[Unit]
Description=apply umask over created/moved files
After=local-fs.target

[Service]
ExecStart=/usr/local/bin/inotifymask 0177 ~/private ~/also-private

[Install]
WantedBy=default.target