Privacy Policy

Digibrain Gmail MCP — effective 3 September 2026.

This is not a product or service of Acton Academy Riga. Digibrain Gmail MCP is personal software operated by Dāvis Mārtiņš for his own use, published on this subdomain only because the domain is one he controls. This policy describes his handling of his own data. It is not the school's privacy policy and it governs none of the school's systems.

1. Who operates this

Dāvis Mārtiņš, an individual, referred to here as "the operator". There is no company, no legal entity and no organisation behind this tool. Contact: krikauskis@gmail.com.

2. Who the users are

The operator is the only user. There is no sign-up, no hosted service and no way for anyone else to use the tool or connect to an installation of it. Because there are no other users, the tool holds no accounts, profiles or data belonging to anyone else. The only other people whose information appears is the operator's correspondents, whose messages arrive in his mailboxes in the ordinary way that email works; the tool does not gather, enrich or process that information beyond reading the mail he already received.

3. What data the tool accesses

Email content — the subject and body text of messages in the operator's own mailboxes.
Email metadata — sender and recipient addresses, dates, thread relationships, labels, and read or unread state.
Attachments — files attached to messages in those mailboxes.

The mailboxes are the operator's own personal and work mailboxes. The tool accesses no other account.

4. How access is granted

Access is granted through Google OAuth. The operator signs in on Google's own consent screen and approves the scopes the tool requests:

https://www.googleapis.com/auth/gmail.readonly — to read messages, threads, labels and attachments.
https://www.googleapis.com/auth/gmail.modify — to organise mail: apply and remove labels, mark read or unread, archive, trash, and draft or send replies at the operator's instruction.

5. Where OAuth tokens are stored

OAuth credentials and refresh tokens are stored only on the operator's own computer, in his own local filesystem. They are never transmitted to any third party and never sent to any server operated by anyone. The tool has no backend. It makes requests directly from the operator's machine to Google's API. There is no hosted component that could receive a token, and no telemetry or analytics of any kind.

6. What is never done with the data

Email content, metadata and attachments are never sold.
They are never shared with any third party, transferred to any other service, or published anywhere.
They are never used for advertising, ad targeting, profiling or any marketing purpose.
They are never used to train machine-learning or AI models, and are never supplied to anyone else for that purpose.
No credit or lending decisions, no resale, no data brokerage. None of these activities exist here.

Mail content is read by the operator's AI assistant solely in order to answer the operator's own questions about his own mailboxes and to carry out the organising actions he asks for. It is processed for that purpose and no other.

7. Google API Services Limited Use

Digibrain Gmail MCP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

Data obtained from Google APIs is used only to provide and improve the tool's single user-facing feature — letting the operator's own AI assistant read and organise his own mail at his instruction.
That data is not transferred to others except as necessary to provide that feature, to comply with applicable law, or as part of a merger or acquisition (none of which apply to an individual's personal tool).
That data is not used for serving advertisements of any kind.
That data is not used to develop, improve or train generalised or non-personalised AI or machine-learning models.
No humans read the data except the operator himself, reading his own mail, or where required for security purposes, to comply with applicable law, or with the operator's own explicit consent.

8. Retention

The tool keeps no database of mail. It reads from the Gmail API on demand and holds results only for the duration of the request in the memory of the operator's own machine. The only persistent data is the OAuth credential file described in section 5.

9. Revoking access

The operator can revoke the tool's access at any time at myaccount.google.com/permissions. Revoking access immediately and permanently terminates the tool's ability to reach the mailbox; the stored tokens stop working at once and can be deleted from the local machine.

10. Security

Everything runs on the operator's own machine, which is protected by full-disk encryption and the operating system's own access controls. There is no server, no shared host and no public endpoint, so there is no remote surface for anyone else to attack.

11. Changes to this policy

If this policy changes, the revised version will be published at this address with a new effective date.

12. Contact

Questions about this policy: Dāvis Mārtiņš — krikauskis@gmail.com.