Google API Services Disclosure

Scopes we request (the Google user data we access)

openid, email, profile: your name, email address, profile picture and Google account ID, to create and identify your account.

https://www.googleapis.com/auth/gmail.send: the ability to compose and send an email message from your Gmail account. This scope cannot read, list, search, modify or delete anything already in your mailbox, and we never request broader Gmail, Drive, Calendar or Contacts access.

How Google user data is used

Your email address identifies your account and appears as the sender of scheduled emails. Your name and picture are shown in the app and used in the email signature you configure. The gmail.send permission is used solely to deliver the emails you have scheduled inside DontRemember, at the time you chose, from your own address.

We do not use Google user data for advertising, to build advertising or interest profiles, or to train generalized AI or machine learning models. We do not use it for anything other than operating the features described above.

Who we share Google user data with

We do not sell or rent Google user data, and we do not share it with the people you schedule emails to beyond what appears in the email itself.

It is shared only with service providers who process it on our behalf, under contract, to operate DontRemember: our database/hosting infrastructure (to store your account, encrypted at rest); OpenAI, via the Vercel AI SDK, to draft the wording of scheduled emails from the facts you provide (this never includes your Gmail token, profile picture, or Google account ID); and Stripe, only if you upgrade to a paid plan (your name and email only, for billing). None of these providers may use Google user data for their own purposes, and none may train models on it.

We may disclose it if required by law or a valid legal request, or as part of a merger or acquisition, in which case we will notify you and the new entity remains bound by this disclosure.

Limited Use

DontRemember's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising, do not sell it, do not allow humans to read it except with your explicit consent for support, to investigate abuse, or as required by law, and do not use it to train generalized AI or machine learning models.

Storage and security

We never see or store your Google password; sign-in and Gmail access both use OAuth, handled entirely by Google.

OAuth refresh tokens are encrypted at rest with AES-256-GCM and decrypted only in memory, at the moment we send an email you scheduled. They are never logged and never exposed to the browser. All data in transit uses HTTPS/TLS.

Access to production data is restricted to the engineers who operate DontRemember, on a need-to-know basis.

Retention and deletion

Your Gmail refresh token is kept only while Gmail stays connected, and is deleted from our database immediately when you disconnect it in Settings, revoke access at myaccount.google.com/permissions, or delete your account.

Your Google profile data (name, email, picture, account ID) is kept for as long as your account is active, and is permanently deleted, along with everything else in your account, within 30 days of account deletion.

Revoking access

Disconnect from Settings, or remove DontRemember at myaccount.google.com/permissions. Scheduled sends stop immediately and we notify you that Gmail is no longer connected.