Privacy and your Google account.

Google permissions

The intended connection requests Gmail’s send-email permission, OpenID, and permission to identify the connected account by email address. It is intended to verify the sender and send the owner’s review emails. It does not request permission to read Gmail inbox messages.

Information used and shared

The connection uses the account email address and authorization credentials. Review packages may contain the reviewer addresses, subject lines, draft text, and any attachments supplied for the review. Google receives outgoing messages to deliver them, and the designated reviewers receive their respective messages and attachments.

Winston is hosted on a Hostinger server. Its Google client configuration is encrypted on that server, with the encryption key held on the same server. The planned authorization credentials will also be stored encrypted there. An administrator with sufficient access to that server can access its data.

Retention and deletion

The proposed sender currently has no automatic expiration schedule for stored review packets or delivery records. If activated without a change to that design, those records may remain until the operator deletes them. Credentials remain until removed or invalidated. This notice will be updated if the retention design changes.

To ask for removal of Winston’s authorization credentials or locally retained review records, email simon.closeouts@gmail.com. The operator will handle removal manually. Hosting backups may retain copies until they expire or are removed. Google’s Sent mail and copies already delivered to reviewers are separate from Winston’s local records.

Revoke Google access

You can review and remove the app’s access in your Google Account connections. Revoking access stops future authorized use; contact the operator separately to request deletion of Winston’s local records.

Google data and AI

Winston will not use Google user data for advertising targeting or to train general-purpose AI models. The use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. The app does not use this Gmail connection to read email for marketing inputs.

If separate AI services are introduced for content creation, the operator will document the actual services and data flows before they are used. Content supplied independently by the owner is distinct from information obtained through the Gmail connection.

Changes

This notice will be updated when the actual connection, data handling, or service providers change. The date above identifies the current version.