Privacy Policy

This policy explains what data the software published at jarvislai.com accesses, why it accesses it, where that data goes, and how you can revoke access. It covers both the public website and the private automation client that connects to Google APIs on behalf of its single operator.

1. Who operates this

jarvislai.com is a personal portfolio site and automation workspace operated by Jarvis Lai as an individual, not a company. There is one user: the operator. The Google integration exists so that his own assistant tooling can read his own mail, calendar, and documents. No third-party customer accounts are served, and no user accounts are created on this site.

Contact for any privacy question or data request: jarvis2286@gmail.com.

2. What data is accessed

When the operator authorizes the application with his own Google Account through Google OAuth 2.0, the application may access the following, limited to that one authorized account:

• Gmail: message headers (sender, subject, date) and message bodies, read to classify mail and produce summaries. The application can also send mail and apply labels from the same account.
• Google Calendar: existing events in a forward-looking window, read to avoid duplicate entries, and new events created for date-bound commitments such as meetings, deadlines, and travel.
• Google Drive: file listings and file contents that the operator points the tooling at.
• Google Sheets and Docs: spreadsheet and document contents used for reporting and record keeping.
• Google Contacts: contact names and email addresses, read only, used to resolve who a message is from.

No other Google data is requested. Scopes are fixed at authorization time and can be reviewed on the Google consent screen.

3. How the data is used

• Producing a short daily briefing of important email, so that routine mail does not need to be read manually.
• Creating calendar entries for genuine date-bound commitments found in that mail.
• Saving durable facts from selected messages into a local plain-text knowledge vault on the operator's own computer.
• Generating reports and summaries from spreadsheets and documents.

Data is used only for these purposes. It is not used for advertising, not used to build profiles for third parties, and not used to train machine-learning models beyond the operator's own local tooling.

4. Google API Services User Data Policy

The application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms:

• Google user data is used only to provide or improve the features described in section 3.
• Google user data is not sold, and is not transferred to third parties except as needed to provide those features, to comply with law, or as part of a merger or acquisition.
• Google user data is not used for serving advertising.
• Humans do not read Google user data unless the operator grants permission for a specific message, it is necessary for security or support, or the data has been aggregated and anonymized.

5. Where data is stored

Processing happens on the operator's own machine. The following is stored there:

• An OAuth token file containing the access and refresh tokens issued by Google. It lives in a local configuration directory and is readable only by the operator's user account.
• Plain-text notes distilled from selected messages, kept in a local vault directory.
• Local logs of what was processed and when.

The website itself is static. It serves HTML, JSON, and font files only; it sets no cookies, runs no analytics, embeds no third-party trackers, and does not read Google data at page load.

6. Retention

• OAuth tokens are kept until the operator revokes access or deletes the token file.
• Message content is processed transiently. Only messages judged durable are summarized into local notes, and those notes remain until the operator deletes them.
• Raw email bodies are not copied into a remote database, because there is no remote database.
• Calendar events created by the application remain in the operator's Google Calendar and can be deleted there at any time.

7. Sharing

There are no third-party recipients of your data beyond Google itself. The application sends requests to Google APIs and receives responses; nothing is forwarded to advertisers, analytics services, or data brokers. Files are not shared with other users unless the operator explicitly shares them through Google Drive.

8. Security

• All traffic to Google APIs uses HTTPS with certificate validation.
• OAuth is used instead of storing a Google password; the application never sees or stores the account password.
• Tokens are scoped to the specific services listed in section 2, and can be revoked at any moment.
• Access tokens are short-lived and are refreshed automatically; the refresh token is the long-lived credential and is stored only locally.

9. Your choices and how to revoke access

• Review or remove the application's access at myaccount.google.com/permissions. Revoking there takes effect immediately for future requests.
• Delete the local token file (google_token.json) to remove the stored credential from the machine.
• Delete any calendar event the application created, directly in Google Calendar.
• Request deletion of any retained note by emailing the address in section 1.

10. Children

The service is operated for personal use and is not directed at children under 13. No data is knowingly collected from children.

11. Changes to this policy

This policy may be updated as the tooling changes. The effective date at the top of this page reflects the current version. Material changes will be reflected here rather than announced separately, since there is a single user.