Privacy Policy
Starprojector Lab · Pip — last updated 4 November 2026
Pip is a single-user personal assistant. It is operated by the owner of the Google Account that authorises it, and it accesses that account only. This policy explains what Google user data it touches, why, where it is kept, and how to remove it.
Who operates it
One person: the owner of the Google Account that granted access. There are no other users, customers, or clients. Contact: fritzendugan@gmail.com.
What Google user data is accessed
| Scope | Why it is needed |
|---|---|
| Gmail — read, modify, send | To find, summarise, label, archive and send mail when the owner asks. |
| Calendar | To read the owner's schedule and create or edit events she asks for. |
| Drive | To find, read and save files in the owner's own Drive. |
| Sheets and Docs | To read and write spreadsheets and documents she points it at. |
| Contacts (read-only) | To recognise the people she corresponds with. |
No other Google data is requested. The assistant does not ask for passwords and never sees them.
How the data is used
- Only to carry out tasks the owner requests in conversation, or that she schedules.
- Only for her own account. No profiling, advertising, or automated decisions about anyone.
- Google user data is never sold, rented, or shared with third parties, and is never used to train machine-learning models.
- No human other than the account owner reads it.
Where it is stored
The assistant runs on a private server in the owner's home. Its credentials and any working copies of data live on that machine. Nothing is stored in a public cloud service operated by someone else, and there is no public endpoint that serves the owner's mail or files.
Retention and deletion
Data is kept only while it is useful for a task the owner set. She can delete any stored copy at any time by asking, or by removing it from the machine directly. Revoking the app's access from her Google Account (myaccount.google.com/permissions) immediately ends all access; the stored token stops working.
Security
Access uses Google's standard OAuth 2.0 flow. The refresh token is held on the private server with file permissions restricted to the assistant's own user account. The server is not reachable from the public internet except through authenticated channels.
Changes
If this policy changes, the date at the top changes with it. Because the only user is the account owner, changes are reviewed by her before they take effect.