Privacy Policy

marty-mcgregor · last updated 29 August 2026

This policy covers marty-mcgregor, a private, single-operator assistant application operated by Andrea S. Head. The application is not offered to the public and has no users other than its operator.

1. Data controller

Andrea S. Head, Cape Town, South Africa. Questions about this policy or about data handling: andrea@heads.bio.

2. What the application accesses

marty-mcgregor requests the following Google OAuth scopes, and nothing else:

Scope	Why it is requested
`calendar.readonly`	To read the operator's own calendar events, in order to produce a daily schedule summary and timed reminders before appointments.
`calendar.events`	To create and amend the operator's own calendar events, at the operator's explicit request.
`gmail.readonly`	To read the operator's own mail, in order to summarise it and surface items needing attention.
`gmail.send`	To send mail from the operator's own account, when the operator asks for a message to be sent.
`gmail.modify`	To apply labels, mark messages read, and archive, at the operator's explicit request.
`openid`, `userinfo.email`, `userinfo.profile`	To identify which account has been connected, so the application addresses the right mailbox and calendar.

3. How the data is used

Data retrieved from Google is used solely to carry out the operator's own instructions — summarising a calendar, sending a reminder, drafting a reply. It is processed for that purpose and for no other.

4. Sharing and limited use

Google user data is never sold, rented, or shared with third parties. There is no advertising, no analytics performed on Google user data, and no profiling.
Where the application relies on a third-party language model to interpret a request, only the minimum content needed to answer that request is sent, and it is not used to train any model.
marty-mcgregor's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Storage, retention and deletion

Google user data is processed transiently to answer a request. It is not copied into a separate long-term store beyond what is needed to complete that request.
OAuth tokens are held in credential storage on hardware controlled by the operator, and are transmitted only to Google.
Cached working data is discarded once it is no longer needed. To have any retained data deleted, email andrea@heads.bio.

6. Withdrawing access

Access can be revoked at any time from Google Account → Third-party apps & services. Revoking immediately invalidates the application's tokens.

7. Security

Connections to Google are made over TLS. Credentials are not written to logs and are not shared with anyone.

8. Children

The application is not directed at children and is not available to anyone other than its operator.

9. Changes to this policy

Any change will be published on this page, with a revised date at the top.