Privacy Policy

Last updated: 2026-07-04

What we collect

We collect the account information you provide (name, email, profile picture), the content you create or upload, and basic usage data needed to operate the service.

Google account data

If you choose to connect your Google account in Settings, we access only the Gmail, Calendar, and Drive data needed to perform the specific actions you ask our assistant to perform (e.g. checking unread email counts, listing upcoming events, listing recent files). We do not access your Google data unless you have explicitly connected your account, and you can disconnect it at any time from the Settings page. Tokens are stored encrypted and are never shared with third parties.

Information obtained through Google APIs is used exclusively to provide the specific in-app feature or action you have requested. This data is never used to train or improve AI or machine-learning models, never used for advertising or analytics unrelated to your request, and never transferred to third parties except as required to fulfil your request (e.g. displaying your emails inside the app).

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google data sharing and disclosure

We do not sell, rent, or share your Google user data with any third parties for their own purposes. The only external systems that may receive your Google data are: (1) Google's own APIs, which process requests on your behalf; and (2) our cloud hosting infrastructure, which stores your encrypted OAuth credentials. No other third party has access to your Google account data. We will disclose data only if required by law or to protect the rights, property, or safety of our users.

Data protection and security

We protect your sensitive data using the following mechanisms: OAuth access and refresh tokens are stored encrypted in our database using AES-128-CBC symmetric encryption (Python cryptography library / Fernet). All data in transit between your browser, our servers, and Google APIs is protected by HTTPS/TLS 1.2 or higher. Raw tokens are never written to application logs or exposed in API responses. Access to the encrypted credential store is restricted to authorised application processes only. You may revoke our access to your Google account at any time, either from the Settings page or directly from your Google Account permissions page (myaccount.google.com/permissions).

How we use your data

Your account data (name, email, content you create) is used solely to provide the features of this application. We do not sell your personal data, and we do not use Google API data for any purpose other than performing the specific action you request within the app.

Data retention and deletion

You can delete your account and associated data at any time from your profile settings, or disconnect any connected third-party account (such as Google) independently.

Contact

Questions about this policy can be sent to medusadbt@gmail.com.