Privacy policy

1. Information accessed and processed

With the owner's consent, the integration obtains the connected Google account's email address and its verified-email status to confirm the authorized account. It obtains OAuth authorization credentials so the local application can send email without collecting a Google password.

The integration processes outgoing recipients, subjects, message bodies, delivery timestamps, and Gmail acceptance identifiers for authorized reports and alerts. These outgoing messages may contain private operational information supplied by the owner's local workflows.

The requested scopes are openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/gmail.send. This connection does not request inbox reading, attachment downloading, message deletion, or label-management permissions.

2. How information is used

Information is used to authenticate the Gmail connection, verify account identity, send owner-authorized reports and alerts, prevent duplicate sends, maintain delivery records, and diagnose failures. The current local application policy limits recipients to the owner's verified email address, although Google's send permission itself is broader.

This connection does not conduct public email campaigns or authorize contact with outside business counterparties. It does not use Google user data for advertising, resale, credit decisions, or training general-purpose AI models. The notification integration does not retrieve inbox content for AI processing. Separate approved workflows may prepare the report text that it sends.

3. Storage and security

OAuth credentials are stored in a private file on the owner's computer with file permissions limited to the operating-system account. The local notification service uses HTTPS to communicate with Google. Credentials are not placed in this public website or its upload package.

Outgoing message content and delivery history are stored in the local operational database and may be retained in local backups. File permissions and access controls are used; these files are not encrypted by the application itself. Security also depends on the owner's device and account protections.

4. Sharing and human access

Google processes account authorization and outgoing email to provide authentication and Gmail delivery. Google may retain messages and service records under its own policies. The intended recipient is the owner.

The integration does not sell Google user data or disclose OAuth credentials to AI providers or advertisers. Local records are available to the owner and to people or tools the owner specifically authorizes to maintain or inspect the application. Any such access must be limited to the authorized purpose. Information may also be disclosed where required by law or necessary to address a security issue.

5. Retention and deletion

Local authorization credentials are retained while the connection is configured, until the owner removes them or replaces the connection. Delivery history and outgoing report content are retained locally until the owner deletes them under the owner's recordkeeping needs; there is no automatic deletion period currently configured. Backup copies may persist until the owner removes those backups.

Revoking Google access stops future authorized API access but does not automatically delete existing local records, backups, or messages already stored in Gmail. To request local deletion or assistance, contact the developer at the address below.

6. Revoking access

The owner can review or remove the application's connection at Google Account connections and disable the local notifier. Reconnection requires a new owner-controlled consent process. The website does not offer a public account-creation or authorization form.

7. Public website

These informational pages do not include application-added analytics, tracking scripts, forms, or advertising. When hosted on Cloudflare Pages, Cloudflare processes ordinary web-request information, such as IP address and browser details, to serve and protect the website under Cloudflare's privacy policy. The website host is not used to store the local application's OAuth credentials or private operational records.

8. Google API data policy

ClaudeBox Notifications' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

9. Changes and contact

This policy will be updated when the notification integration's practices change. Material new uses of Google data or broader permissions require an updated disclosure and any necessary consent before use.

Developer: Jason Schwartz
Support, privacy, and deletion requests: jason.schwartz1993@gmail.com.