Privacy Policy

OpenClaw Appointment Reminder is a personal-use, operator-run local application. When enabled, it reads a bounded Gmail time window to find appointment-related messages, reconciles confirmations, cancellations, and reschedules into local appointment state, and generates weekly or morning-of reminders.

The application itself does not use Gmail-derived information for advertising, sale, lending or credit decisions, general surveillance, or training a shared or general-purpose model.

The service and its Gmail-reading schedules are currently inactive. Final Google OAuth production configuration remains unfinished, and Google has not verified or approved this application.

The inspected local OAuth authorization request used these scopes:

• gmail.readonly — to search and retrieve Gmail messages for appointment detection and verification.
• openid and email — to authenticate the Google account and make its email identity available to the OAuth/OpenID flow.
• userinfo.email — to read the authorized account’s email-address identity.

Gmail read-only is the only observed mailbox-data scope. It can view Gmail messages and settings, although this application does not call a Gmail settings API. The production Google Cloud consent screen and each production authorization request still need to be verified against this observed scope list.

Whether both email and userinfo.email are necessary remains unresolved. Their production use must be reviewed and tested rather than assumed or changed solely from this policy.

During a one-year mailbox sweep split into bounded, overlapping time bands, the application may access:

• message and thread identifiers, timestamps, display date, and labels used to exclude Sent, Drafts, Spam, and Trash;
• Sender and Subject headers, Gmail result counts, and page tokens;
• a Gmail-generated snippet in metadata, which is validated but withheld from semantic classification and not persisted;
• message metadata such as history ID, size estimate, Workspace classification-label identifiers, and MIME structure;
• MIME-part metadata that may include MIME type, part ID, attachment filename, attachment ID, and attachment size;
• for messages not safely discarded from metadata, one bounded flattened body representation together with Subject and From; and
• From, Authentication-Results, and ARC-Authentication-Results headers for cancellation or reschedule authority checks.

Because the initial search is chronological rather than filtered by sender or subject, metadata for non-appointment messages can be read before classification.

Identifiers, timestamps, labels, sender, and subject support bounded inventory traversal, deduplication, folder enforcement, provenance, and appointment triage. Selected body text is used to decide whether a message concerns an appointment and to extract reminder-relevant logistics such as organization, provider, time, modality, location, status intent, and optional appointment identifiers.

Message and thread identity and received time support reconciliation and linkage of updates to an appointment. Authentication headers are used only to decide whether a cancellation or reschedule is sufficiently authenticated and corroborated to change canonical appointment state. Persisted appointment logistics are used to select upcoming appointments and render reminders.

The application does not:

• send or compose email, or create or edit drafts;
• delete email or move it to Trash;
• archive email;
• add, remove, or modify labels;
• mark messages read or unread;
• move messages between folders;
• change Gmail settings; or
• otherwise modify Gmail mailbox state.

This describes the Appointment Reminder application. Production authorization must still be checked to confirm that no broader Gmail scopes were configured elsewhere.

The application performs deterministic bounded searches, pagination, response validation, folder exclusion, deduplication, and repeated inventory checks. A local classifier first receives bounded Subject and From values; the Gmail-generated snippet is withheld.

When needed, a bounded body representation is fetched and sanitized. A second local classifier and a local structured extractor may each receive Subject, From, and up to 16,000 characters of sanitized body text. Results are schema-checked, source-grounded, and reconciled deterministically. A model cannot independently authorize a mailbox or canonical appointment mutation.

The inference client accepts only an exact IPv4 loopback endpoint and verifies the configured Ollama models as installed local models before Gmail-derived text is sent. It has no hosted-model fallback and does not pull models. Prompts and responses are not stored by Appointment Reminder.

The deployed local model and loopback-only boundary were provenance-validated with synthetic input. The validated configuration disabled cloud execution and request-body logging and passed fixed-context, non-thinking, and structured application-adapter checks. These are point-in-time deployment facts, not guarantees against privileged host access or later configuration changes. The private model service is disabled and inactive while the application is dormant, and exclusive loopback-port ownership must be rechecked before activation.

The operator selects the location of a local SQLite state file. Stored records can include:

• appointment time, organization, optional provider, status, modality, confidence, optional location, internal IDs, and timestamps;
• minimal Gmail provenance: message ID, thread ID, received time, evidence kind, and optional external appointment ID;
• typed history, links between revisions and supporting Gmail evidence, and policy-version attestations;
• content-free unresolved-source records with IDs, timestamps, bounded reason codes, and lifecycle state; and
• content-free notification intent and receipt records with opaque fingerprints, internal references, state, and timestamps.

The runtime creates a newly needed parent directory with owner-only permissions. It does not implement database encryption and does not control permissions on a pre-existing directory.

Discord delivery uses a dedicated, isolated Appointment Reminder OpenClaw profile. OpenClaw briefly queues the rendered payload locally before delivery; successful queue entries are removed, while failed or uncertain delivery state can retain a payload until it is resolved or the dedicated profile is deleted.

The Appointment Reminder SQLite database does not store:

• raw messages, raw MIME, message bodies, sanitized body excerpts, snippets, or Subject and From text;
• arbitrary or authentication headers, label lists, history IDs, size estimates, or MIME-part and attachment metadata;
• attachment content, prompt text, or raw model output;
• diagnoses, insurance data, unrestricted clinical notes, or preparation and check-in text; or
• rendered Discord notification text.

Raw fetched content, prompt text, model responses, inventory objects, and authentication header text remain transient process-memory data as implemented. This does not establish whether separately administered host services or logs retain other copies.

A Google OAuth client managed outside this application is authorized by the user. The local GOG client stores its OAuth client credential and account refresh token in its own OS-local, file-backed credential or keyring area, outside Git and outside the Appointment Reminder database. The application provides the keyring selection and a password from its process environment to the Gmail subprocess.

Credentials and tokens are not written by the application to SQLite, Git, model prompts, Discord messages, or development evidence. This application does not itself implement OAuth callback handling, token exchange, refresh, consent-screen rendering, account registration, or cloud credential provisioning.

If Discord reminders are enabled, selected Gmail-derived appointment logistics are sent through an account-specific, isolated OpenClaw profile to one dedicated, privately administered Discord destination. Deployment checks verified the intended participant boundary and sufficient bot delivery permissions; unavoidable administrative access remains.

A bounded reminder can include date and time, organization, optional provider, physical location when present and safe to render, modality, status, reminder or verification state, uncertainty warnings, and aggregate counts.

The reminder renderer has no fields for Gmail IDs, account identity, Subject or From, snippets, message bodies, authentication headers, attachment data, prompts or model output, diagnoses, insurance information, unrestricted notes, or preparation text. Operator-controlled Appointment Reminder messages are removed no later than seven days after the appointment, or earlier after a verified deletion request.

Discord is an external third-party destination. Discord, channel participants, and other recipients may retain caches, backups, screenshots, exports, recipient copies, or legally required copies outside the operator’s control.

The application does not request or download attachment content. A Gmail metadata response may nevertheless expose attachment names, IDs, sizes, MIME types, and MIME structure for validation; the application does not persist those values as appointment facts.

Sanitization removes recognized URL-bearing content, and Discord rendering withholds fields containing recognized HTTP(S) or www. URL forms. Virtual appointments are rendered only as the generic “Telemedicine” label, without the stored location. These protections do not categorically detect every bare domain, other link shape, or email-address-shaped value in source-derived organization, provider, or physical-location text. Discord mentions and Markdown are neutralized, but such text may still be delivered.

Derived appointment records, minimal Gmail message and thread identifiers, reconciliation history, unresolved-item records, and notification-delivery fingerprints are retained only while the service remains enabled for the account. App-specific Google credential state is retained only while access remains authorized and in use. This history supports reconciliation, provenance, and duplicate-reminder prevention.

The application has no automatic row-level purge, data-export endpoint, or in-application delete-account or delete-data workflow. Its history is immutable or append-only, so deletion is a manual complete per-account reset rather than selective record deletion.

Appointment Reminder does not intentionally create backups of application state or credentials by default, and deployment inspection found no Appointment Reminder backup job. If backups are enabled in the future, this policy will be revised before activation; they will be account-specific, owner-only, encrypted, no older than 14 days, and removable after a verified deletion request. Future general OpenClaw backups and host or provider snapshots require reinspection and may follow separately disclosed retention rules.

Only content-free scheduler, cleanup-review, and OpenClaw operational status logs are retained, for no more than 14 days. Logs found to contain user data are handled under the deletion procedure instead of ordinary expiry.

To request deletion, email openclaw-privacy@usefulgeometry.com. Requests are acknowledged within two business days. Control is verified through a single-use confirmation sent to the Gmail address associated with the app-specific authorization. We will never ask for your Google password, OAuth token, keyring password, or mailbox content.

Operator-controlled copies are deleted within seven calendar days after verification. The complete per-account reset removes the local Appointment Reminder database and sidecars, app-specific Google OAuth token and credential state, the app-specific GOG home, the dedicated OpenClaw profile and pending or failed delivery state, controlled backups, applicable user-data logs, and identifiable operator-controlled Discord reminders.

Completion is confirmed with a description of what was removed and any residual Discord or provider caches, recipient copies, legal holds, host or provider snapshots, or externally administered logs outside operator control.

You can stop future access in your Google Account’s third-party connection controls by selecting the application and removing its access. Visit Google’s instructions for managing third-party connections.

Revocation prevents future Gmail access. It does not itself erase Appointment Reminder SQLite records, messages already delivered to Discord, host backups, or other copies outside the application’s control.

The application restricts Gmail commands to message search and retrieval, applies read-only and no-send safeguards, reduces Gmail subprocess environments, bounds and validates model inputs and outputs, and restricts model communication to verified local Ollama models over loopback.

These controls do not establish encryption at rest, end-to-end encryption, or the security of a pre-existing database directory, host, backups, scheduler logs, local Ollama administration, OpenClaw process, Google account, or Discord destination. Authorized host operators, database or backup administrators, and Discord account or destination participants may be able to access derived information according to their operational permissions.

Intended human access is limited by policy to security, deletion, user-requested support with appropriate consent, or legal necessity. Local application files are restricted to the deployment’s operating-system account, but the operator and privileged host, storage, backup, Discord, or service administrators may remain technically capable of access.

The dedicated OpenClaw profile and Discord boundary, local schedules, operational-log retention, no-application-backup state, local-model controls, request-log behavior, and complete deletion topology were verified in the inspected deployment. Relevant deployment facts must be rechecked after configuration changes.

The complete deletion procedure was exercised against populated synthetic state while live state remained unchanged. It has not been exercised against real production user data, real credentials, or third-party Discord or OAuth deletion.

The private model service and Gmail-reading schedules are disabled and inactive, the overall production-ready gate has not been reached, and final Google OAuth production configuration remains unfinished. This policy does not represent the service as launched, active, Google verified or approved, or OAuth-production-ready.

The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

This policy may be updated when the application, its operational configuration, or its data practices change. Material changes should be reflected here before the related behavior is made available. The effective date is September 2, 2026.