Privacy Policy
Effective date: October 31, 2026
This policy explains how ntomoya (“the app”), operated by an individual developer (“the operator”, “we”), accesses, uses, stores and shares data when you connect a Google account. It applies to every tool and service that signs in with Google under the name ntomoya, as described on the homepage.
1. Google user data we access and why
Each tool requests only the categories below that it needs, at the lowest access level that works (read-only where possible). Google's consent screen shows the exact permissions before you agree. A tool works only with the data of the account that authorized it.
| Data | Access | Purpose |
|---|---|---|
| Basic profile: account identifier, email address, name, profile picture | Read | Identify you when you sign in, link you to an account the operator has authorized, and show your name and email address in the operator's services. |
| Gmail: messages, labels and drafts | Read, or read and change | Search, read, label, organize and draft email when you run a tool. |
| Google Drive, Docs, Sheets and Slides: files and their content | Read, or read and change | List, read, create and edit files when you run a tool. |
| Google Calendar: calendars and events | Read, read and change, or limited to calendars the tool created | View and create events when you run a tool; create a dedicated calendar and keep events copied from another calendar service (title, date and time, location, notes, participant names and reminders) in sync. |
| Google Tasks: task lists and tasks | Read, or read and change | View and manage tasks when you run a tool. |
2. How we use the data
Google user data is used only for the purposes in section 1, to provide the features you chose to use. A tool acts only when you run it or on a schedule you set up.
When you choose, the result of a tool you run may be passed to an AI assistant that you use on your own device, to complete a task you asked for (for example, summarizing your own inbox). This happens only at your direction and only with your own data.
We do not:
- sell Google user data or use it for advertising, including personalized or retargeted ads;
- use Google user data to develop, improve or train generalized AI or machine-learning models;
- use Google user data to determine credit-worthiness or for lending;
- allow humans to read Google user data, except you reading your own data, with your explicit consent for specific messages or files, when needed for security purposes (such as investigating abuse), or to comply with applicable law.
3. Storage and security
- Tools that run on your own device: the authorization is stored on that device. Data is fetched directly from Google when the tool runs and is not uploaded to any ntomoya server. Copies stay on the device only when you save them.
- Tools that run on a schedule on the operator's servers: the Google refresh token is stored as an access-restricted secret. Only the state needed to do the job (such as calendar IDs and sync progress) is kept, not a copy of your content. The content of your email, files and events is not written to logs.
- Sign in with Google: your account identifier, email address and name are stored in the operator's identity service as part of your account link. Google access and refresh tokens are not stored after sign-in.
- All connections are encrypted with TLS.
4. Sharing and disclosure
We do not share, transfer or disclose Google user data to third parties, except:
- with infrastructure providers that carry traffic for the operator's services (for example, Cloudflare for network delivery), only as needed to operate them;
- as described in section 2, at your direction;
- when required by law, or to protect the security of users and services.
When a tool brings data in from another service (for example, copying events from another calendar service into Google Calendar), the transfer is one-way into Google. Google user data is not sent to that other service.
5. Retention and deletion
- You can revoke ntomoya's access at any time at myaccount.google.com/connections. Tools stop working with your data as soon as access is revoked.
- Authorizations stored on your device are deleted when you sign out of the tool or revoke access.
- Refresh tokens and state stored on the operator's servers, and the account link for Sign in with Google, are deleted when you stop using the tool or account, or within 30 days of a request to privacy@ntomoya.com.
- Data a tool created in your Google account at your request (such as a dedicated calendar) stays there until you delete it.
6. Limited Use
ntomoya's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. New tools and changes to this policy
New tools may be added to ntomoya. They use only the kinds of data, purposes and sharing described in this policy. Before any tool uses a different kind of Google data, uses data for a new purpose, or shares it in a new way, this policy will be updated with a new effective date, and you will be asked to consent again before your data is used in the new way.
8. This website
apps.ntomoya.com is a static website. It does not use cookies, analytics or tracking scripts. Our hosting provider (Cloudflare) may process standard request logs, such as IP addresses, to deliver and protect the site.
9. Children
ntomoya is not directed to children under 13 and is used only by the operator and by people the operator has authorized.