by law.

Flathead EXO’s use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Specifically: human beings do not read your Google user data except (a) with your explicit consent for specific messages, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data is aggregated and anonymized for internal operations. We do not use Google user data to train generalized or non-personalized AI/ML models, and we do not transfer or sell it.

To power search, summaries, and research you request, relevant excerpts of your content may be sent to AI model providers strictly to generate a result for you. This content is not used by us or by those providers to train generalized models, and it is processed only to return your requested output.

Your data is stored in access-controlled databases with row-level security so that each member can only reach their own tenant’s data. Provider credentials are kept in an encrypted secrets vault and are never exposed to the browser. Access to the application is invite-only and authenticated.

You can disconnect any connected source at any time, which stops further access. You may request deletion of your account and all associated data — including data obtained via Google, Microsoft, or Dropbox — by emailing us at the address below, and we will delete it promptly.

Questions or requests: hunter@flatheadforge.com.