Hub ("the service") connects Google accounts and AOL mailboxes you choose to
link to an AI assistant you use, through the Model Context Protocol. This policy describes
exactly what the service stores, what it never stores, and why it asks for the
access it asks for. The service is open source, so every statement here can be
checked against the code.
What we store
Google OAuth tokens for each account you link — encrypted at
rest with AES-256-GCM. The database never holds a usable token.
Account identifiers — the email address and Google subject ID
of each linked account, the scopes Google granted, and timestamps.
Your sign-in identity — the Google subject ID of the account
you sign in with, used as the key that ties your linked accounts to you and
to no one else.
Connector credentials — OAuth clients your AI assistant
registers, and authorization codes and refresh tokens it is issued. Codes and
tokens are stored as one-way hashes; codes are single-use and expire in five
minutes, refresh tokens rotate on every use.
AOL app passwords for each AOL mailbox you link — a password AOL
generates for this service alone, encrypted at rest with AES-256-GCM like the Google
tokens. It is checked against AOL before it is stored, used only to sign in to AOL's
mail servers, and never logged or shown back.
Subscription status — if you subscribe, your Stripe customer and
subscription IDs, the subscription's status and renewal date. Card details go
to Stripe directly and never reach this service.
What we never store
Content. Emails, attachments, calendar events, files, contacts and tasks flow
through the service in response to a request from your AI assistant and are not
written to disk or database. There is no logging of message bodies, file
contents, or search results.
Google user data, scope by scope
Each Google account you link grants these scopes, each for one reason:
Scope
Why
gmail.modify
Search, read, draft, send, label, archive and trash mail on your
instruction. This scope deliberately excludes permanent deletion —
nothing the service can do destroys mail irrecoverably.
calendar
Read your calendars and create or respond to events on your instruction.
drive
Search, read, create, edit, share and trash files on your instruction.
The service does not expose Drive's permanent-delete endpoint.
contacts.readonly, contacts.other.readonly
Resolve names to addresses ("email Ann"). Read-only; the service cannot
change your address book.
tasks
Read and update your task lists on your instruction.
openid, userinfo.email, userinfo.profile
Know which account was linked, and which person is signed in.
AOL mailboxes
AOL offers no OAuth sign-in for mail apps, so an AOL mailbox is linked with an app
password instead. That password reaches the whole mailbox, so the limits are kept by the
service itself: it searches, reads, drafts, sends, files into folders and trashes mail on
your instruction, and never deletes mail permanently. The only deletion it performs is of
a single draft you ask it to delete or replace, and it refuses to delete a folder that
still holds mail. AOL mailboxes have no calendar, files, contacts or tasks here.
Limited Use disclosure
The service's use and transfer of information received from Google APIs adheres
to the Google
API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to provide the features described above, at your
request. It is not used for advertising, not sold, not used to train machine
learning models, and not read by humans except with your explicit consent for
support, for security, or where required by law.
Who your data goes to
Google — every read and write is a request to Google's APIs,
authorized by the tokens for the relevant account.
AOL — for an AOL mailbox you link, every read and write is an IMAP
or SMTP session with AOL's mail servers, signed in with that mailbox's app password.
AOL receives no Google user data.
Cloudflare — mail you send from an AOL mailbox passes through a
relay we run on Cloudflare Workers, because our host blocks outbound SMTP. It
receives the message and that mailbox's app password for that one send, hands
them to AOL's mail server, and stores and logs nothing.
Your AI assistant — results are returned to the MCP client
(for example, Claude) that made the request under your credentials. What that
assistant retains is governed by its own privacy policy.
Stripe — if you subscribe, Stripe processes the payment and
receives your sign-in email address. It receives no Google user data.
Nobody else. There are no analytics, no advertising partners,
and no sale or sharing of data.
Isolation between users
Every credential the service issues carries the identity of the person who signed
in, and every request is scoped to that identity. One user cannot list, read, or
act on another user's linked accounts, including by naming them directly.
Where data lives
The service and its PostgreSQL database are hosted on
Railway. Connections are TLS end to end; the
database is reachable only over the deployment's private network.
Retention and deletion
Unlink an account at /gmail/connect —
the service revokes its grant with Google and deletes the stored tokens and
identifiers for that account. For an AOL mailbox, unlinking deletes the stored app
password; delete the app password itself in AOL Account Security too, since an app
password cannot be revoked from here.
Full deletion, self-serve — "Delete everything" on
/gmail/connect unlinks every account (revoking each
grant at Google), deletes all stored tokens and every record tied to your
identity, and signs you out. Or email
brisebyme@gmail.com and it is done
for you.
Expired authorization codes and refresh tokens are purged automatically.
Changes
Material changes to this policy will be reflected on this page with a new
"last updated" date before they take effect.