Your data, in your hands.

Who we are

Worldlet is provided by Clockless LLC. This policy covers the Worldlet Mac and Windows apps, the iPhone and Android companion apps, worldlet.ai, and our supporting services. For privacy questions or deletion assistance, email kelvin@clockless.ai.

Information you choose to connect

Worldlet accesses a connected account only after you authorize it. Depending on the Applet, this can include account identifiers, email messages and their metadata, calendar events, and document metadata or content. Access varies by the connection and permissions you grant.

Google sign-in requests basic identity permissions (openid, email and profile) to identify your own account. Gmail reads messages and threads to surface relevant tasks and updates; Calendar reads events to show upcoming commitments. The desktop connection requests Gmail and Calendar read access together. Drive access is separate: its connection requests read access to files, while automatic collection retrieves file metadata and links, not file bodies. Calendar and Drive connections do not modify your events or files.

Sending email requires an additional Gmail sending permission (gmail.send). Fox prepares a draft for you to review; sending requires your explicit Send confirmation. Worldlet retains local draft and delivery records to recover interrupted reviews and check whether a send completed. An uncertain send is checked rather than automatically sent again.

The YouTube Applet opens the original website. Worldlet does not request a YouTube API permission to import your subscriptions or playlists. Signing in to the website is separate from connecting a structured data source.

Other sources, including Notion, can provide page content through their authorized connector. Website logins inside Applets are separate from data connections and follow the website's own policies.

How your information is used

We use connected content to display your Applets, answer your questions, find related context, and organize tasks, events and updates. Automated source checks may run while Worldlet is open. They are bounded checks, not a complete backup of your accounts.

Your world, saved items, imported content and conversation history are stored on your computer. The Agent you use may also store tool results and memory locally, including content retrieved from connected accounts. Connection credentials are retained locally so authorized services can remain connected.

Models and other service providers

Worldlet has no model of its own. Fox talks through the Agent you choose, such as Hermes, OpenClaw, Claude Code, Codex or pi, so your messages and relevant conversation context go to the model provider that Agent is set up with. That provider's terms, retention and account settings apply. Worldlet does not run model inference on its own servers.

Connecting a source and allowing private-content processing are separate choices. After you allow that processing, relevant source content may be included in model requests to answer questions or extract items. You can decline this processing. The services handling a request and your provider's retention policies and account settings apply. Local storage does not make cloud inference local.

Google account reads by the desktop connection go directly to Google's APIs. Content may subsequently reach your chosen model provider when you authorize private-content processing. Local storage does not mean all processing stays on your computer.

Voice prefers on-device recognition when available. Cloud transcription fallback sends audio through Worldlet's Cloudflare service, and optional live voice uses an online voice service. These features process audio to provide the requested transcription or conversation. Requested weather uses approximate coordinates sent to a weather service. Websites, media streams and embedded services receive the requests needed to load their content.

If you pair the Worldlet iPhone or Android app, your computer sends it Attention Center items, which can summarize connected content, and recent Fox conversation. These pass through Worldlet's Cloudflare relay end-to-end encrypted between your computer and phone: the relay stores only encrypted messages and hashed pairing tokens, queued messages expire after seven days, and either device can unpair, which deletes the pairing's relay data.

Cloudflare hosts our website and supporting services and may process IP addresses, request metadata and operational logs to deliver and secure them. Third-party services may process information in countries other than your own.

Google data and Limited Use

Worldlet's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Google data is used for the user-facing features described above. It is not sold, used for advertising, or used to train generalized AI or machine-learning models. Transfers are limited to providing these features with your consent, security, legal obligations, or a business transfer with your prior consent. Our personnel do not read your Google content except with your specific agreement, when necessary for security or legal obligations, or in the limited aggregated circumstances permitted by Google's policy.

Retention, disconnection and deletion

Local information remains until you remove it. Disconnecting an account stops Worldlet's connection but does not erase previously saved tasks, imported material, conversation history or agent memory. Fox's recorded activity, shown under Settings › Help, can include text Fox read from connected accounts; authorization credentials are removed before it is saved, and it remains until you reset Worldlet. Google Applets that share one grant may disconnect together. You can also revoke Worldlet in your Google account's third-party connections.

To delete all local Worldlet data or selected history, contact us for current instructions before removing files. Uninstalling the app alone may leave application data on your computer. Deleting local data does not delete originals in Google or another source, or copies already held by a model provider. Requests concerning those copies should also be directed to that provider.

If you email us, we retain the correspondence while needed to resolve the request and meet legal or security obligations. You can request access, correction or deletion of information we hold by contacting us. We may need to verify that a request concerns your information.

Feedback you choose to send

When you press Send feedback in the Companion panel, Worldlet sends the message you reviewed, your optional reply email and the app version/build to our Cloudflare-hosted support inbox. We do not automatically attach chats, connected account content, screenshots or recordings. Dictation uses the voice-processing services described above to prepare an editable draft; the feedback submission itself contains text, not audio.

Feedback is separate from PostHog usage counts. We retain support messages while needed to address them and meet legal or security obligations. Keep the receipt ID if you wish to request access or deletion through our support email. Drafts remain in the current app session until sent or the app closes.

Security and diagnostics

Worldlet uses HTTPS for supported online services and stores its local library and agent configuration under your user account on your computer. Protect your computer and backups; local storage is not a separate promise of application-level encryption. No storage or transmission method is completely secure.

Export diagnostics creates a local file with version information, connection states and recent error codes. It does not automatically upload the file. Review it before sharing. Do not send us API keys, authorization tokens or private source content unless specifically needed and agreed for support.

Basic product analytics

Packaged Mac and Windows apps send PostHog explicit events for daily activity, first-use setup, Google connection outcomes, Fox request outcomes, Applet openings, content-read outcomes, local item updates and app process crashes. A failed operation includes a short failure category such as timeout or authentication, never the error message. App errors are reported with their type, that category and the names and line numbers of Worldlet's own code where they happened, without the error message, file locations on your computer or your content. Events include a random installation identifier, timestamp, platform, app and OS versions, system language and coarse operation timing. Before Google sign-in, a random ID measures setup progress. After sign-in, we send your own Google email address, available display name and a derived account ID to PostHog, associating activity with your Person profile across devices. This does not include email message contents. Normal app updates preserve the installation ID; account changes use separate identities. Older app versions may report only anonymous counts.

We do not send authorization credentials, connected message or document contents, conversations, page URLs or raw error messages. With reporting on, the app's World screen also uses PostHog's standard web capture: clicks and other interactions, screen views and visit length, and a session recording of the World screen. Every word, element label and typed input is hidden before it leaves your computer, and pictures, video and embedded pages are blocked, so a recording shows only the layout and pointer movement, never your mail, chats or Fox's replies. This capture goes through the app itself and stops as soon as you stop reporting. Geographic enrichment is disabled; PostHog still receives the network request and its IP address. You can stop future reporting in Settings › General › Usage counts, through Fox’s Privacy controls, or with the Mac application menu’s “Share Basic Usage Counts” option. Development and practice activity are excluded. Offline usage and older app versions may be absent. Contact us for questions or deletion assistance.

Downloads

Anyone can download Worldlet; there is no invite code and no form. When you press a download button, the download page keeps when you pressed it, which download, and, if website analytics is on, where your visit came from (only a site name such as “reddit” or “direct”, never an address) and the short ID of the post whose link brought you, if any, under a random token in a cookie. For about three days we also keep a one-way hash of your network address with that press, so that when the Worldlet app first starts on the same network it can learn that random token; the app sends only that token to our product analytics. The one-line install command works the same way: when a terminal fetches the install script, we keep when, which system and the same network hash, with the source and post ID of a download press from your network, if any, so the app can learn that run's random token. We use this to see which places people come from end up using the app. You can turn off the app’s analytics before its first start in the same Privacy controls. Names and emails left on the earlier invite form are kept only to answer those people and are not used for anything new.

Philosophy page

Our philosophy article at worldlet.ai/philosophy/ is open to everyone; it asks for nothing. Names, companies and emails left on its earlier form are kept only as history and are not used for anything new. To have them removed, email us.

Website analytics

Our public website records page views, which of its links and buttons you click (the button’s own words, where on the page it is, and where it leads as a page or site name, never a full address), clicks on Get Worldlet and download buttons with a separate random browser ID, a session ID, public page categories and allowlisted campaign/source labels; the source is a link’s campaign label or, without one, only the name of a well-known site you came from, such as X or Reddit. When you arrive through a link from one of our posts, the link’s short post ID (such as 20261009-2) is kept in browser storage for 90 days and sent with these events, so we can see which posts bring visitors. A download click is not a confirmed installation. We do not join website visitors to app installations, except downloads as described under Downloads, and we join a browser ID to a name only when you leave one on the philosophy page. Browser storage retains these IDs. Do Not Track and Global Privacy Control are respected; you can disable website analytics using the button below. We do not send form contents, arbitrary query strings or referrer URLs. Website person profiles and session replay are disabled.

Browsing memory

The Mac app locally remembers eligible pages visited inside Worldlet’s embedded browser, including URLs, titles, visit times and short visible-text excerpts. It does not import Safari or Chrome history. Some sensitive routes and password pages are excluded, but snippets may contain personal information. Fox searches this history only under your private-context processing permission; returned excerpts may then be sent to your configured model provider. Recording itself makes no model request. Clearing all local Worldlet data also removes this history.

Children and policy changes

Worldlet is not directed to children under 13. If you believe a child has provided us personal information, contact us. We will update the date on this page when this policy changes. A materially different use of connected Google data will require updated disclosure and consent before that new use.