Privacy
Last updated 22 September 2026
Otto is a personal tool with one user, Maia Karnecka. It is not a product, it has no customers, and it is not offered to anyone else. This page describes exactly what it does with data, in plain terms.
What Otto reads
- Email in the two Gmail accounts its user has authorised.
- Google Calendar events, read only.
Where that content goes
Message content is sent to Anthropic's Claude API so it can be sorted, summarised and used to prepare draft replies. This is worth stating plainly: although Otto does not store message bodies, they do leave Google in order to be processed.
What Otto stores, and what it does not
- Stored: sender, subject, a one-line summary, a category, an importance rating, the one-line reason for that rating, a search index entry, and any draft reply.
- Never stored: message bodies and attachments. Those stay in Gmail, and are fetched live when needed.
A summary still contains the substance of a message. The honest claim is far less data, not nothing sensitive.
Optional health data
The user may connect a continuous glucose reading, a menstrual cycle date, and a daily mood check-in, so Otto can adjust how much it puts in front of her and how it is worded. All three are optional and Otto works fully without them.
Otto never acts on glucose clinically. It does not alert on a high or a low, does not interpret readings, and is not a substitute for a glucose monitor's own alarms.
How long it is kept
- Summaries, reasons and drafts — 6 months, then deleted.
- Search index entries and message IDs — kept, so old searches still work.
- Tasks, contacts, writing style and health data — until deleted.
- A log of actions that cannot be undone — kept, never auto-deleted.
Who else is involved
- Google — mail and calendar.
- Anthropic — sorting and drafting.
- Supabase — storage.
- Cloudflare — hosting and the login wall.
- Resend — alerts when something breaks.
Nothing is sold, shared for advertising, or used to train anyone's models.
Nothing is sent without approval
Otto drafts replies. It never sends one, replies to anyone, accepts an invitation or spends money unless the user taps approve first.
Deleting everything
Otto has a single control that clears every table it holds, including health data, and requires re-authorisation from scratch. Access can also be revoked at any time from Google Account permissions.
Contact
maiakarnecka@gmail.com