1. Personal use only
This service is not a public application. It is operated by one person (loiu92, the “operator”) and used only with the operator’s own Google accounts. Although this website is publicly readable — required for OAuth branding — the app is not offered for general enrollment. Google OAuth publishing status is managed separately from this website. No accounts other than the operator’s are intended or expected to grant it access.
2. What the service accesses
The service accesses Gmail and Google account data only through OAuth consent granted to the operator’s own accounts, and only within the permissions listed on the Google consent screen at the time of grant. Which permissions apply depends on which MCP tools are configured: the service can be operated with read-only scopes, or with broader scopes if features such as sending or organizing mail are enabled.
The consent screen — not this document — is the authoritative list of what is requested. Access can be withdrawn at any time (see section 6).
3. How email data is used
The purpose of the service is to let the operator’s chosen MCP-compatible AI clients work with the operator’s email. That means email content can be passed to the AI tools and clients the operator explicitly connects, for example to summarize, draft, search, or organize mail. Each connected client or tool is selected by the operator, and its own handling of data is governed by that tool’s terms and privacy policy.
4. What this service does not do
As operator policy, the service and its operator do not:
- use accessed data for advertising, or sell or share it for advertising;
- sell or transfer accessed data to third parties other than the operator-selected tools described above;
- use accessed data to train machine-learning or AI models.
Compliance note. Use of Gmail data through this service is intended to comply with the Google API Services User Data Policy, including its Limited Use requirements, to the extent they apply to an app of this kind.
5. Website data, storage, and retention
This website is a set of static pages. It sets no cookies, runs no analytics, and has no forms. Hosting providers may process request metadata such as IP addresses and browser information in server logs.
The currently documented personal mail deployment connects to mailboxes using IMAP credentials. Those credentials are stored as Kubernetes Secrets and loaded into the mail process through environment variables. The mail container has a read-only filesystem and no persistent data volume. Messages remain with the mailbox provider; copies returned to connected clients are subject to those clients’ storage and deletion settings. Infrastructure credentials persist until the operator removes or rotates them; this deployment defines no automatic credential expiry.
This static website does not receive or store Gmail OAuth tokens or email content. A Gmail OAuth token-storage implementation has not been confirmed for the separately operated MCP service. This policy must be updated with that implementation’s storage, retention and deletion details before it is used to represent a deployed Gmail OAuth flow.
6. Revoking access
Access granted to this app can be revoked at any time from your Google account: Google Account → Security → Third-party apps with account access (sign in as the account that granted access, select “Loiu92 Email MCP”, and choose Remove access). Revocation takes effect for future access immediately, and any associated OAuth tokens stop refreshing.
Revocation is not deletion. Removing access stops future access, but it does not delete copies of data that were already passed to connected tools or stored by the service while access was active. To request deletion of existing copies, contact the operator (section 7).
7. Deletion requests and contact
Requests to delete stored data associated with the service — including data already held by the operator or already passed to tools the operator configured — can be sent to the owner:
- Email: loiu92@gmail.com
- GitHub: open an issue on the project repository
Because the service is personal-use, the only account with granted access is expected to be the operator’s own; requests are handled accordingly.
8. Changes to this policy
If the service’s data practices change, this policy will be updated on this page before those changes take effect.