Privacy policy

Google account access

The owner authorises the app through Google OAuth. The read-only connector uses the Gmail profile endpoint to check account access. It uses calendar identifiers and free/busy information to check access to Google Calendar. For these checks it does not read message bodies or attachments, send email, or create or edit events.

Use, sharing and storage

The VPS uses a private credential store to refresh access and make requests to Google. The connector processes the Google responses on the VPS and passes only a status result to the relevant assistant. OpenAI Codex processes Workspace prompts and those status results. The connector does not forward raw Gmail profile or Calendar response data to the model.

Workspace can store chat prompts, replies and tool status in the owner’s private conversation history. The VPS health journal retains check outcomes under the VPS journal retention settings. Private backup copies may retain records until the copies are removed or expire.

Revoking access and removing records

The owner can stop future Google access via Google Account connections. Revocation does not itself remove previously saved Workspace history, logs or backup copies. For credential and history removal, use the support contact displayed in the Google consent configuration.

The app handles Google data in line with the Google API Services User Data Policy, including its Limited Use requirements.