Privacy

The initial integration requests read-only Gmail, Calendar and Drive access, plus basic account identity. It cannot use these grants to send mail, change events or modify Drive files. Only accounts individually authorized by their owner are used.

OAuth credentials are stored on the operator's server in encrypted per-account files. Relevant data may be processed by the assistant's configured AI providers (OpenRouter/DeepSeek and OpenAI) to answer the owner's requests. Access is not a promise that data will remain entirely on the local machine. Requested summaries, selected memories and local drafts may be stored on that server. Routine Discord reports should contain operational summaries rather than private email bodies.

The operator controls access, local retention and deletion. Encrypted recovery backups currently retain up to 14 daily and 8 weekly snapshots, so deleted local data may remain in encrypted backups until those snapshots expire. Credentials and personal content are not published in the code repository. The service does not sell Google user data or use it for advertising.

The owner can revoke access at any time from Google Account > Third-party apps and services. Revocation stops new authenticated access; it does not automatically remove existing local notes or encrypted backups. The operator can remove those separately.