Privacy Policy

gmailkit — last updated 25 August 2026

Summary

gmailkit is a personal, single-user command-line tool. Its only user is its author, operating on his own Gmail accounts. It has no servers, no database, no analytics, and no third-party recipients of any kind. No data about anyone is collected, sold, shared, or transmitted anywhere other than directly between the author's own computer and Google's Gmail API.

Who operates this application

gmailkit is operated solely by its author (GitHub: joshmiller83). It is not distributed to, offered to, or usable by other people. It is not a commercial product or a hosted service.

What data is accessed

When authorized, gmailkit uses the Gmail API to access the mailbox contents of the Google accounts the author explicitly signs in to: message metadata, message bodies, labels, and attachments. It requests the https://mail.google.com/ scope so that it can read, organize, send, and delete mail in those accounts.

How that data is used

Message data is fetched on demand, displayed in the author's terminal, and then discarded. It is used only to carry out the command the author just typed — a search, a read, a label change, a send. It is not indexed, profiled, retained, or used to train anything.

What is stored, and where

• OAuth refresh tokens — encrypted with AES-256-GCM. The decryption key is held separately in the macOS Keychain and is never stored next to the encrypted data.
• Short-lived access tokens — cached in an owner-only file (permissions 0600) outside the project directory, and refreshed automatically when they expire.
• Message content — not stored. It is held in memory only for the duration of a single command. Attachments are written to disk only when the author explicitly asks to save them.

Sharing and disclosure

None. Data is never sold, rented, shared, or disclosed to any third party. There is no advertising, no telemetry, no crash reporting, and no external service involved. The only network destination is Google's own API.

Limited Use disclosure

gmailkit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through the Gmail API is used solely to provide the features described above, is never transferred to others, and is never used for advertising, profiling, or model training.

Retention and deletion

Because no message data is retained, there is nothing to delete beyond the stored credentials. Access can be revoked at any time from Google Account permissions, which immediately invalidates the stored tokens. Deleting the local encrypted credential file removes them entirely.

Changes

If this policy changes, the revised version will be posted on this page with an updated date.

Contact

Questions can be raised as an issue on the author's GitHub account.