Privacy Policy

Last updated 27 September 2026.

This policy covers Stoa, a private automation setup operated by one individual (“the operator”) for his own use. Stoa has no other users, offers no service to the public, and collects nothing from anybody else.

1. Whose data this concerns

Only the operator's own Google Accounts, and only those he has personally connected. Stoa never asks any other person to sign in, and has no mechanism by which anyone else could grant it access.

Where a document or calendar entry that the operator can see was created or shared by someone else — a household member, for example — Stoa can read it only because that person already shared it with the connected account through Google's own sharing controls. Removing that share removes Stoa's access immediately, with no action required here.

2. What Stoa accesses, and why

Scope	What it permits	Why Stoa asks for it
`drive.readonly`	Read-only access to files and folders visible to the connected account.	So an agent can locate, read and summarise a document the operator asks about.
`drive.file`	Create files, and access only files this application itself created.	So a document the operator has just downloaded can be filed into one specific, pre-agreed folder. This scope gives no access to any other file in Drive.
`calendar.readonly`	Read-only access to the connected account's calendars.	So an agent can answer questions about what is scheduled.
`openid`, `userinfo.email`	The account's email address.	So Stoa can confirm which account a stored credential belongs to.

Stoa holds no scope permitting it to send email, share a file, change a sharing permission, move, overwrite or delete anything. Its one write capability creates new files in a single named folder and is independently prevented by Google from altering any file it did not create.

3. Limited Use

Stoa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

Google user data is used only to provide the features described on this site and on the home page.
Google user data is not transferred to, or sold to, any third party, advertising platform, data broker, or information reseller.
Google user data is not used for advertising, marketing, profiling, or credit assessment.
Google user data is not used to develop, improve or train generalised machine-learning models. Where a large language model processes this data to answer the operator's question, it is used only to produce that answer, and the operator's provider settings prohibit its retention for model training.
No human reads Google user data except the operator, who is also its owner. There is no support team, no contractor and no reviewer.

4. Where data goes, and where it stays

Credentials. OAuth refresh tokens are held in an encrypted keyring on a single private virtual server controlled by the operator. They are never transmitted anywhere else and are not stored in any repository or backup that leaves that server.
File and calendar content. Read in memory to answer a request, and not copied into a lasting store. Stoa is designed not to accumulate: it answers and stops.
Model processing. To interpret a request and summarise what it found, Stoa sends the relevant excerpt to a commercial large-language-model provider under an agreement that prohibits training on it. Only the excerpt needed for that request is sent.
Audit log. Every attempt to file a document records the file name, destination and outcome — metadata only, never the document's contents. It stays on the operator's server and exists so that the operator can review what the software did.
No analytics. This website sets no cookies, runs no scripts, embeds nothing from a third party, and does not track visitors.

5. Retention

Nothing read from Google is retained beyond the request it was read for, except the metadata-only audit log described above. Credentials are retained until access is revoked or the operator removes them. Revoking access, as described below, renders any stored credential useless immediately.

6. Revoking access

The operator can withdraw Stoa's access at any moment, without contacting anyone, at myaccount.google.com/connections. Revocation takes effect immediately and invalidates every stored token. Any person who has shared a file or calendar with a connected account can likewise end that access by removing the share in Google Drive or Google Calendar.

7. Disclosure

Stoa discloses Google user data to nobody. There are no third-party recipients, no processors other than the model provider described in section 4, and no circumstance in which data is shared for commercial purposes. Data would be disclosed only if compelled by law.

8. Children

Stoa is not directed at children and is not available to anyone other than its operator.

9. Changes

Material changes will be reflected here with a new “last updated” date. Because the operator is also the only user, changes are not notified separately.

10. Contact

Questions about this policy, or about data Stoa may have accessed: privacy@thestoa.dev.