More Signal Tools
Last updated 2 September 2026
This policy covers Google Sync, a personal automation tool that reads and writes the operator’s own Google Workspace data. It is built and operated by Brett Jones and is used by one person: its operator. There are no other users, no sign-ups, and no public release.
Google Sync authorises against a single Google Account — the operator’s own — and requests the following scopes:
| Scope | What it is used for |
|---|---|
.../auth/contacts |
Look up an existing contact to avoid creating duplicates; create or update a contact record; read the account’s contact labels and file a person under an existing one. |
.../auth/spreadsheets |
Read and append rows to the operator’s own tracking spreadsheets. |
.../auth/documents |
Read and write the operator’s own documents. |
.../auth/presentations |
Read and write the operator’s own presentations. |
.../auth/drive.file |
Save generated files back to the operator’s own Drive. This is the per-file scope: it grants access only to files this tool itself created, and never to the rest of the Drive. |
The tool requests no other Google scopes. It has no access to Gmail.
Google user data is used for one purpose only: automating the operator’s own routine work in their own account — keeping contacts current, maintaining tracking spreadsheets, and producing documents. Every read and every write happens in the operator’s own account, at the operator’s own instruction.
The data is not used for advertising, profiling, marketing, resale, analytics, or any form of automated decision-making. It is not used to train machine learning or AI models.
The contacts component runs as a small server-side function hosted on Vercel, reachable only by the operator. A request flows in one path and one path only:
operator’s assistant → this service on Vercel → the relevant Google API → back again
Data is held in memory only for the moment it takes to serve a single request, and is then discarded. There is no database and no Google user data is stored at rest. Nothing is written to disk, and no copy of the operator’s data is retained anywhere in this service.
Vercel acts as the hosting provider and, in that capacity, processes requests on the operator’s behalf. As with any web host, Vercel records operational request logs (timestamps, paths, status codes). Those logs are not designed to contain Google user data, and the service does not deliberately write such data into them.
Other components of Google Sync run locally on the operator’s own computer, with credentials encrypted at rest and bound to that machine’s keychain.
The tool authenticates with an OAuth refresh token belonging to the operator’s own account. That token, and the OAuth client credentials, are stored as encrypted environment variables in the Vercel project (or in the local encrypted credential store, for the local components). They are never exposed to the browser, never written into the served pages, and never shared. Short-lived access tokens are obtained from Google as needed and held only in memory.
The hosted endpoint requires a secret bearer token, so it cannot be called by anyone other than the operator.
Google user data is never sold, rented, or shared with any third party. No human other than the operator has access to it. Apart from Vercel in its role as host, and Google itself, no other service receives this data.
Google Sync’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Because the service stores no Google user data, there is nothing on its side to delete. The underlying records live in the authorising Google Account and can be edited or removed at any time through the relevant Google product.
Access can be withdrawn at any time from the Google Account permissions page at myaccount.google.com/permissions. Revoking access immediately invalidates the stored refresh token and the tool stops working.
The pages you are reading are static. They have no login, no forms, no analytics, no advertising and no cookies, and they collect nothing from visitors.
The tool is not directed at children and is not accessible to anyone but its operator.
If the tool’s data handling changes — for example, if it requests an additional Google scope — this page will be updated and the date at the top revised.
Questions about this policy can be sent to brett.jones2@gmail.com.