Privacy Policy

Effective: October 29, 2026 · Last updated: November 2, 2026

The short version

If you sign in with Google, we store your name, email address, and Google account ID, plus the desktop you create (your files, notes, open windows, and settings).
Guest desktops stay in your browser and are never sent to us.
If you use Mail, we store the messages you send and receive and the contacts you save. People you write to see your name and email address.
If you contact Max through Customer Care, we store your tickets, messages, and any voice notes you record. Only you and Max can see them.
If you like or comment on Max's Logbook (the blog), we store that. Comments are public and show your first name and last initial.
We don't sell your data, show ads, or use tracking cookies or third-party analytics. We keep simple daily counts (how many people visited, which apps were opened) without cookies or IP addresses, and skip browsers that ask not to be tracked.
You can delete your account and data yourself at any time from the account panel (the ^ in the taskbar), or ask us at [email protected].

1. Who we are

MaksimOS is the personal portfolio website of Maksim Babayan, available at https://maxus.life (the "Site"). It is presented as a small, simulated desktop operating system. In this policy, "we", "us", and "our" mean Maksim Babayan as the operator of the Site, and "you" means anyone who visits or uses it.

Questions about this policy or your data can be sent to [email protected].

2. Information we collect

When you sign in with Google

Signing in is optional. If you choose "Sign in with Google", we ask Google only for the standard openid, email, and profile permissions and receive:

your Google account ID (a unique number Google assigns to your account),
your name and first name,
your email address and whether Google has verified it.

We never see your Google password. We don't store your profile photo, and we don't request access to your Gmail, Drive, contacts, calendar, or any other Google data.

Your desktop

When you are signed in, the Site saves your desktop to your account so it is there when you come back: the files and text you create (for example notes in Notepad), file names, which windows are open and where, and your settings (such as wallpaper, light or dark mode, and icon size). Please don't store passwords, financial details, or other sensitive information in your files; the Site isn't designed for that.

Sign-in sessions and security records

When you sign in, we create a session so you stay signed in. For each session we store a scrambled (hashed) form of its key, when it was created and last used, when it expires, and your browser type, so sessions can be managed and ended. We also keep a security log of sign-ins, sign-outs, failed sign-in attempts, and blocked abuse, which records the time, the account involved (if any), and the IP address.

Mail

Signed-in users can send plain-text messages to other MaksimOS accounts. We store each message (sender name and email, recipient address, subject, text, date, and whether it was read) and the contacts you save. Recipients see your name and email address. We never show or suggest which email addresses have accounts: a message to an address without an account is kept only in your Sent folder.

To keep Mail friendly, messages are checked automatically for slurs and profanity before they are sent; blocked messages are not stored, and we record only that a message was blocked and why (not its content). The site administrator can allow a user's strong language or suspend their Mail, but has no way to read anyone's messages through the Site.

Customer Care

Signed-in users can open support tickets with the site owner (Max) in the Customer Care app. For each ticket we store the reason you picked, the subject, the messages you and Max exchange, their dates, whether they were read, and whether the ticket is open or closed. Only you and Max can see your tickets; Max sees your name and email address in order to reply.

You can also record voice notes of up to one minute. Your browser asks for permission before it uses your microphone, recording only happens while you're recording a note, and nothing is sent until you press Send voice note. We store the recording and its length, and play it back only to you and Max. Voice notes are not transcribed, analysed, or shared.

Max's Logbook (blog)

Anyone can read the blog. Signed-in users can like posts and leave comments. For a like we store which account liked which post. For a comment we store the text, the post, the date, and your account. Comments are public: everyone who reads the post sees the comment with your first name and last initial (never your email address). Comments are checked automatically for slurs and profanity, like Mail. You can delete your own comments at any time; the site owner may remove comments that break the Terms. Like counts carried over from the earlier version of the blog are anonymous totals and aren't linked to anyone.

Usage counts

To see how the Site is used, we keep aggregate daily counts: how many people visited, how many were signed in, which apps were opened, and how often each blog post was read. We don't use cookies or store anything in your browser for this, and we don't store IP addresses. To count each visitor only once per day, the server makes a one-way code from the date, your IP address, and your browser type; the code changes every day, can't be turned back into your IP address, and is deleted after two days. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. The counts are not linked to your account and are kept for 13 months.

Guestbook and high scores

If you sign the Guestbook while signed in, your note is public with your first name and last initial; you can delete it at any time. You can also sign without an account: then we store only the name you type and your note (not your IP address), shown publicly with a Guest badge. Your browser keeps a private key that lets you delete that note later from the same browser; otherwise, email us and we'll remove it. If you play Flappy Bird, Minesweeper, or Solitaire while signed in, your best score or time is saved and shown on the public High Scores board with your first name and last initial. Both are deleted when you delete your account.

Profiles, achievements, and notifications

If you're signed in you can choose an avatar from a fixed set and write a short bio. Your profile is public: it shows your first name and last initial, avatar, bio, the month you joined, your best scores, how many forum posts you've written, and your achievements. It never shows your email address. Achievements are awarded when you do things on the Site, and some are recorded by your browser (for example, which apps you've opened). We also keep a short list of notifications for your account, such as new mail or replies, for up to 60 days.

Forum

Signed-in users can post on the public Forum. Each post is shown with your first name, last initial, and avatar, and is checked automatically for slurs and profanity, like Mail. You can delete your own replies, and a thread of yours that has no replies yet; the site owner may remove posts that break the Terms. When you delete your account, the text and titles of your posts are erased, and other people's replies stay.

Custom wallpaper

If you upload your own wallpaper, your browser shrinks it first (which removes photo metadata such as location) and we store the picture with your account. Only you can see it. Please only upload pictures you have the right to use.

Shared Folder

Signed-in users can add text files and drawings to the Shared Folder. Everything in it can be opened and copied by anyone who is signed in. Other users aren't told who added an item, but we store that with the item and the site owner can see the name and email address of the person who added it. You can delete your own items at any time, and they're removed when you delete your account.

Big Canvas

Everyone can watch the shared canvas, and signed-in users can place a limited number of pixels each day. For each pixel we store its position, the colour you chose, time, and the account that placed it. Other users can't see who placed a pixel; the site owner can, in order to remove abuse. Your pixels stay on the canvas after you delete your account, but they're no longer linked to you.

Reports and two-player games

If you report something, we store what you reported, the reason, and your account, so nobody can report the same item twice. The site owner sees the report but isn't shown who sent it. In the Game Room, we store the moves and result of each game and which accounts played. Your opponent sees your first name, last initial, and avatar. Games are deleted after 30 days without activity.

Emails

If you're signed in, we can email the address on your account about things that happen to your account, such as a ticket being opened or answered, new Mail, or a reply to your forum thread. Blog posts and What's New updates are only emailed if you turn them on. You can change all of this any time in Email preferences (the ^ in the taskbar, or your Profile), and every email has an unsubscribe link. Emails are sent through our email provider, Spacemail.

Live visitor count

The "online" count works from a random code your browser makes each time the page loads. It is held only in memory for about 90 seconds and isn't linked to your account, your IP address, or anything else.

If you use the Site as a guest

Guest desktops are kept only in your own browser's session storage. They are not sent to our server and are erased when you close the browser tab. If you later sign in for the first time in the same tab, that guest desktop is copied into your new account.

If you send us a message

If you contact us through a form on the Site, we receive the name, email address, subject, and message you enter, along with your IP address and browser type to help prevent spam.

Technical information

Like any website, our server receives your IP address and basic request details (such as the page requested and your browser type) in order to deliver the Site. IP addresses are used briefly, in memory, to limit abuse (for example, too many messages in a short time). Error logs may contain basic request details for troubleshooting.

The Site is delivered through Cloudflare, which protects it from attacks and speeds it up. Cloudflare processes requests on our behalf and may set strictly necessary security cookies and run a small bot-detection script.

3. Cookies and browser storage

We use only what is needed to make the Site work. There are no advertising, analytics, or cross-site tracking cookies.

Name	Type	Purpose	Duration
`__Host-mos_session`	Cookie (first-party)	Keeps you signed in. A random key that is HttpOnly, Secure, and limited to this site.	Up to 30 days (ends after 14 days unused, or when you log off)
`__Secure-mos_oauth`	Cookie (first-party)	Protects the Google sign-in step against forgery.	10 minutes
`__cf_bm` and similar	Cookie (Cloudflare)	Security and bot protection.	Up to 30 minutes
`maksimos:booted`, `maksimos:boot-every`	Local storage	Remembers you have seen the boot screen, and whether to play it on every visit.	Until you clear it
`maksimos-offline-2`	Browser cache	The small page shown when you have no connection. It holds nothing about you.	Until you clear it
`maksimos:announcements-seen`	Local storage	Which announcements you've dismissed, so they don't come back.	Until you clear it
`maksimos:notified`, `maksimos:claimed`, `maksimos:apps`	Local storage	Which notifications you've already seen, and your progress towards achievements.	Until you clear it
`maksimos:guest`, `maksimos:guest-state`	Session storage	Your guest choice and guest desktop.	Until you close the tab

4. How we use information

To sign you in and keep you signed in.
To save and restore your desktop, files, and settings.
To greet you by name on the Site.
To reply to messages you send us.
To keep the Site secure, prevent abuse, and fix problems.

We don't sell or rent your information, use it for advertising, build marketing profiles, or use it to train AI models.

5. Google user data

MaksimOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from Google is used only to sign you in and personalise your account on the Site. It is not shared with third parties, except as needed to run the Site (see section 6), to comply with the law, or with your consent.

6. When information is shared

We don't share your personal information except:

Service providers that run the Site for us: our hosting provider, which stores the Site and its data, and Cloudflare, which delivers it. They process data only to provide their services.
Legal reasons, if required by law or to protect the rights, safety, or security of users, the public, or the Site.
With your permission.

7. How long we keep information

Account and desktop: kept while your account exists. Deleting your account from the Site removes it, your desktop, and your sessions immediately; if you ask us by email, we do it within 30 days.
Sessions: end after 30 days, after 14 days without use, or when you log off; ended sessions are deleted within an hour.
Security log: kept for 90 days.
Mail: kept until both the sender and the recipient have deleted it (or deleted their accounts), then removed within an hour. Contacts are kept until you remove them or delete your account.
Customer Care tickets and voice notes: kept while the ticket is open, then deleted 24 months after it was closed. Deleting your account removes all of your tickets and voice notes immediately.
Blog likes and comments: kept until you remove them (unlike, or delete the comment) or delete your account.
Messages: kept as long as needed to respond, and no longer than 24 months.
Forum posts: kept until you or the site owner remove them, or you delete your account, which erases their text.
Notifications: kept for 60 days.
Backups: encrypted nightly backups of the database are kept for 14 days, so something you delete can remain in a backup for up to 14 days before it's gone for good.
Guest desktops: never stored by us; your browser deletes them when you close the tab.

8. Your choices and rights

Delete your account: open the account panel (the ^ in the taskbar) and choose Delete account. For your security, we may ask you to sign in with Google again first. Deletion is immediate and permanent. Security log entries remain for up to 90 days without any link to your account.
Access, correction, or export: email [email protected] from the address on your account and we will respond within 30 days.
Log off: use Start → Log Off to end your session on that device.
Disconnect Google: you can remove the Site's access at any time from your Google Account at myaccount.google.com/connections.
Use the Site without an account: continue as a guest, and nothing is stored on our server.

Depending on where you live, you may have additional rights under local law (for example, to object to processing or to complain to a data protection authority). Contact us and we will help.

9. Security

The Site is served only over HTTPS. Account data is kept in a database on our server that only the Site's own restricted account can access, session keys are stored only in hashed form, and sign-in cookies are HttpOnly and Secure. No method of transmission or storage is completely secure, so we can't guarantee absolute security.

10. Children

The Site is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

11. International visitors

Our servers, and our service providers' servers, may be in countries other than yours. By using the Site, you understand that your information may be processed in those countries.

12. Changes to this policy

We may update this policy as the Site changes. We will post the new version here with a new effective date, and for significant changes we will show a notice on the Site.

13. Contact

Maksim Babayan, MaksimOS · [email protected] · maxus.life