Privacy · Review draft

How Buddy handles data.

A plain-English draft covering Google account access, AI processing and stored information. The operator must resolve the review notes below before this becomes a finalized privacy policy.

The operator

Buddy is operated by Tareq Yaghmour as a personal AI assistant. It is not a public SaaS product. This draft covers the assistant’s handling of Google account data and the informational website intended for buddy.tarj.net.

For support, access requests, deletion requests or privacy questions, contact the operator:

tareq.yaghmour@gmail.com

Google data & permissions

Buddy accesses Google account data within the permissions granted to the app, for owner-directed assistance. This can involve reading information, organizing it, drafting content, and carrying out requested actions such as sending a message or updating a calendar event or document.

The configured service categories covered by this draft are:

Gmail: read, modify and send
Message content and related information, such as senders, recipients, labels and attachments, may be accessed or used for email tasks.
Google Calendar
Calendar and event information, such as titles, times and participants, may be used to organize schedules and work with events.
Google Drive, Docs and Sheets
File information, document content and spreadsheet data may be used to find, organize, create or update material within the granted permissions.
Google Contacts: read-only
Contact information, such as names and email addresses, may be read to support the owner’s tasks. This permission does not allow modifying contacts.

What Buddy accesses for a particular task depends on that task, the app’s configuration and the permissions in effect. This description is not a claim that every listed type of data is accessed for every task.

AI & other providers

Processing is not local-only. Google account data can be included in AI prompts and processed by configured third-party AI, tool or service providers to carry out the owner’s instructions.

Depending on the task and configuration, this may include message content, calendar details, file contents, document or spreadsheet text, contact information, and generated outputs. Requested actions may also send information to recipients or selected services, such as when sending an email or updating a Google file.

The providers involved and their terms, policies and settings affect how submitted information is handled. Their exact identities and applicable policies must be confirmed before finalization; this draft does not make provider-specific retention, training or human-access guarantees.

Storage & retention

Data and outputs may persist in conversation history, logs, project files, Google services or other selected service providers. Copies may also exist in backups, depending on the systems used.

A verified retention schedule and backup deletion practice have not yet been documented for this policy. This draft therefore does not promise a specific retention period or immediate, complete deletion of every copy.

The operator needs to confirm the relevant storage locations, retention practices and deletion limitations before finalization.

Access, revocation & deletion

You can revoke Buddy’s Google access through your Google Account connections:

Manage Google Account connections

Revoking access stops future authorized access to your Google account. It does not automatically delete previously stored copies in conversation history, logs, project files, backups or third-party services.

For a request to access or delete information held through Buddy, or to ask about copies that may remain, email the operator. Any applicable deletion limitations or provider-specific steps need to be explained when handling the request.

tareq.yaghmour@gmail.com

This website

This is a static informational website. The site files contain no app sign-in, forms or analytics code, and do not load remote fonts or scripts.

When the site is hosted, the hosting service may collect ordinary request logs, such as IP addresses, request times, requested pages and browser information. The operator must confirm the host’s logging and retention practices. Following an external link or sending an email involves the destination service’s own handling of information.

Operator confirmation required

Draft review notes

These are open questions, not assurances. Resolve them and revise this policy before finalization:

  1. Provider identities & policies. Name the AI, tool, service and hosting providers that receive or store data, and identify the applicable policies and settings.
  2. Retention & backup deletion. Confirm what is stored, for how long, how requests are handled, and when copies and backups can actually be removed.
  3. Data sale, advertising & training. Confirm whether selling data, using it for advertising, and using it for AI model training are excluded by the operator’s practices and the relevant provider terms and settings. This draft does not promise those exclusions.
  4. Google API Limited Use. Review the applicable Google API Services User Data Policy requirements and any Limited Use commitment. Add only a commitment that the operator has confirmed and can meet; this draft does not claim compliance.

Also confirm the permission list, contact details and hosting practices. This review draft is publicly available but is not a finalized privacy policy.