Privacy Policy

1. Scope and operator

OpenClaw OAuth Adapter is an OAuth configuration for authorized users that connects approved Google accounts to an operator-controlled OpenClaw environment through gogcli. The operator of the adapter determines why and how data is processed for this service and can be contacted at [email protected].

This policy covers the OAuth adapter, the related authorized OpenClaw workflows, and this information website. The website does not receive OAuth redirects, tokens, or Google account content. It uses no application analytics, advertising trackers, or account sign-in. Its hosting provider may process ordinary request data such as IP address, browser information, requested URL, and timestamps to deliver and protect the site.

2. Data we process

The categories depend on the permissions shown by Google and the tasks a user authorizes:

• Account and configuration data: Google account email address, local alias, profile label, enabled service bundle, and authorization status.
• OAuth data: the OAuth client configuration, access tokens, refresh credentials, and related authentication metadata.
• Google service data: content and metadata from Gmail, Calendar, Drive, Docs, Contacts, Tasks, and Photos, including changes or actions requested through those services.
• Task and operational data: prompts, tool inputs and results, generated responses, saved artifacts, diagnostic results, and limited logs needed to run, secure, and troubleshoot the authorized service.
• Website request data: standard network and security metadata processed by the site hosting provider.

Google data comes from the account holder through Google APIs. Configuration and task instructions come from the user or the authorized operator.

3. Why and how data is used

• Authenticate the intended Google account and maintain its authorized connection.
• Read, search, organize, create, update, send, or delete information when an authorized user-facing task requires it.
• Return task results, create requested artifacts, and preserve information the user asks the workflow to retain.
• Verify that the authorization and Google services work, including limited read-only service checks.
• Protect accounts and systems, investigate errors or abuse, meet legal duties, and maintain reliable operations.

Where European or similar data-protection law applies, processing is based as appropriate on providing the service requested by the user, consent where legally required, the operator’s legitimate interests in securing and maintaining the authorized service, and compliance with legal obligations. A user may withdraw a consent-based authorization, but that does not make earlier lawful processing unlawful.

4. Google API Limited Use

Google user data is used only to provide or improve prominent, user-facing features requested through this adapter. It is not sold, supplied to data brokers, used for advertising or retargeting, used to determine creditworthiness, or used to build unrelated profiles.

Humans do not read Google user data except when the account holder or authorized user affirmatively asks for help with specific data, when access is necessary for security or troubleshooting, when required by law, or when data is aggregated and used for permitted internal operations.

5. Processing, service providers, and disclosure

Data is not disclosed to unrelated third parties. To complete an authorized task, relevant data may be processed by:

• Google, which authenticates the user and supplies the requested Google APIs under the user’s Google relationship.
• gogcli and the operator-controlled OpenClaw runtime, which obtain authorization and execute requested service actions.
• Configured AI model providers, when task prompts or tool results must be processed to produce the user-requested response.
• Hosting, network, and backup providers, to operate, secure, and recover the controlled environment and this website.

Data may also be disclosed at the user’s direction, to investigate abuse or protect security, or when legally required. If a provider processes data in another country, that processing is subject to the provider’s terms and applicable transfer safeguards. The operator remains responsible for limiting transfers to what the authorized feature requires.

6. Storage and security

Each Google account has a separate OAuth grant. Credentials are stored in an encrypted, file-based keyring inside protected service state, outside the agent-writable workspace. The local account manifest records items such as alias, email, profile label, and enabled services, but not the token itself, and is stored with restricted file permissions.

Controlled backups can include the state containing encrypted Google credentials and service configuration. Administrative access is restricted and reasonable technical and operational controls are used to protect data in transit and at rest. No storage or transmission method can be guaranteed completely secure.

7. Retention, deletion, and revocation

OAuth credentials are kept while the account remains onboarded or until the local credential is deleted, the Google grant is revoked, or the controlled environment is retired. Task data and artifacts are retained only as needed for requested workflows, security, legal duties, and configured storage or backup practices. A fixed universal retention period does not apply because the duration depends on the workflow and the relevant backup lifecycle.

Removing an alias

removes the local friendly mapping and manifest entry. It does not itself delete the stored credential or revoke Google access.

Deleting the local credential

removes the credential from active protected storage. Encrypted backup copies may persist until the applicable backup is deleted or expires.

Revoking the Google grant

stops future API access through that grant. The account holder can do this at Google Account permissions.

Requesting deletion

allows a user to ask the operator to remove locally held account records and task data, subject to narrow security, legal, or backup limitations.

8. Privacy rights

Depending on where the user lives and which law applies, the user may have rights to be informed; request access, correction, deletion, restriction, or portability; object to certain processing; withdraw consent; and complain to a local data-protection authority. The service is not intended to make decisions producing legal or similarly significant effects solely by automated means.

Where applicable under US state privacy law, users may also request to know, correct, or delete personal information and exercise applicable rights without discrimination. The operator does not sell personal information or share it for cross-context behavioral advertising.

Requests can be sent to [email protected]. Reasonable verification may be required to protect the account, and the response may be limited where an exemption or competing legal obligation applies.

9. Children

The adapter is not directed to children and is not offered for use by anyone under 13 or below the minimum age required to manage their own Google Account in their country. The operator does not knowingly onboard a child’s account.

10. Changes and contact

This policy may be updated when the integration, providers, or legal requirements change. If a change materially expands how Google user data is used, affected users will be informed and asked for renewed authorization where required before the new use begins.

Privacy questions, rights requests, and deletion requests can be sent to [email protected].