Privacy Policy

Last updated 9 September 2026

This policy describes how the personal MCP server operated by Justin Carmony (“the application”) handles data. The application is a private, single-user tool. It has no public sign-up and no users other than its operator.

Who operates this application

Justin Carmony, Utah, United States. Contact: justin@justincarmony.com

What data the application accesses

The application authenticates with Google using OAuth 2.0. When access is granted, it may read and act on data in the authorising Google account according to the scopes shown on Google’s consent screen at the time of authorisation. The consent screen is the authoritative list — the application cannot access anything outside the scopes approved there.

The application also stores the OAuth credentials Google issues (an access token and a refresh token) so that it can continue to operate without re-prompting for sign-in.

Why the data is accessed

Solely to carry out actions the operator has explicitly requested through an AI assistant connected to this server — for example retrieving information from, or making changes to, the operator’s own Google account data.

How data is stored and protected

OAuth tokens are stored on infrastructure controlled by the operator and are not transmitted to any third party.
Data retrieved from Google APIs is used to fulfil the request at hand. It is not copied into a separate database or long-term store for analytics, profiling, model training, or advertising.
Access is limited to the operator.

What the application does not do

It does not sell, rent, or trade any data.
It does not share Google user data with third parties, except where required by law.
It does not use Google user data for advertising.
It does not use Google user data to train, retrain, or fine-tune any generalised machine learning or AI model.
It does not permit humans to read Google user data, except the operator acting on their own account, where required for security or to comply with the law, or where the data has been aggregated and anonymised.

Limited Use disclosure

The application’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention and deletion

OAuth tokens are retained only while access remains authorised. Revoking access at Google Account permissions invalidates them immediately, and the stored copies are deleted.

To request deletion of any data held by the application, email justin@justincarmony.com.

Cookies

The application itself does not set cookies. This website uses Google Analytics to measure traffic; those cookies are unrelated to the application and carry no Google account data.

Changes

This policy may be updated. The date at the top reflects the most recent change.