Privacy Policy

Effective 4 October 2026 · Updated 7 October 2026 (Facebook Page and Instagram posting)

Pergulia (“the app”, “we”) is a desktop application made by CDS Films. This policy explains what data the app handles and where it goes. The short version: the app runs on your computer, and we never receive your data. We operate no server that your data passes through.

1. Data the app keeps on your computer

• The businesses, departments and agent settings you create.
• Tasks, chat history with agents, drafts, approved outputs and the notes agents keep (“memory”).
• Credentials for services you choose to connect, such as a Google Drive connection or a search API key. These are encrypted on disk (AES-256-GCM) with a key stored only on your computer.

All of this stays in the app’s data folder on your machine. The app’s local server listens only on your own computer (127.0.0.1) and is protected by a token.

2. Google user data

Connecting Google Drive is optional. When you click “Connect Google Drive”, Google asks you to grant these permissions:

• openid and email: to show which Google account is connected.
• https://www.googleapis.com/auth/drive.readonly: to search, list and read your Drive files. This permission is read-only; the app cannot create, modify, share or delete anything in your Drive.

One Google sign-in for the app’s own features (optional)

In Settings → Connections → Google account you sign in to Google once for the features the app itself runs: the ledger spreadsheet, Calendar, Gmail drafts and bank notification emails. Google’s consent page lists each permission below with its own box; you tick only the ones you want, and can sign in again later to add more. The app never asks for your Google password. These tokens are used only by the app on your computer and are never given to any agent. Google Drive for agents (above) stays a separate sign-in, because that permission is handed to the agents you choose.

Google Sheets for the finance ledger (optional)

If you install the personal-finance Pack and tick this box when signing in, the app gets:

• https://www.googleapis.com/auth/drive.file: to create one spreadsheet for your ledger and read and write only files the app itself created. It gives no access to any other file in your Drive.

With it the app creates a spreadsheet in your Drive, writes your ledger to it (transactions, categories, accounts, debts, a monthly summary) and, every 15 minutes or when you press “Sync now”, reads back the edits you made in it and applies them to the ledger on your computer. It reads only the tabs it created; tabs you add yourself are never read. Unlinking stops the sync; the app never deletes the spreadsheet.

This permission is used only by the app itself. Its token is never given to any agent, and agents cannot read or write the spreadsheet through it; agents work with the ledger on your computer, and each change they ask to make waits for your approval in the chat.

Google Calendar (optional, two separate permissions)

In Settings → Connections → Calendar you can connect Google Calendar. On Google’s consent page each permission has its own box, and you can grant one without the other:

• https://www.googleapis.com/auth/calendar.calendarlist.readonly and https://www.googleapis.com/auth/calendar.events.readonly (“Read calendars”): to list your calendars and read the events in the ones you tick. Read-only; the app cannot change any event with it.
• https://www.googleapis.com/auth/calendar.app.created (“Write the app’s own calendar”): to create one secondary calendar named “iCloud · Pergulia” and write into it copies of the events from your Mac calendars. Google limits this permission to calendars the app created; it gives no access to any other calendar.

Every 5 minutes, or when you press “Sync now”, the app reads events from 7 days back to 60 days ahead in the calendars you ticked, and keeps copies on the other side: Google events in a calendar named “Google · Pergulia” on your Mac, Mac events in the app’s Google calendar. Copies carry no guests and the app sends no invitations or notifications (sendUpdates=none). Your original events are never edited or deleted. For a calendar you mark “Busy only”, the copy and what agents see show just “Busy” and the time. If one sync would delete more than half of the copies, the app stops and asks you first.

Agents see your calendar only in the companies you tick, and only the agents you give “Read calendar”. They get a read-only snapshot on your computer (title, time, place, notes, or just “Busy”) and a free-time finder; they cannot create, edit or delete events, and the Google tokens are never given to them. The app log records counts only (how many copies were added, changed or removed), never what is on your calendar.

How we access it

Sign-in happens in your own browser using Google’s standard OAuth flow for desktop apps (a loopback redirect to your computer, with PKCE). The resulting refresh token is stored encrypted on your computer. It is never sent to us.

How we use it

• Only the agents you enable for Drive can use it on a task. In a chat you started, an agent may also ask to use Drive; each request waits for you to allow or deny it, unless you have chosen to always allow that kind of request for that agent.
• An agent can search your Drive by name or text, list recent files or a folder, and read the text of Google Docs, Sheets (every tab), Slides, Word (.docx) and Excel (.xlsx) files, PDFs that contain text, and plain-text files. Other file types show metadata only (name, type, size, dates).
• File contents are fetched on demand. To read a Word, Excel or PDF file, or a Google Sheet (exported as .xlsx so every tab can be read), the app downloads it into memory on your computer, extracts the text and discards the file; it is not saved to disk. The app does not copy or sync your Drive.

How it is shared

To read a file for you, the agent passes its text to the AI model that powers it: Anthropic’s Claude, used through the Claude Code tool and your own Claude account. Anthropic processes that text under the agreement between you and Anthropic (see anthropic.com/legal/privacy). Apart from this, Google user data is not shared with anyone. In particular, we do not:

• receive, store or view your Google data on any server of ours;
• sell it, or use it for advertising, retargeting or credit decisions;
• use it to develop, improve or train generalized AI or machine-learning models;
• allow humans to read it, except you.

Answers and drafts that agents write from your files may quote them. Those outputs are stored on your computer, in the app’s task history, drafts and agent notes, like any other agent work.

Limited Use

Pergulia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

• Disconnect in the app (Settings → Connections → Google Drive → Disconnect; for Sheets, Calendar and Gmail: Settings → Connections → Google account → Disconnect): the token is deleted from your computer and revoked with Google. The spreadsheet and the calendar the app created stay in your account until you delete them.
• You can also revoke access at any time at myaccount.google.com/permissions.
• Agent outputs saved on your computer can be deleted in the app, or by deleting the app’s data folder.

3. Other services you connect

If you configure other services (for example a web search API, or a webhook that publishes content you have approved), the app sends data only to the services you set up, and only for the purpose you set them up for. Their own privacy policies apply.

Calendars on your Mac (optional, macOS permission)

To read the calendars in the macOS Calendar app (iCloud and any other account you added there), the app asks macOS for Calendar access; macOS shows its own prompt and you can turn it off at any time in System Settings → Privacy & Security → Calendars. The app reads them on your computer through Apple’s EventKit; it holds no iCloud password. It writes only into the one calendar it created (“Google · Pergulia”), never into your other calendars, and it cannot invite anyone. What it reads is used as described for Google Calendar above.

Reminders and Contacts on the Mac are optional and off until you allow each in macOS’s own prompt (you can turn them off at any time in System Settings → Privacy & Security → Reminders / Contacts). The app reads only the reminder lists you tick, and only reminders not yet done; it adds reminders only to the one list it created (“Pergulia”), only after you approve the work they came with, and it never edits, completes or deletes a reminder. Contacts are read only: an agent can look up one name, number or email at a time (at most 10 cards), never the whole address book, and the app never writes to Contacts. Agents see this only in the companies and seats you turn on; the activity log records counts, not titles or names.

Bank notification emails (optional, Gmail or IMAP)

The personal-finance Pack can read your bank’s balance-change emails so transactions reach the ledger by themselves. With Gmail this uses the Google sign-in above:

• https://www.googleapis.com/auth/gmail.readonly (“Read bank emails”): to search for messages from the bank senders the Pack lists and fetch them. Read-only; the app cannot send, change or delete mail with it.

For a mailbox outside Gmail (under “Advanced”), you can instead create an App Password and type it into the app; it is encrypted on disk (AES-256-GCM) and used only to connect to your mail server over IMAP.

• Access is read-only: messages are fetched without being marked as read. The app never sends, moves, flags or deletes mail.
• It fetches only messages from the bank senders the Pack lists, and keeps only those whose bank signature (DKIM) your mail provider verified. From those it extracts the amount, time, balance, transfer note and the last four digits of the accounts on each side (to tell your own transfers apart) into the ledger on your computer; full account numbers and the message itself are not stored.
• Neither the Google token nor an App Password is ever given to any agent or put in a prompt. Disconnecting in the app deletes it from your computer.

Gmail drafts (optional)

You can let the app leave letters an agent wrote in your Gmail Drafts, for you to review and send yourself. This uses the Google sign-in above:

• https://www.googleapis.com/auth/gmail.compose (“Leave drafts in Gmail”): to create drafts. Google’s permission would also allow sending; the app has no code that sends, and never sends, moves, flags or deletes anything. It only creates drafts.
• A draft is created only after you yourself approve the task in the app, only for the companies you tick, at most five per task. Automatic approval or approval by someone else creates no draft.
• The app’s log records only how many drafts were created, never addresses, subjects or text. Letters are kept out of anything posted to a publishing channel.
• The token is never given to any agent. Disconnecting in the app deletes it from your computer and revokes it with Google.

YouTube (optional)

A company can post its approved videos to the YouTube channel of the Google account above. This uses the same sign-in:

• https://www.googleapis.com/auth/youtube.upload (“Manage your YouTube videos”): to upload a video. The app only uploads; it does not read, edit or delete anything on the channel.
• A video is uploaded only after a post with a video is approved in the app, only for the companies you turn on, at the privacy you choose (private, unlisted or public). Its title and description are the approved post.
• The token is never given to any agent. Disconnecting in the app deletes it from your computer and revokes it with Google.

Facebook Page and Instagram (optional)

A company can post its approved drafts to a Facebook Page you manage and to the Instagram professional account linked to it. This uses a Meta app that you create in your own Meta developer account and whose App ID and App secret you paste into the app (encrypted, stored only on your computer). You then sign in once with a “Connect Facebook” button in Meta's own window; the reply returns to http://localhost:4697/meta-callback on your computer, which listens only on 127.0.0.1, only while it waits, and checks a one-time state value.

• Permissions asked: pages_show_list, pages_read_engagement and business_management to list the Pages you manage (including Pages held in a Meta Business portfolio); pages_manage_posts to post to a Page; instagram_basic and instagram_content_publish to post to the linked Instagram account. You can untick any of them in Meta's window; without the Page permissions nothing can be posted, and without the Instagram ones the app posts to Facebook only.
• A post goes out only after it is approved in the app, and only to the Page (and its Instagram account) each company picks. Facebook gets the post's video, photo or text; Instagram needs a photo, which the app may first upload to the Page as an unpublished photo so Instagram can fetch it from Meta. Besides your name, the names and IDs of your Pages and their linked Instagram accounts, the app reads nothing from Meta; it does not read, edit or delete existing posts, comments or messages.
• The tokens (your user token and a Page token per Page) are encrypted on disk, never shown back in the app and never given to any agent; every call to Meta is signed with your App secret (appsecret_proof). The content you post is covered by Meta's privacy policy. Disconnecting in the app revokes the app's permissions with Meta and deletes the tokens from your computer.

Telegram alerts (optional)

You can have the app's alerts reach your phone through a Telegram bot that you create with @BotFather and whose token you paste into the app.

• Alerts are sent only for the companies you tick, and only for things that need you (a company stalled, an approved post that could not be published, a task that failed for good, a notebook over its limit). Each alert carries the company name, the task title and the error; these pass through Telegram's servers to your chat and are covered by Telegram's privacy policy.
• The app learns your chat only from the one-time Start link you open. Unless you turn on chat, it does not read messages you send to the bot.
• Chat over Telegram is off by default. If you turn it on and pick a company, what you write in your linked private chat is answered by that company's top seat, like the chat in the app: your message and the reply pass through Telegram's servers, and the reply can contain what that seat knows (its memory and the company's books). Messages from any other chat, and messages sent before you turned chat on, are never read. Granting tools, assigning work and approving stay in the app.
• The bot token is encrypted on disk and used only by the app on your computer to call Telegram's Bot API directly. It is never given to any agent. Disconnecting in the app deletes it; revoking it in @BotFather disables it for good.

Binance account (optional, read-only API key)

The personal-finance Pack can read your Binance account so its balance and history reach the ledger by themselves. You create an API key on Binance with only Enable Reading turned on and paste it into the app yourself. The key and its secret are encrypted on disk (AES-256-GCM) and used only by the app on your computer to call Binance’s API directly.

• Read-only is enforced, not just asked for: when you connect and before every read, the app asks Binance what the key is allowed to do, and refuses or stops using any key that can also trade, withdraw or transfer. The app only calls endpoints that read.
• It reads your balances (valued in USDT at Binance’s price at the time), which coins you hold, and your deposit, withdrawal, P2P and Binance Pay history. These go into the ledger on your computer. A P2P order is matched to the bank transaction on the other side by amount and date, on your computer.
• The key is never given to any agent, never put in a prompt, and never sent anywhere but Binance. Disconnecting in the app deletes it from your computer; deleting the key on Binance revokes it for good.

4. Analytics

The app contains no analytics, tracking or advertising code. This website sets no cookies.

5. Children

The app is not directed at children under 13 and is not meant to be used by them.

6. Changes

If this policy changes, we will update this page and its effective date. Material changes affecting Google user data will be noted in the app before they apply.

7. Contact

Questions or requests: cdsf@cdsfilms.com.