Privacy Policy

Who we are

The Vastream applications are developed and operated by Richard Dawson ([email protected]), in Google Cloud project bubbly-triumph-508920-i8. This is a personal application. The developer and the only user are the same person. There are no other users, no accounts, and no sign-up.

What Google data we access

The applications access only the Google account of the owner. The data accessed is limited to what each requested OAuth scope permits:

• Gmail — read messages and threads, search the mailbox, create and update drafts, send on the owner’s behalf when explicitly instructed, and add or remove labels. Read via gmail.modify; labels via gmail.settings.basic.
• Google Drive — search and list files, read file contents, read metadata and permissions, and create or copy files. Read via drive.readonly; writes limited to files the application created or was explicitly opened via drive.file.
• Google Docs, Sheets and Slides — read and edit content in documents, spreadsheets and presentations the owner asks it to work on.
• Google Calendar — list, read, create and update events on the owner’s own calendars via calendar.events.

No scope is requested for any purpose that has not been implemented. See Applications and scopes for the full list and the reason for each one.

Why we access it

The data is used for one purpose only: to carry out the owner’s own instructions on their own account — finding a message or file, summarising it, drafting a reply, renaming or organising a document, or adding a calendar event. Every use is a user-facing feature that is visible and prominent in the application’s own interface.

Where it is stored

All processing happens on hardware the owner operates at their own premises. OAuth access tokens and refresh tokens are stored in files on that private server, with filesystem permissions restricted to the owning user, and are never placed in version control. Traffic between the application and Google uses TLS. The services themselves are not reachable from the public internet.

Who we share it with

The applications are driven by an AI assistant. When the owner asks the assistant to read, summarise, or act on a message, document or event, the relevant content is transmitted to the large-language-model provider configured in that assistant in order to complete the request the owner asked for. This is the only onward transfer of Google user data that occurs, it happens only for the content the owner has asked to be worked on, and the owner consents to it by using the application.

Google user data is never:

• transferred or sold to advertising platforms, data brokers, or information resellers;
• used to serve advertising, including retargeting or interest-based advertising;
• used to determine credit worthiness or for lending purposes;
• displayed, sold, or distributed to any third party conducting surveillance;
• shared with any other person or organisation.

No human other than the owner reads the data. Data is not read by staff for analytics, product development, or any internal purpose.

Retention and deletion

• Access tokens expire on their own, typically within about one hour.
• Refresh tokens are kept until they expire or are revoked.
• Content that the assistant has processed is not kept in a separate archive; any working notes are stored on the owner’s private server and can be deleted at any time.
• Revoking access at myaccount.google.com/permissions ends all further access immediately. Deleting the token files on the private server removes the stored credentials.

Children

The applications are not directed at children and are not available to children.

Changes to this policy

If the applications begin accessing a type of user data that is not disclosed here, this policy will be updated first and the owner will be prompted to consent again before that data is accessed.

Contact

Questions about this policy: [email protected].