Privacy Policy
Who operates this software
Eddy Varela, doing business as Digital Porters (the "operator"). Contact: eddy@digitalporters.com.
Who the software is for
This is single-user software. It is installed and run by the operator on computers he owns, and it connects only to Google accounts he owns. It is not offered as a service to anyone else, has no sign-up, and collects no information about visitors to this website beyond what the hosting provider's standard server logs record.
Google user data the software accesses
Through the gmail-mcp OAuth client the software requests these Google API scopes on the operator's own accounts:
- Gmail (
https://www.googleapis.com/auth/gmail.modify) — to read messages, apply labels, mark messages read/unread, archive, and create drafts. Automated tasks never send email; outbound mail is staged as drafts for the operator to review. - Google Calendar (
https://www.googleapis.com/auth/calendar) — to read availability and to create, update and delete events that the software itself created (their titles carry a[TEA]prefix).
How that data is used
- To update the operator's own task board — for example, moving a job application card forward when a confirmation or interview email arrives, or noting a deadline found in an email.
- To place tentative work blocks on the operator's own calendar around those deadlines.
- Data is processed on the operator's computers. Email contents used by an automated task may be passed to an AI model provider (Anthropic) to perform that task; summaries of what a task did are written to the operator's task cards.
Google user data is not sold, not used for advertising, not shared with any other person or organization, and not used to train models. The software's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Storage and retention
- OAuth tokens are stored as files on the operator's computers only. They are never committed to source control or transmitted anywhere except to Google to authenticate API calls.
- Task cards (which may contain short excerpts or references to emails, such as a sender, a subject, or a message id) are stored on the operator's computers and mirrored to a private database (Supabase) that only the operator's authenticated account can read.
- Logs of automated runs are kept on the operator's computers and can be deleted at any time.
Deleting data and revoking access
The operator can revoke the software's access at any time at myaccount.google.com/permissions, which invalidates the stored tokens. Locally stored tokens, cards and logs can be deleted directly from disk. Any request about data handled by this software can be sent to eddy@digitalporters.com.
Security
Tokens live on encrypted, password-protected computers under the operator's control; database access requires the operator's authenticated session; automated runs use a restricted tool allowlist.
Changes
If this policy changes, the new version is published at this address with an updated effective date.