Privacy Policy — JARVIS Agent

This policy describes how JARVIS Agent (“the Application”, “the agent”) handles information when it accesses a Google Account. The Application is a private, single-user automation tool built and operated by one individual, Mateusz (“the owner”, “we”). It is not a public service and has no users other than its owner.

In short: the Application accesses only the owner's own Google Account, on the owner's explicit instruction, with the owner's explicit consent. Nothing is sold, shared, published, or sent to third parties. All data stays on the owner's self-hosted hardware. Access can be revoked at any time.

1. Data the Application accesses

Only after the owner grants consent through Google's OAuth 2.0 screen, the Application may access:

Gmail	Read messages, metadata and labels; modify labels; compose and send messages. Used to triage incoming mail, summarise threads, and send replies that the owner has approved.
Google Calendar	Read calendar events (titles, times, locations, attendees) and create or delete events on the owner's request. Used to prepare briefings and answer schedule questions.
Google Drive	Create, upload, download and organise files owned by the owner. Used to hand the owner generated documents and to store agent-produced artefacts.
Google Docs & Sheets	Create and edit documents and spreadsheets in the owner's Drive, on the owner's request.
Contacts	Read-only access to the owner's contacts, to resolve names to email addresses when drafting mail.

The Application does not access any Google data belonging to anyone other than the owner, and it requests nothing beyond the scopes listed above.

2. How the data is used

Solely to carry out tasks the owner asks for, and to operate the Application itself.
To show the owner information in the conversation interface the owner uses (a private chat client).
To keep short-lived working state (for example, an email draft awaiting approval) on the owner's server.

The Application does not use Google user data for:

advertising, marketing, or profiling of any kind;
training or improving machine-learning models — neither its own, nor any third party's;
determining creditworthiness or lending purposes;
sale, rent, or transfer to any third party.

Automated analysis of message content is only performed to serve the owner's own requests (for example, “summarise unread mail”), never for any other purpose.

3. Where the data is stored

The Application runs entirely on a self-hosted server located on the owner's private premises and reachable only through the owner's private network. Configuration — including OAuth credentials and access tokens — is stored as local files on that server, readable only by the account the agent runs under.

No Google user data is transferred to cloud services, analytics providers, or any third-party processor. There are no subprocessors.

4. Retention

OAuth access and refresh tokens are kept until the owner revokes access or the token expires.
Working files the agent creates (documents, spreadsheets, uploaded files) live in the owner's own Google Drive and are managed by the owner like any other file.
Local logs record technical events (task started, API call failed) and are rotated; they are not used for profiling.

5. Who can see the data

The owner, and only the owner. The Application is not operated by a company, has no staff, and shares no data with anyone. Should the owner ever change this, this policy would be updated before any such sharing occurred.

6. Security

Access is granted through Google OAuth 2.0 with a dedicated client; the account password is never stored by the Application.
Tokens are stored with filesystem permissions restricted to the agent's runtime user.
The hosting server is not exposed publicly; administrative access is limited to the owner's private network.

7. Google API Services User Data Policy

JARVIS Agent's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

Google user data is used only to provide or improve the owner-facing features described above.
Google user data is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice.
Google user data is not used for advertising, and is not used to train or improve generalised AI/ML models.
Human review of Google user data is limited to the owner reviewing their own data.

8. Revoking access and deleting data

Access can be revoked at any time at myaccount.google.com/permissions. After revocation the Application can no longer access the account, and no further data is read.

To request deletion of any data stored locally by the Application, write to [email protected]. Local records are deleted within 30 days of such a request. Data held in the owner's own Google Account (mail, files, events) is controlled by the owner and can be deleted directly in Google's own interfaces.

9. Children

The Application is not directed at children and is not made available to anyone other than its owner.

10. Changes to this policy

If this policy changes, the “last updated” date above is revised and the new version is published at this address.

11. Contact

Controller of the data: Mateusz, owner and sole operator of JARVIS Agent.
Email: [email protected]