Privacy policy

1. Operator and scope

Adarsh Kumar is responsible for Kiro Gmail and can be contacted at adarshkumar167@gmail.com. The app currently runs as a private, operator-managed personal automation setup. This website offers public information about the app; it does not offer public account registration or collect Google passwords.

This policy covers Google account information accessed through the automation and the records derived from it. The separate portfolio assistant has its own visible chat disclosure and does not give visitors access to the connected mailbox, workbook or financial database.

2. Data accessed and Google permissions

• Google Sheets: configured spreadsheet IDs, sheet names, entered investments, income records, balances, liabilities, transaction details, dates and calculation results. The connection reads entries and writes the configured workbook’s views, summaries and sync results.
• Google Drive: file identifiers and metadata used by the Sheets connector to locate and work with spreadsheet files. Connector permissions can allow access to files used with the app and broader Drive metadata management. The workflows use the configured workbook rather than collecting unrelated document contents.
• Gmail, where connected: message identifiers, sender and recipient headers, subjects, dates, message contents and supported finance-statement attachments returned by configured issuer searches. Gmail read-only permission can technically allow reading across the connected mailbox. The intake targets supported finance emails and does not send, modify or delete mail.
• Authorization information: OAuth access and refresh tokens and the granted permissions needed for the connected services. Google handles account sign-in and consent; the app does not ask you to disclose your Google password to the operator.
• Derived and supplied records: reviewed bill amounts, due dates, card/account labels, statement entries, rewards, portfolio values, reconciliations, source references and manually supplied corrections. A separately supplied statement password may be stored in a local encrypted password vault for supported PDF processing.

3. How the app uses this data

Data is used to provide the personal features described on the app homepage: process supported statements, reconcile amounts, detect duplicate imports, maintain portfolio and finance records, refresh a configured workbook and deliver selected account summaries and reminders. Unsupported or conflicting records may require review by the authorized account holder and operator.

Where portfolio research workflows are enabled, relevant portfolio context is combined with public market information to generate research summaries. The app does not execute bank payments or investment trades.

4. Connected services and disclosures

• Google APIs: authorization information and API requests are exchanged with Google to read or update the authorized data.
• Telegram: configured reminders and summaries are sent to the selected chat. These can include amounts, due dates, account/card labels and portfolio summaries. Telegram receives and stores delivered messages under its own policies.
• Google Gemini: separate portfolio-research workflows can send portfolio context, including asset names, asset values, allocations and exposure information, together with public news and market information, to Google’s AI service for inference. The supported Gmail statement parser processes message contents and attachments locally; it does not send those raw emails or attachments to Gemini. Google’s processing of Gemini inputs is governed by the terms and settings of the configured Gemini service.
• Infrastructure providers: the public site uses Tailscale HTTPS hosting/relay infrastructure. Providers may process connection information such as IP addresses and request metadata to deliver and secure their services.

The operator does not sell Google user data or use it for advertising, data-broker services or creditworthiness decisions. The app does not itself train AI models. Human access is limited to the account holder and authorized operational review, troubleshooting, security or legal needs. Relevant data may be disclosed where applicable law requires it.

5. Storage and security

Automation data is kept on operator-controlled infrastructure. Financial records are stored in a private database; supported statement documents, review material and operational backups can also be retained in restricted local storage. OAuth tokens are encrypted by n8n. Supplied statement passwords are kept separately in an encrypted local vault where that feature is used.

The public app pages do not display connected records, credentials or statement documents. Google and Telegram API calls use HTTPS. Access controls and restricted storage reduce exposure, but no system can guarantee absolute security. This policy does not claim that every database, local working file or backup is encrypted at rest.

These static app and policy pages do not use advertising trackers, analytics cookies or a Google sign-in form. Necessary network requests still disclose connection metadata to the hosting infrastructure.

6. Retention and deletion

Imported financial history, source references, review documents and operational backups are retained while needed for the personal record-keeping features or until the operator removes them. There is currently no fixed automatic deletion period. Short-lived processing data and execution metadata may also exist while workflows and maintenance operations run.

You can request access, correction or deletion by emailing adarshkumar167@gmail.com. Identify the connected account and the records involved; do not send passwords, OAuth tokens or full card numbers. The operator may verify that you control the account before acting.

A deletion request can cover stored application records, retained source documents and backup copies. The operator will explain any copies that need separate removal or must be retained for a stated legal reason. Removing the Google connection does not automatically delete previously stored records or messages already delivered to Telegram. Telegram messages and the original Google files remain subject to the controls of those services.

7. Manage or revoke access

Visit Google Account connections, select the app and remove its access. The app will be unable to obtain new authorized access after revocation; already issued access tokens may take time to become invalid. You can also ask the operator to stop a workflow or remove its stored connection and records.

For personal data supplied manually, contact the operator to review or correct it. Financial summaries depend on source accuracy, the last successful sync and your manual confirmations.

8. Google API Services and Limited Use

Our use and transfer of Google API data must follow the Google API Services User Data Policy, including its Limited Use requirements. Google data is used for the disclosed personal automation features. Any additional data use or new transfer requires an updated disclosure and any consent required before that use begins.

9. Updates and contact

The date above identifies the current policy. Material changes to Google data access, use or sharing will be disclosed before the changed processing begins, and new authorization will be requested where required.