oddrefresh

PennyOS fine print

PennyOS privacy

What this website, the PennyOS software and the services behind it do with your information. Effective 14 October 2026. Written from the code at version 1.23.0 and checked against it.

The short version

PennyOS is software for a handheld you own, paired with a server you own. There are no accounts, no analytics, no crash reports and no update checks. What you write stays on the handheld and your server. A few apps reach public services or small hubs the project runs, and this page says exactly what each one sees.

Who this covers

This page covers this website, the PennyOS software on the handheld, and the small hosted services the project runs for its optional features, which it shares with PennyOS Mobile. Questions go to the Contact me button on this page.

This website

  • The site is static files served by Cloudflare Workers. It sets no cookies and runs no analytics. Images are served from this domain.
  • The pages load the Schibsted Grotesk, Martian Mono and VT323 typefaces from Google Fonts, so Google receives the requests for the stylesheet and font files, including your IP address, under the Google privacy policy. No other third party script or stylesheet is loaded.
  • Cloudflare processes each request to deliver it, which involves your IP address and browser details, under the Cloudflare privacy policy. The site's Worker has Workers Logs turned on, so those request details are also kept for a limited time in the Cloudflare account that runs it.

The handheld and your server

  • The handheld's whole disk is encrypted and opens at boot with a PIN. Notes, the journal, the wiki mirror, caches, chats, saved places and settings live on it. They are not sent to the project.
  • Your server is reached two ways, both on your own private network: a console API that takes a token kept on the handheld in a file only its owner can read, sent only in a header and only to addresses on that network; and SSH to a gate that runs a short list of fixed commands and logs each one by shape. Through them go notes and journal pages (synced to your server's inbox), questions for Ask and Chat, search terms, addresses looked up in Store, and the edits, rulings and new records you make in the console apps. Back come the wiki mirror, answers, and the console's own data.
  • Ask sends your question to Anthropic through Claude Code running on your server, under your own Anthropic account and terms. Chat uses a local model on your server and sends nothing to Anthropic. Search and Store can run a web pass through Claude Code on your server. Nothing on the handheld holds an Anthropic credential.
  • Terminal opens a shell on your server over its own SSH key. What you type there goes to that shell.
  • The lock clears what is in memory: the Ask conversation, the clipboard, open reports and forms, decoded pictures. It does not erase what is on disk. Settings > Clear cache removes every cached file, with a secure delete when that setting is on. Notes, journal, the wiki mirror and chats stay until you delete them.
  • PennyOS contains no telemetry, crash reporting or update check. Its logs stay on the handheld and hold no message text, key presses or tokens.

Services the project operates

Three features talk to small Cloudflare Workers run by the project, the same ones PennyOS Mobile uses; see that page for what each keeps. In short: the Link hub receives a random channel id and, while the monitor is on, the text of a note you are typing, non-private Chat answers and your saved places; the News API receives a random reader id, your feeds and your read marks; the property lookup receives a location inside San Francisco and the addresses and names you look up. None asks for your name or email.

Third-party services the software contacts

Some apps fetch public data directly from other providers. Each receives your IP address and the request itself, and each has its own privacy policy.

  • Weather and Field: Open-Meteo (a forecast and air quality for your coordinates, and the place names you type), OpenStreetMap's Overpass API and Nominatim, Photon by Komoot, and Wikipedia, each with your coordinates or a place name. Field also downloads public data from USGS (earthquakes) and Where the ISS at; neither receives your coordinates. Trip's maps, search and directions are offline, from data built on your server.
  • Locate: when you ask for a fix, BeaconDB receives the Wi-Fi access points your handheld can hear.
  • Messages: your Beeper account, through a Matrix client running on the handheld, which holds your chats and keys on the encrypted disk. iMessage goes through Beeper Desktop on your server over a tunnel that can open nothing else. Pictures in chats are held in memory and dropped at lock.
  • Mesh: LoRa radios over USB or Bluetooth only. Messages and node positions never leave the handheld.
  • Router: your travel router on its own network, with its password in a file only the owner can read. On that network one request to Google's connectivity check tells the app whether it is online, and the portal helper posts a hotel's login form once with what you typed and keeps nothing.
  • Analyze: downloads only from the Internet Archive and Canon's own sites, and only after you confirm each one.
  • Import: a camera card to your NAS, on your home network only.
  • Wi-Fi: passwords are typed into the system's network manager, which stores them, not PennyOS.

The glasses

Over the dock, display glasses are a second screen: everything the panel would show appears there and nothing comes back. Over the Link hub, a pair of smart glasses receives only what is listed above: never the journal, Ask, Messages, Photos, Mesh, Mail or the wiki.

Retention and deletion

Everything on the handheld and your server is yours to delete. For the hosted services, the Link channel is retired from the Link app, and the rest follows the schedule on the PennyOS Mobile privacy page. To ask for data tied to a reader or channel id to be deleted sooner, send the id through the Contact me button on this page.

Children

PennyOS and this site are not directed at children under 13 and do not knowingly collect information from them.

Changes

This policy changes when the software does. The effective date at the top is the date of the current version.