Last updated: 27 October 2026
Homelab ("the app") is a private, single-user software project that runs on hardware I own and control. It is not offered to the public, has exactly one user (the owner), and is not distributed to anyone else. This policy explains how it handles Google user data.
When you authorize the app, it requests these scopes:
https://www.googleapis.com/auth/gmail.readonly - read email messages, threads, and labels.https://www.googleapis.com/auth/gmail.compose - create and manage drafts.The app does not request permission to send email, delete messages, or modify existing mail.
Gmail data is used for exactly two purposes: to search and read messages when I ask the app a question about my mailbox, and to create draft messages for me to review and send manually. All requests are initiated by me, interactively. There is no background scanning, indexing, or bulk collection of mailbox content.
OAuth credentials (client credentials and refresh tokens) are stored locally on my own machine, in encrypted storage. Mailbox content is not retained: messages are held in memory only for the duration of a request and are not written to disk beyond ordinary application logs, which do not contain message bodies.
No Google user data is sold, rented, or shared with third parties. Data is not used for advertising, profiling, or training machine-learning models. Requests to Google are made directly from my machine to Google's APIs.
Homelab's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Because mailbox content is not stored, there is nothing to retain or delete on the app side. To remove the app's access at any time, revoke it at myaccount.google.com/permissions. You can also delete the locally stored credentials, which immediately ends the app's ability to access Google data. Revocation takes effect regardless of any locally cached token.
The machine running the app is administratively controlled by the owner, with disk encryption and restricted access. Credentials are never committed to source control or transmitted to any third party.
If this policy changes, the updated version will be posted at this URL with a new date.
Questions about this policy: dgo.ponciano [at] gmail.com