Google-connected personal workflows
Privacy policy
This policy describes the Iris email and Athena agenda workflows within Alfred Personal Assistant, operated by Emre Öztimur for personal use.
It covers information obtained through Google APIs and the related private notes, processing records and notifications. It also explains this information website. The application is not offered as a public service.
1. Information accessed
- Gmail: account identity, message and thread identifiers, labels, dates, sender and recipient headers, subjects, message text and attachment metadata. The scheduled workflow reads email bodies when classifying messages; it does not need to download attachment files for that classification.
- Google Calendar: accessible calendar details and event information such as titles, dates, times, locations and descriptions. The appointment workflow uses relevant email evidence to prepare new events.
- Google Tasks: task-list and task information used to prepare agenda briefings.
- Connection and processing records: OAuth credentials, account verification hashes, synchronisation checkpoints, decisions, action proposals and execution receipts.
2. Why Google permissions are requested
| Permission | Purpose in this application |
|---|---|
| Gmail modification | Read incoming mail, create Iris labels and add those labels to messages. Google’s permission is broader than the operations allowed by the scheduled application code. |
| Calendar read access | Read calendars and events for agenda briefings and appointment checks. |
| Owned-calendar event access | Add source-verified appointments to the owner’s primary calendar under the owner’s authorised policy. |
| Tasks read access | Include open tasks in briefings. |
These connections can use separate OAuth grants. Only permissions approved in the relevant Google consent screen are granted. The current scheduled email workflow does not send mail, remove existing labels, archive or delete messages, or mark them as read. The appointment workflow does not send invitations or delete existing events.
3. How information is processed
The email and agenda workflows run on the owner’s private computer infrastructure. They use a locally hosted language model to classify messages, identify proposed actions and assist with briefings and appointment extraction. These workflows do not send their email bodies to a cloud language-model service and do not train or fine-tune models as part of their scheduled operation.
Models can make mistakes. The application uses validation and processing receipts, and uncertain items can remain for review. Selected proposals, appointment evidence and outcomes can be stored in the owner’s private Alfred Next notes and associated private memory workflows.
4. Storage and retention
OAuth credentials and operational records are stored in restricted files and databases on the owner’s equipment. The Iris checkpoint database stores message identifiers, classification decisions and handoff state; it is not a complete email archive. Email bodies are fetched for processing. Short extracts, summaries or appointment evidence may remain in derived notes, receipts, briefing files, private conversation history or explicitly retained diagnostic copies.
Private notes may synchronise between the owner’s personal devices. Local backups may contain copies of retained files. There is currently no universal automatic deletion period: records and notes remain until the owner removes them or retires the relevant workflow. Backup copies may remain until they are separately removed or retired.
5. Sharing and third-party services
- Google: supplies authorised Gmail, Calendar and Tasks data; receives requested label changes and approved new calendar events.
- Discord: receives selected agenda briefings and notifications sent to the owner’s chosen channel. These can include event titles, dates, task information and summaries of email action proposals. Discord processes those messages under its own policies.
- Personal devices: receive private notes through the owner’s configured synchronisation and backup arrangements.
Google-derived private notes are intended for the private side of the assistant setup, rather than the general memory available to cloud agents. This website does not publish mailbox contents, calendar entries, private notes or OAuth credentials.
The application does not sell Google user data, use it for advertising, or use it to develop, improve or train generalised AI or machine-learning models. Its use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Website visitors
This is a static information website. Its pages contain no application account registration, email upload, advertising or analytics scripts. The hosting and network providers may process ordinary request information, such as IP addresses and request logs, to deliver and secure the site. Google authorisation is initiated by the private application, not by a sign-in form on this website.
7. Revoking access and deleting information
The owner can withdraw a connection through Google Account connections and stop the related scheduled jobs. Revoking access prevents subsequent authorised access once existing access tokens expire; it does not automatically remove labels or events already created, nor delete local records, notes, backups or Discord posts.
For deletion or correction, contact the operator below. The operator can remove retained application data and credentials from the devices under their control, and separately remove relevant notes, backup copies and Discord messages where accessible. Changes to original Gmail messages and Calendar events remain separately controlled by the account owner.
8. Contact and changes
Operator: Emre Öztimur.
Email: emreoztimur@gmail.com.
This page will be updated when the described data practices change. The date above identifies the current version.