What we hold, and where it goes.

01What this policy covers

This policy covers two separate things, and it is worth being clear which is which. The first is this website — what happens when you read it or write to us through it. The second is Jarvis, the private assistant Obsidian Labs LLC builds and runs for its own principal, which connects to that person's own Google account. If you are here to read about the website, section 2 is all you need. Sections 4 onward describe Jarvis's handling of Google user data.

Jarvis is single-owner software. It is not a product offered to the public, there are no accounts to sign up for, and no third party's mailbox is connected to it. The Google data it touches belongs to the person who runs it.

02The website

The contact form collects your name, your email address, and whatever you write in the message. We use it to reply to you and to decide whether the work is a fit. That is the whole purpose.

Analytics

None. There is no analytics script, no advertising pixel, and no third-party tag on this site.

Cookies

No tracking or advertising cookies are set.

Retention

Enquiries are kept as ordinary business correspondence for as long as the conversation is live and for our own records afterwards. Ask us to delete yours and we will.

Sharing

We do not sell, rent, or share enquiries. They go to the studio's own inbox and nowhere else.

03What Jarvis is

Jarvis is a personal assistant that runs on its owner's own Windows machine. Its interface is a desktop application talking to a service on that machine over the local loopback interface, plus a paired iPhone reaching it over a private network. There is no Obsidian Labs server in the middle: we operate no cloud service that receives this data, and there is no hosted, multi-tenant version of Jarvis.

The iPhone companion app has its own policy, covering what that app handles on the phone. This policy covers what the assistant does with Google user data, which is a different question.

04The Google permissions Jarvis asks for

Jarvis requests these scopes, and only these, at the moment the owner connects an address:

gmail.modify

Read messages, search, read label names, move messages to Trash, mark them read, apply the account's own labels, and send mail as the owner. This is a restricted scope.

calendar.events

Read and write events on the connected account's primary calendar. This is a sensitive scope.

userinfo.email

Read the address being connected, so the assistant can label the grant correctly. Nothing else.

What Jarvis deliberately cannot doIt never requests the full https://mail.google.com/ scope, which is what permanent deletion of mail would require — so mail can be moved to Trash and recovered, and never destroyed outright. It never downloads Gmail attachments. It reads only each connected account's primary calendar, never subscribed or shared ones.

05What Jarvis reads, and when

From Gmail: message identifiers and the From, Subject and Date headers of messages matching a search; the names of the account's labels; unread counts. When the owner explicitly asks to read a particular message, up to the first two thousand characters of its plain-text body. When first connecting an account, up to a hundred and twenty of the owner's own sent messages, to learn how they write.

From Calendar: events on the primary calendar in a bounded window — title, start and end, all-day flag, location, the event's description, and attendees' names and email addresses, capped at twenty per event. Events that were cancelled, or that the owner declined, are dropped before anything else happens.

Reads happen when the owner asks for something, and on a small number of scheduled tasks the owner has granted explicitly — a calendar mirror-sync, and a daily check that each Google grant still works. That daily check exchanges the refresh token and reads no mail and no calendar at all.

06Where Google user data goes: OpenAI

The disclosure that matters mostGoogle user data does leave the machine. Jarvis uses OpenAI's models for its voice interface, for summarising and searching mail, and for drafting replies, and the material those features work on is sent to OpenAI to do it. OpenAI is the only model provider that receives any of it.

Concretely, what is sent to OpenAI is: the addresses of the connected Google accounts; senders, subjects and dates of messages the assistant is asked about; the names of the account's labels; search terms the owner uses; up to two thousand characters of a message body when the owner asks for that message to be read aloud or summarised; short excerpts of the owner's own sent mail, so a drafted reply sounds like them; and calendar event titles, times and attendee email addresses.

This transfer exists to provide the features the owner is asking for at that moment, and for no other purpose. Nothing is sent to OpenAI for advertising, for resale, or to build a profile. No other third party receives Google user data: not the studio, not any analytics service, and not any other model provider.

What OpenAI then does with it is governed by the OpenAI account the assistant is configured with, and by OpenAI's own terms and data controls — including whether that traffic may be retained or used for training, which is a setting on that account rather than something this software decides. Anyone connecting an account to Jarvis should read OpenAI's terms as well as this policy.

07Limited Use

Google API Services User Data PolicyObsidian Labs LLC's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice that means: Google user data is used only to provide and improve the assistant's own user-facing features; it is not transferred to others except as needed to provide those features, for security purposes, or where the law requires it; it is not used for advertising of any kind; and no human at Obsidian Labs reads it, except where the owner has explicitly asked for help with something specific, where it is necessary for security, or where the law requires it.

08How it is stored, and for how long

Google credentials

Refresh tokens rest on the owner's machine, encrypted with Windows DPAPI so that only that Windows user account can open them. Short-lived access tokens are held in memory and never written to disk. Backups exclude the credential directories by design.

Message bodies

Read and used in the moment; not written to the database. The exception is text the owner has approved for sending — a reply they wrote is stored with the approval that authorised it.

Writing-style excerpts

Three excerpts of the owner's own sent mail, five hundred characters each, in a plain file on that machine.

Envelope and event details

Subjects, recipient addresses, search terms, calendar titles and attendees can appear in the assistant's task and approval records, and in its append-only audit log, which exists so every action the assistant took can be reviewed afterwards.

Encryption at rest

Credentials are encrypted as above. The assistant's database itself is not encrypted at the file level; it sits on the owner's own machine, protected by that machine's disk encryption and account security.

Retention

There is no automatic expiry: records persist until the owner deletes them, which they can do directly, since the storage is theirs. The audit log is deliberately append-only and is not edited after the fact.

09Revoking access and deleting data

Access can be withdrawn at any time from the Google account's own security settings, at myaccount.google.com/permissions. Revoking there stops Jarvis immediately and permanently: the refresh token it holds becomes useless, and it has no other way in.

Because the data lives on the owner's machine, deleting it is something they do directly rather than something they ask us for. Deleting the credential file disconnects the account; deleting the database removes the history.

10What we never do

• We do not sell, rent, or trade Google user data, or any other personal data.
• We do not use Google user data for advertising, and we run no advertising.
• We do not operate a cloud service that receives this data — there is no Obsidian Labs server in the path.
• We do not send Google user data to any model provider other than OpenAI, and we do not send it to the payment, banking, or messaging services the assistant uses for other purposes.
• We do not run analytics, telemetry, or crash reporting that would carry this data anywhere.
• We do not download Gmail attachments, and we cannot permanently delete Gmail.

11Children

Neither the website nor Jarvis is directed at children, and we do not knowingly collect personal information from anyone under sixteen.

12Changes, and how to reach us

If this policy changes in a way that affects how Google user data is handled, the effective date at the top of the page changes with it and the previous version stops applying from that date. We do not make such a change quietly.

Questions about this policy, or a request about your own data, go to hello@labsobsidian.co. A person reads it.