Privacy Policy

Gonzalo HQ is a private personal dashboard operated by Gonzalo Franco at gonzalofranco.com/hq. It has exactly one user: its operator. It is not a product, it has no customers, and it does not accept sign-ups. This policy explains what it accesses, what it keeps, and what it sends elsewhere.

Who this applies to

Only the operator. The dashboard sits behind a password and there is no mechanism for anyone else to create an account or connect data to it. The Google accounts it connects are the operator's own. If you are reading this, you are almost certainly here because Google links to it from a consent screen.

Google user data

With the operator's explicit consent through Google's OAuth screen, Gonzalo HQ requests:

• Google Calendar events (calendar.events): to display upcoming events on the dashboard, and to create an event when the operator types something like “lunch with Dave Tuesday at noon” into it.
• Gmail (gmail.modify): to list and read the unread mail in the inbox (sender, subject, Gmail's preview and the start of the body), and to count how each sender's earlier mail was treated (deleted, kept, written to or replied to), so the dashboard can summarise the inbox and suggest what is likely trash; to mark messages as read; and to move messages to Trash when the operator clicks to do so. Trash is recoverable for 30 days, and this scope cannot permanently delete mail: Google enforces that. The dashboard never sends mail and never trashes anything on its own.
• Gmail filters (gmail.settings.basic): to create a Gmail filter when the operator chooses to block a sender, so that sender's future mail goes to Trash. The filter is an ordinary one, visible and removable in Gmail's settings.
• Email address (openid, email): to know which account is connected, so each inbox is titled with its address and the same account is never connected twice.

No other Google scopes are requested. The app has no access to Drive, Contacts, Photos, or anything else.

What is stored, and where

Everything below lives in a hosted Upstash Redis database, encrypted at rest.

• Per connected Google account: an OAuth refresh token, the account's email address, the date it was connected and the scopes granted, kept until the account is disconnected. Short-lived access tokens are cached for under an hour.
• The unread inbox, briefly: for each unread message its sender, subject, Gmail's preview of up to 180 characters, date and category, and the dashboard's suggestion for it. Kept for 90 seconds (20 while new mail is still being sorted), so the dashboard does not ask Gmail for the same list on every click.
• Sender history: per sender address, and per sender and subject label (like “OK:” alerts), how many of their messages were deleted and how many kept, the dates of deletes made in the dashboard, and whether the operator has ever written to that address. Refreshed from Gmail weekly.
• AI suggestions, in an inbox where the operator has turned AI reading on: per unread message, whether it is likely trash, a confidence and a one-line reason. Each is deleted the next time the dashboard loads that inbox after the message stops being unread.
• A profile of each inbox with AI reading on: the senders mostly deleted and mostly kept, with their counts, and the sender, subject and preview of about 20 recently deleted and 20 recently read messages. Rebuilt daily and deleted after two days.
• The suggestions' record: how many AI suggestions the operator acted on, and the sender, subject and reason of the last 20 the operator overruled.
• Calendar event content is not stored. Events are fetched from Google when the dashboard loads, rendered, and discarded.

What the data is never used for

Google user data is not sold, rented, or shared with anyone. It is not used for advertising, for analytics, for profiling, or to train any machine-learning model. It is not transferred to third parties, except to the providers strictly required to run the dashboard: Vercel, which hosts it; Upstash, which stores what is listed above; and Anthropic, whose Claude API summarises and sorts the operator's mail as described below.

Gonzalo HQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data sent to AI providers

• Mail, to Anthropic's Claude API. To summarise an inbox on its card: the sender, subject and preview of its newest unread messages. To suggest what is likely trash, in an inbox where the operator has turned AI reading on, for messages the sender history cannot decide: the sender's name and address, subject, preview, whether the message carries an unsubscribe header, the sender history counts, and the first 2,000 or so characters of the body with quoted replies and signatures removed, read together with that inbox's profile. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
• Typed text, to Anthropic's Claude API. The dashboard has a box the operator types into, and that text is sent to Claude to work out what it is: a reading link, a task, a calendar event.
• Voice, to OpenAI's API. Recordings made in the dashboard are sent to OpenAI only to be transcribed into text.

Calendar events retrieved from Google are never sent to either.

Other connected services

The dashboard also pulls the operator's own data from Mercury, Stripe, Hospitable, and Open-Meteo. That data is the operator's own and is kept separate from anything received from Google.

Revoking access

Each inbox card has a Remove action. For an inbox added from the dashboard it deletes the stored refresh token and everything listed above about that inbox's mail. The first two accounts also back the calendars, so removing their inbox card keeps the connection; each calendar has a Disconnect button, which deletes its refresh token immediately. Access can also be revoked at any time from Google Account permissions, which invalidates the token regardless of what this app does.

Retention

Refresh tokens are kept until disconnected or revoked. The inbox listing lasts seconds, an AI suggestion lasts until its message is read or deleted and the inbox is next loaded, and profiles last two days, as above. Sender history and the suggestions' record are kept while an inbox is in use, are deleted with an inbox that is removed, and for the two calendar accounts stay until the operator deletes them.

Changes

If this policy changes, the date at the top changes with it. Given the app has one user, changes will not be announced any other way.