Privacy Policy

1. Who operates this service

Personal Workspace is a self-hosted, single-tenant assistant operated privately by its owner on a virtual private server. It is not offered to the public, has no sign-up process and has no user accounts other than the owner's own. Throughout this policy, "the owner" means the single individual who operates the service and whose Google Account it connects to.

2. What data the service accesses

Personal Workspace accesses Google user data only through Google's OAuth 2.0 flow, and only after the owner has explicitly granted access on Google's consent screen. The following scopes are used:

Google Calendar

• Calendar access - to read upcoming events and to create or update entries when the owner asks for it.

Google Drive

• Read-only Drive access - to read files and folders the owner points the service to.
• Per-file Drive access - to create files and folders that the service itself produces, and to manage only those items.

Basic identity

• Email address and basic profile identifier - used solely to confirm which Google Account the stored authorisation belongs to.

No other Google scopes are requested. If a future feature requires a different scope, it will be requested separately through the same consent screen, and this policy will be updated before that happens.

3. How the data is used

Google user data is used exclusively to carry out requests the owner makes of the assistant - for example, reporting what is on the calendar, scheduling an event, locating a document, or organising files.

Google user data is not used for advertising, is not sold or rented, is not shared with third parties for their own purposes, and is not used to build profiles or to train machine-learning models.

4. Processing by an AI model provider

The assistant produces its responses using a large language model operated by a third-party provider. To answer a request, the relevant portion of the material involved - which may include calendar entries or the contents of files the owner has asked the service to work with - is transmitted to that provider over an encrypted connection so that a response can be generated.

This processing happens only as part of fulfilling the owner's own requests. The provider acts as a processor for that purpose and is not permitted to use the data to serve advertising or to sell it onward. Material is sent only when a request actually requires it.

5. Storage and security

OAuth tokens are held in an encrypted keyring on the server, unlocked by a secret supplied through the server environment. They are not stored in plain text and are never exposed in any public page or interface.

Content retrieved from Google services is processed to fulfil a request. Where the owner has asked the assistant to keep working notes, summaries or produced files, those are written to storage on the same private server or back to the owner's own Google Drive. Access to the server is limited to the owner through authenticated remote access.

All communication with Google APIs takes place over TLS. This site itself is served over HTTPS.

No security measure is absolute, and no guarantee of absolute security is made here.

6. Retention and deletion

The service applies no fixed automatic deletion schedule. Data is retained for as long as it remains useful to the owner and is removed at the owner's direction.

The owner can withdraw access at any time:

• by revoking the application's access in their Google Account under Security - Your connections to third-party apps and services; and
• by deleting the stored authorisation from the server, after which the service can no longer reach Google data at all.

Revoking access in the Google Account immediately prevents any further access to Google user data, regardless of what is stored locally.

7. Limited Use disclosure

Personal Workspace's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Children

The service is not directed at children and is not made available to anyone other than its owner.

9. Changes to this policy

If the service's handling of Google user data changes, this page will be updated and the date at the top revised before the change takes effect.

10. Contact

Questions about privacy or about the handling of Google user data can be sent to runandback@gmail.com.