Machinehead — Privacy Policy
Effective date: November 9, 2026
Machinehead is personal productivity software operated by a single individual for their own private use. It runs entirely on the operator's own computer. It is not a commercial product or service, has no other users, and collects no data from anyone other than its operator.
1. What data Machinehead handles
- Data the operator enters: tasks, goals, habits, calendar entries, notes, and conversations with the application's local AI assistants.
- WHOOP data: with the operator's explicit OAuth authorization, Machinehead retrieves the operator's own physiological data from the WHOOP API (recovery, sleep, workouts, cycles, body measurements, and basic profile information).
- Google Calendar data (if connected): the operator's own calendar events, read and written with the operator's explicit OAuth authorization.
2. Where data is stored
All data is stored locally, in a database on the operator's own device. Machinehead uses a locally hosted AI model; no conversations, biometric data, or personal information are sent to any cloud AI service or third party. Machinehead has no analytics, no advertising, no tracking, and no telemetry.
3. How data is used
Retrieved data is used solely to display the operator's own information back to them and to inform the application's local scheduling, coaching, and progress-tracking features. It is used for no other purpose.
4. Data sharing
None. Machinehead does not sell, share, transmit, or disclose any data to any third party. The only network connections the application makes are outbound requests to the APIs the operator has explicitly connected (WHOOP; optionally Google Calendar) to retrieve or update the operator's own data.
5. Data retention and deletion
Data is retained locally until the operator deletes it. The operator can delete any or all data at any time by editing or removing the local database. Disconnecting an integration within Machinehead deletes its stored access tokens; authorization can also be revoked at any time from the connected service (e.g., the WHOOP app or whoop.com, or the Google account security page), which immediately ends Machinehead's access.
6. Security
API credentials and access tokens are stored locally on the operator's device with restricted file permissions and are never published, logged, or transmitted anywhere except to the issuing service for authentication. The application is reachable only on the operator's private network.
7. Children's privacy
Machinehead is not directed at children and has no users other than its adult operator.
8. Changes
If Machinehead's data practices change, this policy will be updated at this same URL before the change takes effect.
9. Contact
Questions about this policy: [wyld@wyldrenaissance.com]