Woodshed Privacy Policy

Effective: 2026-05-08 · Last updated: 2026-05-08
Contact: daniel@indiethinkers.com

Plain-English summary. Woodshed is a local-first desktop application. We do not operate a server that receives or stores your data. The Woodshed app on your computer communicates directly with Google’s servers (and other services you connect) using credentials that never leave your device’s keychain. Your markdown files, your mail, and your calendar events stay on your computer.

1. Who we are

“Woodshed,” “we,” “us,” and “our” refer to Daniel Hunter, an individual operating in California, USA, with mailing address 6600 Sunset Blvd, Los Angeles, CA 90028.

2. Information we collect

2.1 Information you provide directly

• Vault folder path. When you pick a folder for your Woodshed vault, the path is stored locally so the app can re-open it next session. This path is not transmitted off your device.

• Markdown files. Files you create or edit inside Woodshed are saved as .md files in the vault folder you chose. They never leave your device.

2.2 Information collected via authorized integrations

When you connect Woodshed to a third-party service, the app fetches data on your behalf using credentials you supply or a token you authorize. All such data is stored locally on your device only.

• Google Gmail (IMAP + SMTP, App Password). You generate a Google App Password and paste it into Woodshed. The app stores the App Password in your operating system’s keychain and uses it to connect directly to Google’s IMAP and SMTP servers. Woodshed reads message metadata (sender, recipient, subject, date, thread ID) and bodies, and sends mail you compose. Woodshed does not use Gmail OAuth scopes (gmail.readonly, gmail.modify, etc.). Gmail data is stored as markdown files in your local vault folder and is never transmitted to any server controlled by us or any third party.

• Google Calendar (OAuth, calendar scope). With your authorization, Woodshed reads, creates, updates, and deletes calendar events on the calendars you select. The OAuth refresh token is stored in your operating system’s keychain. Calendar data is stored as markdown files in your local vault folder and is never transmitted to any server controlled by us or any third party.

• AgentMail (API key). If you connect an AgentMail inbox, the API key is stored in your operating system’s keychain and used to fetch and send mail directly against AgentMail’s API. Same local-only treatment as the Google integrations above.

2.3 Information NOT collected

• Woodshed does not run a server that receives your data.

• Woodshed does not transmit your markdown files anywhere.

• Woodshed does not have user accounts.

• Woodshed does not collect device identifiers, IP addresses, analytics events, or telemetry in v1.

• Woodshed does not use cookies, fingerprinting, or third-party trackers.

If we add any of the above in a future version, we will update this policy and notify users in-app before changes take effect.

3. How we use information

The data Woodshed reads from connected services is used solely to provide the features visible to you in the app: rendering messages on Person pages, showing events on the Today and Calendar views, indexing wikilinks across emails and notes for backlink discovery.

We do not use this data to train AI models, sell to third parties, build advertising profiles, or for any purpose other than serving you inside the Woodshed app on your own device.

4. Google API Services User Data Policy

Woodshed’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements:

• We will only use access to read and process Google user data to provide or improve user-facing features that are prominent in the requesting application’s user interface.

• We will not transfer Google user data to others unless necessary to provide or improve those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.

• We will not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.

• We will not allow humans to read Google user data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for our internal operations and even then only when the data have been aggregated and anonymized.

In Woodshed’s case, the Limited Use posture is naturally enforced by the architecture: we have no servers, so the data physically cannot leave your device through us.

5. Where data is stored

• Markdown files: in the vault folder you chose, on your device.

• Local SQLite indexes: in Woodshed’s app-data directory on your device (search FTS5 index, IMAP UID state), derived from the vault and wipeable.

• OAuth refresh tokens, App Passwords, and API keys: in your operating system’s keychain (macOS Keychain on macOS), accessed by Woodshed only.

We do not store your data on any server we operate.

6. How long we keep data

• Data on your device persists until you delete it or uninstall Woodshed.

• Uninstalling Woodshed does not automatically delete your markdown vault (we treat your files as yours; we will not delete files you created without explicit action). To remove all Woodshed data including the local indexes and stored credentials: delete your vault folder, delete Woodshed’s app-data directory (~/Library/Application Support/Woodshed on macOS), and remove the Woodshed entries from your OS keychain.

7. How you can access, export, and delete your data

• Access and export: your markdown files are plain .md files in the folder you chose. You can open them in any text editor at any time. They are yours.

• Revoke Google Calendar OAuth access: disconnect Woodshed from myaccount.google.com/permissions. This invalidates the refresh token in your keychain.

• Revoke a Gmail App Password: revoke the app-specific password at myaccount.google.com/apppasswords.

• Delete app data: see Section 6 above for how to remove local indexes, stored credentials, and app preferences.

We don’t have a copy of your data on our servers, so we have nothing to delete on our end.

8. Children

Woodshed is not directed at children under 13 (or the relevant age in your jurisdiction). We do not knowingly collect data from children.

9. Changes to this policy

We will post material changes to this policy on this page and update the “Last updated” date. For changes that materially expand the data Woodshed collects or uses, we will notify users in-app before the change takes effect.

10. Contact

Privacy questions and general contact: daniel@indiethinkers.com
Mailing address: 6600 Sunset Blvd, Los Angeles, CA 90028