Privacy Policy

Effective Date: 2026-04-08

This Privacy Policy specifically outlines how gmail-autodraft (the "Service") handles data passing through its headless execution pipelines.

1. Data Minimization & Retention

The Service is explicitly designed to not save, store, log, or persist any of your email content. When Google Pub/Sub triggers a webhook, the Service retrieves the targeted email from Google's servers securely in memory solely to generate a response draft. Upon successful drafting or immediately upon generation failure, all email contents are safely scrubbed from active memory.

The only objects permanently stored in our databases are strictly limited to:

• Your Google OAuth `refresh_token` (used uniquely to access the API headlessly).
• Aggregated and fully anonymized webhook payload Identifiers (e.g. `historyId` and `messageId`) stringently for deduplication architecture purposes.
• Your custom "Tone Rules" system prompt constraints explicitly configured by you.

2. Third-Party AI Processors (Google Gemini)

To fundamentally operate, all email context retrieved strictly for drafting purposes is securely forwarded over HTTPS instantly to Google Gemini AI Language Models. You explicitly consent to parsing your email content through these specific third-party providers upon generating API tokens. The integration ensures strict boundaries following standard data processing limits enforced by Google APIs.

3. Third Party Compliance

The Service operates as an automated routing proxy and relies exclusively on the security of the Google Cloud ecosystem. We do not sell, rent, extract, or exploit ANY analytical context from your messages. Usage strictly complies within the boundaries of standard automated Assistant integrations.

4. Age Restrictions

The Service and its APIs are not intended for use by persons under the age of 18. We do not knowingly solicit or collect any information from anyone under this age threshold.