Data handling · Updated October 12, 2026
Privacy policy
Personal AI Briefing is a private personal project maintained by Sebastian. It collects approved information to prepare responsibilities and follow-up summaries on his own Mac.
What the Google connection can access
The installed Desktop app requests exactly https://www.googleapis.com/auth/gmail.readonly and https://www.googleapis.com/auth/calendar.readonly. These grants allow reading data; they do not authorize sending or modifying email or modifying calendars.
The current Gmail collector examines a bounded set of inbox records and uses subjects and metadata to identify possible follow-ups. It does not fetch full message bodies or attachments. The Calendar collector reads authorized calendar events and uses summaries, start and end times, availability information, and event identifiers to identify upcoming commitments and conflicts. A follow-up suggestion is a candidate for review, not proof of an obligation.
Why the information is used
Approved Google data is used only for the personal briefing and its related displays, reminders, source checks, and local follow-up prioritization. It is not sold, used for advertising, or used to train a general-purpose AI model. Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Where records and credentials are stored
Google refresh credentials are stored in macOS Keychain. The Desktop OAuth client registration is stored outside Git repositories with owner-only file permissions. Briefing snapshots, reports, status records, and test evidence are stored locally on the Mac and protected by its account and filesystem permissions. The app does not add its own encryption layer to every local report.
GAIA's local databases may retain tasks, conversations, and extracted memories when those features are enabled. The live personal-data GAIA reasoning route is currently disabled while validation is completed. A local model is being evaluated using synthetic data only. Real Gmail, Blackboard, private Rally, or research records are not sent to the NVIDIA trial endpoint or another hosted AI model in the current configuration.
Other sources and iMessage
The local briefing may also read separately authorized FCC Blackboard responsibilities, scoped Rally GitHub metadata, canonical research status records, and operator-provided college planning information. These records are not uploaded to this public website. Reading a source does not authorize changing it.
iMessage delivery is separately gated. The earlier single delivery test was completed; recurring delivery is not enabled. If approved later, the briefing will be sent through Messages on the owner's Mac to the approved destination, using Apple's messaging services. Enabling delivery requires an additional explicit approval.
Providers and disclosures
Google processes authentication and the authorized API requests. WorkOS handles normal GAIA sign-in and receives login identity and authentication information; it is not the briefing model provider. Name.com supplies the domain's DNS, and Vercel serves these public information pages. Hosting providers may process ordinary access and security logs such as IP addresses, request times, URLs, and browser information under their own policies. These pages contain no advertising, analytics scripts, sign-up form, or app login.
Google-derived records are not intentionally shared with other people or used for unrelated purposes. The owner's approved local display is the current use. Any future provider or data-flow change must be reviewed and approved before use, with this policy updated to describe it.
Retention, deletion, and revocation
Local snapshots are replaced as the briefing runs, while saved reports and evidence can remain until the owner removes them. Native GAIA database records are retained until deleted through an authorized process. Delivery receipts have a 90-day cleanup rule when local housekeeping runs. There is no promise that every local artifact is automatically removed after the same fixed period.
Access can be revoked in Google Account third-party connections. Revoking access stops future successful API reads; it does not automatically erase already saved local reports. The owner can separately remove the local connection and delete retained records. Credentials are never published on this site.
Contact and changes
For questions or requests about this personal project, contact sebastianvelardecisneros@gmail.com. Material changes to Google-data use, providers, or delivery require review before activation and an updated disclosure.