Privacy policy

setup-gmail — last updated 2 September 2026.

setup-gmail is a private tool with a single user: its author, who is also the owner of the only Google Accounts it ever accesses. This policy describes how it accesses, uses, stores and shares Google user data.

What data is accessed

The application requests these OAuth scopes:

• https://www.googleapis.com/auth/gmail.settings.basic — to read and write the filter rules configured on the operator's own Gmail account.
• https://www.googleapis.com/auth/gmail.labels — to read and write the list of labels on that account.

Neither scope grants access to mail. The application cannot read, send, modify, label or delete any message, and it never receives message content, headers, attachments or contacts. The only data it sees is the operator's own filter definitions and label names — that is, configuration the operator wrote themselves.

How the data is used

The filter and label definitions are used for exactly one purpose: to compare the account's current configuration with the configuration file on the operator's machine, show the difference, and — on an explicit confirmation — bring the account in line with the file.

The data is not used for advertising, profiling, analytics, training machine learning models, or any purpose beyond configuring the operator's own mailbox on their own instruction.

How the data is stored

The application runs on hardware controlled by its operator. It stores, on that machine only:

• an OAuth token for the operator's own account, kept encrypted at rest in a private repository and readable only by the operating system user that runs the application;
• the filter and label configuration itself, in a text file under version control in that same private repository.

No message data is stored, because none is ever accessed.

How the data is shared

Google user data is not sold, and is not transferred to anyone. It does not leave the operator's own machines except in requests back to Google's own APIs. There is no server operated for other people, no analytics provider and no third-party recipient of any kind.

Retention and deletion

The operator can revoke the application's access at any time from Google Account permissions, which immediately ends all access. The locally stored token can be deleted by removing the application's token file; doing so leaves no copy of any Google user data anywhere.

Limited Use

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Questions about this policy: jpolcar@gmail.com