Short, because we hold almost nothing

Ostler is a product of Greulich Labs LLC, which is responsible for the little we hold — described below. Questions go to support@getostler.com.

Reservations, guests, payments, notes — all of it lives in a database file on your computer. It is never sent to us, and we have no way to read it. Backups go only where you point them. Emails to guests go through your own email provider or Resend account, and that provider’s privacy terms apply between you and them — Ostler is not in the path.

If you choose “Sign in with Google” for email, Ostler asks Google for permission to send email on your behalf (the Gmail “send” scope), plus the basic sign-in scopes that tell it which account you chose — your email address, shown in Settings so you can see what is connected. Ostler uses the send permission for exactly one thing — sending your hotel’s own guest emails (confirmations, receipts, reminders, and messages you write) from your own Gmail or Google Workspace address. Ostler never reads, lists, searches, or stores your mail, and no message content or Google data is ever sent to us. The sign-in token stays in your computer’s keychain; “Disconnect” in Settings deletes it, and you can revoke Ostler’s access at any time from your Google Account’s security page.

Ostler’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

“Sign in with Microsoft” works the same way: Ostler asks for permission to send mail as you and to see which account you signed in with, uses it only to send your hotel’s own guest emails from your Outlook or Microsoft 365 address, and never reads your mail. The token stays in your computer’s keychain; “Disconnect” in Settings deletes it, and you can revoke Ostler from your Microsoft account at any time.

The Google user data Ostler handles is limited to the OAuth sign-in token Google issues, the email address of the connected account, and the content of the guest emails you ask Ostler to send through that account. The same applies to Microsoft. Security procedures are in place to protect the confidentiality of that data, and we use encryption to protect it. Specifically:

• Encrypted at rest, on your computer only. The token is encrypted with your operating system’s own keychain (the macOS Keychain, or Windows Data Protection) and stored in a file that only your user account on that computer can decrypt. It is never written to the Ostler database, so it is not in your backups, and it is never sent to us — we operate no server that could receive it.
• Encrypted in transit. Ostler talks to Google and Microsoft only over HTTPS (TLS), and the token is sent only to them, only to send the email you asked for.
• Access is limited to you. Ostler requires a local username and password to open, and the token is used by the app itself when it sends a message. No person at Greulich Labs LLC can see or use it, and Ostler never reads, lists, searches or stores any of your mail.
• Kept only as long as it is useful. The token stays until you press “Disconnect” in Settings, switch to another email provider, or remove Ostler’s data — each of those deletes it. You can also revoke Ostler from your Google Account or Microsoft account page at any time, which makes the stored token useless.
• Never shared, sold or used for anything else. We do not transfer this data to anyone, do not use it for advertising, and do not use any Google user data — or any other data from Ostler — to develop, improve or train artificial-intelligence or machine-learning models.
• If something goes wrong. If we ever learn of a security problem in Ostler that could expose this data, we will tell affected customers by email promptly, explain what happened, and say what to do — starting with revoking Ostler’s access from the account page.

Retention and deletion. We store this data only for as long as you keep the account connected in Ostler, which is the business purpose it serves. Pressing “Disconnect”, switching providers, or removing Ostler’s data deletes the token and the connected address from the app immediately (backups made while it was connected still name the address). Ostler keeps its own copy of each guest email it sends — in its database on your computer and in your backups, so the reservation’s Communications tab can show it — and never reads your Sent folder.

Sharing. We do not transfer or disclose Google user data to third parties for purposes other than the ones described here — sending your hotel’s guest emails. It is not shared with anyone, including Greulich Labs LLC.

Limits on use. Google user data is used only to provide the user-facing feature described above. It is never used for advertising or targeted advertising, never sold, never used to determine creditworthiness or for lending, and never used to develop, improve or train generalized artificial intelligence or machine-learning models. If we ever change how Ostler uses Google user data, we will update this page and tell you in the app before the change takes effect.

When you buy a license: the email address you used at checkout and your payment record, held by Stripe, our payment processor — we never see card numbers. We use that record for exactly two things: emailing your license key (including re-sends you request) and support — which includes confirming it is you before we issue a rescue code for a lost password. We don’t send marketing email, and we don’t sell or share anything with anyone.

If you write to us — through the contact form or straight to support@getostler.com — we hold your name, your email address and what you wrote, for as long as it takes to answer you and to make sense of it if you write again. The form sends that message to our inbox and does nothing else with it.

It’s static pages. No analytics scripts, no advertising trackers, no cookies — which is also why there is no cookie banner asking you to agree to any. Nothing here is stored on your device, so there is nothing to switch off. If you buy, Stripe’s checkout page operates under Stripe’s own terms.

Ostler Desktop makes two connections to us and no others. It confirms your license at activation and every six hours after, sending your license key, a random install id and the app’s version number — never any reservation or guest data — and keeps working for up to 48 hours if that check can’t get through. And it checks our website for updates each time it opens (or when you press Check now); the app works identically if that check never succeeds.

Write to support@getostler.com to ask what we hold about you (your purchase record and any messages you have sent us) or to have it deleted once any warranty obligations have passed.