Privacy Policy

Last updated: November 9, 2026

This policy explains what information dos-arch collects, how we use it, who we share it with, and the choices you have. It applies to the dos-arch web app at dos-arch.designs-os.com and to this site.

1. Who we are

dos-arch is operated by AnJ Arch-Tech LLC, a Colorado limited liability company (“we”, “us”). We are the data controller for the information described in this policy.

dos-arch is used by companies (architecture and design practices). In this policy, “your company” means the company whose dos-arch workspace you belong to, and “you” means an individual user.

2. Information we collect

Account information

Your name, email address, password (stored only as a one-way hash), the two-factor (TOTP) secret used to verify your sign-in codes, your role, and the company workspace you belong to. You sign in with email, password, and a TOTP code; dos-arch does not offer “Sign in with Google” or “Sign in with Microsoft”.

Workspace content

Information you and your colleagues put into dos-arch: projects, contacts, organizations, notes, documents, meetings and meeting notes, and similar working material.

Connected-account data (Google and Microsoft)

Connecting a Google or Microsoft account is optional. If you choose “Connect Google” or “Connect Microsoft”, you sign in with that provider and grant dos-arch permission to read that account’s mail and the calendars you select. Access is read-only: dos-arch never sends, deletes, or modifies your mail or calendar events.

We request only these permissions:

• Google: openid, email (https://www.googleapis.com/auth/userinfo.email), https://www.googleapis.com/auth/gmail.readonly, and https://www.googleapis.com/auth/calendar.readonly.
• Microsoft (Microsoft Graph, delegated): openid, email, profile, offline_access, User.Read, Mail.Read, and Calendars.Read.

With these permissions dos-arch receives:

• the connected account’s email address and basic profile identifiers;
• email messages, including headers (sender, recipients, subject, date), message bodies, and attachments;
• a list of your calendars, and events from the calendars you select, including titles, times, attendees, locations, descriptions, and online-meeting links (for example Google Meet or Microsoft Teams links);
• OAuth access and refresh tokens that let dos-arch keep reading on your behalf until you disconnect.

Logs and cookies

Our servers keep operational logs (for example IP address, browser user agent, timestamps, the requests made, and errors) to run, secure, and troubleshoot the service. dos-arch uses a single session cookie to keep you signed in. We do not use advertising, analytics, or tracking cookies, and this site uses no cookies, scripts, or trackers at all.

3. How we use information

• To provide dos-arch: sign you in, store and show your workspace, and run the features you use.
• For connected accounts specifically: to show your mail and meetings inside your dos-arch workspace, let you file messages and meetings to projects and contacts, and detect meetings (including Google Meet and Microsoft Teams links) for dos-arch’s meeting-capture feature.
• To run AI assistant features when you or a colleague asks for them (see section 5).
• To keep the service secure, prevent abuse, and fix problems.
• To communicate with you about your account and the service.
• To comply with law.

We do not sell personal information, we do not show advertising, and we do not use your data to build advertising profiles.

4. Google user data and Limited Use

dos-arch’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data we receive from Google APIs (Gmail and Google Calendar):

• User-facing features only. We use it only to provide and improve the user-facing features described in section 3 that are visible in dos-arch.
• No transfers except as allowed. We do not transfer it to others except as necessary to provide or improve those user-facing features, for security purposes (such as investigating abuse), to comply with applicable law, or as part of a merger, acquisition, or sale of assets, with notice to users.
• No advertising. We do not use or transfer it to serve ads, including retargeting, personalized, or interest-based advertising.
• No human reading, with narrow exceptions. No person at AnJ Arch-Tech LLC reads it unless you have given us affirmative agreement for specific messages (for example, when you ask us to look into a support issue), it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data is aggregated and anonymized and used for internal operations.
• No selling, and no AI model training. We do not sell it, and we do not use it, or allow it to be used, to develop, improve, or train generalized or non-personalized AI or machine-learning models.

We apply the same commitments to data we receive from Microsoft Graph.

5. AI assistant features

dos-arch includes AI assistant features. When a user asks the assistant to do something (for example, summarize a thread or draft notes for a project), the content needed for that request is sent to a third-party AI model provider chosen and configured by your company’s dos-arch administrator. That content can include workspace content and, if you have connected an account, text from your synced mail and calendar events.

• This is per-request processing to perform the task a user asked for; AI features only run when your company has enabled a provider.
• We do not use your content, or any Google or Microsoft user data, to train generalized AI or machine-learning models.
• How a model provider handles the content it receives is also governed by that provider’s terms. Your company administrator chooses which providers, if any, are enabled.

6. How information is shared

Inside your company

dos-arch is a shared workspace. Content, including mail and meetings you sync from a connected account, is visible to colleagues in your company according to dos-arch’s project-based visibility rules (for example, mail filed to a project can be seen by people with access to that project). Each company’s data is isolated from every other company’s data.

Service providers

We use a small number of service providers to run dos-arch, who process data on our behalf only to provide their service:

• hosting and infrastructure providers that run the servers and storage dos-arch uses;
• Cloudflare, for network delivery and the secure tunnel that connects the app to the internet;
• AI model providers, only when your company enables them (section 5);
• an email delivery provider, to send account and service emails.

Other cases

We may disclose information when required by law or valid legal process, to protect the security or integrity of the service or the rights and safety of users and others, or as part of a merger, acquisition, or sale of assets, in which case we will give notice and this policy will continue to apply to the data transferred.

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) or similar US state privacy laws, and we do not use it for cross-context behavioral advertising.

7. How we protect information

• OAuth refresh tokens and the app’s Google and Microsoft client secrets are held only in a separate, encrypted credential broker using envelope encryption. The main application and its background workers never see refresh tokens; they receive only short-lived access tokens.
• Sign-in requires a password and a time-based one-time code (TOTP).
• Traffic to dos-arch is encrypted in transit with HTTPS.
• Each company’s data is isolated from other companies.
• Access to production systems is limited to the people who operate the service.

No system is perfectly secure. If we learn of a security incident that affects your personal information, we will notify you and your company as required by law.

8. Disconnecting a Google or Microsoft account

You can disconnect a connected account at any time in dos-arch under Connected Accounts. When you disconnect:

• For Google, dos-arch revokes its access token with Google and deletes the stored tokens.
• For Microsoft, dos-arch deletes the stored tokens. (Microsoft does not provide a way for apps to revoke them, so you may also remove access on Microsoft’s side, below.)
• dos-arch stops syncing mail and calendars from that account. You may ask us to delete data that was already synced (section 10).

You can also remove dos-arch’s access directly with the provider at any time:

• Google: myaccount.google.com/permissions
• Microsoft personal accounts: account.live.com/consent/Manage
• Microsoft work or school accounts: myapps.microsoft.com

9. How long we keep information

• We keep account information and workspace content for as long as your company’s dos-arch workspace is active, or until it is deleted by you or your company.
• When a user account or a company workspace is deleted, we delete the associated data, including any stored Google or Microsoft tokens, from our active systems within 30 days. Copies in backups are removed as those backups expire in normal rotation.
• Operational logs are kept for up to 90 days unless we need them longer to investigate a security issue or meet a legal obligation.

10. Your choices and rights

You can ask us to give you access to your personal information, correct it, delete it, or export it in a portable format. Many corrections can be made directly in dos-arch. To make a request, email jed@designs-os.com. We will verify your request and respond within the time required by law (and in any case within 45 days). Because dos-arch is a company workspace, we may involve your company’s administrator when a request concerns shared company content. We will not discriminate against you for exercising your rights.

If you are in the EU, EEA, UK, or Switzerland

We rely on these legal bases:

• Contract – to provide dos-arch to you and your company;
• Consent – to access a Google or Microsoft account you choose to connect (you can withdraw consent at any time by disconnecting);
• Legitimate interests – to secure, maintain, and improve the service;
• Legal obligation – where the law requires us to keep or disclose information.

You also have the right to object to or restrict certain processing, and to lodge a complaint with your local data protection authority.

11. Children

dos-arch is a business tool and is not intended for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.

12. International transfers

AnJ Arch-Tech LLC is based in the United States, and dos-arch data is stored and processed in the United States. If you use dos-arch from outside the US, your information will be transferred to the US, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards for such transfers.

13. Changes to this policy

We may update this policy. We will change the “Last updated” date above, and if the changes are material we will notify users by email or in the app before they take effect. We will not use data from connected Google or Microsoft accounts in a materially new way without asking for your consent first.

14. Contact

Questions or requests about privacy: jed@designs-os.com, +1 970-442-1965, or by mail to AnJ Arch-Tech LLC, 1500 N Grant St #5483, Denver, CO 80203, USA.