Privacy policy
This policy covers IRMA, the self-hosted assistant operated by Geraeldo Sinaga, and its Google Workspace connection, identified as irma-gog. Contact the operator at [email protected].
Data we access and collect
When you connect Google, IRMA receives OAuth authorization tokens and account identifiers needed to connect the account. IRMA does not receive your Google password. Depending on the permissions you grant and the task you request, it may access:
- Calendar: calendar names and identifiers, event titles, descriptions, times, locations, attendees, and meeting details.
- Drive: file and folder names, identifiers, metadata, permissions, and the contents of files needed for your task.
- Slides: presentation content, slide text, images, speaker notes, and presentation metadata.
- Sheets: spreadsheet metadata, sheet names, cell values, formulas, and formatting.
- Docs: document text, structure, formatting, and metadata.
IRMA also stores messages you send, uploaded files, assistant responses, task results, memories, routines, and technical activity records needed to operate the assistant. These records may contain Google data returned by a task. Hosting and network services may process IP addresses and request information for delivery and security.
How we use data
We use data to provide the features you request: finding and summarizing information, answering questions, managing calendar events and files, and creating or editing documents, spreadsheets, and presentations. Configured routines may perform these tasks while you are away. Write, sharing, or deletion actions depend on your granted permissions and instructions.
OAuth tokens maintain your authorized connection. Activity records support task history, troubleshooting, and security. Google data is not sold, used for advertising, used to assess creditworthiness, or used to train or improve general-purpose AI or machine-learning models.
AI processing and sharing
IRMA uses the AI provider configured for the installation, which may be OpenAI or another provider selected by the operator. When you request an AI-assisted task involving Google data, relevant content and conversation context may be sent to that provider to generate the requested response or action. This processing must use provider settings and terms that prohibit training general-purpose models on Google user data.
Connect an account and request Google-data tasks only if you consent to this processing. You may ask the operator which provider is configured before using the connection. OAuth refresh tokens are used by the connection and are not intentionally included in model prompts.
Data may also be processed by hosting, network, and backup providers needed to operate the installation, or sent to recipients and services you explicitly instruct IRMA to use. Such processing may occur outside your country. We otherwise disclose data only as necessary for security, to comply with applicable law, or in connection with a transfer of the application after obtaining any required consent. We do not permit human review of Google data except with your affirmative agreement for specific data, as necessary for security or legal compliance, or as otherwise permitted by Google's Limited Use requirements.
Storage and security
IRMA stores conversations, task records, and related content on the installation's host and in its backups. The gog connection stores OAuth tokens in its configured platform keyring or encrypted file backend. IRMA's separate secret store encrypts saved secrets at rest. Google API communication uses HTTPS, and access to the private installation is restricted to authorized users. These controls reduce risk but cannot guarantee absolute security.
Retention, revocation, and deletion
Connection tokens are retained while the account is connected. Conversations, task outputs, files, and memories remain until deleted by an authorized user or the operator, or removed under the installation's retention settings. Backup copies may remain until they expire or are removed under the installation's backup schedule.
You can stop future Google access by removing irma-gog from your Google Account connections. The operator can also remove the local gog account connection. Revocation does not automatically erase information already saved in conversations, memories, task records, or backups.
To request access, correction, export, or deletion of your stored personal data and local connection tokens, email [email protected] using the connected account. We may verify your identity before acting. We will remove the data from active storage and arrange removal or expiry of backup copies, except where retention is required by law or necessary to address a security issue. Deleting an IRMA record does not delete the original Google file or event unless you separately request that action.
Google API Limited Use
IRMA's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Changes and contact
We will publish policy updates here with a new effective date. If a change introduces a new use or disclosure of Google user data, we will notify affected users and obtain consent before that new use. For privacy questions or requests, contact Geraeldo Sinaga at [email protected].