Last updated: 17 October 2026 | Operator: Marlon Santos, Australia
Overview
This Privacy Policy governs the Personal Homepage of Marlon Santos application ("the Application") — a personal tool that operates the marlsantos.com website and connects to the owner's own Gmail account — and the website marlsantos.com, all operated by Marlon Santos ("I", "me", "my"). For questions or requests regarding this policy, contact: marlonsantos.au@gmail.com.
1. What Google User Data the Application Accesses
The Application's Gmail feature (the email categorisation component of the Personal Homepage of Marlon Santos) accesses the following Google user data from my own Gmail account, using the OAuth2 scope https://www.googleapis.com/auth/gmail.modify:
Email metadata: message subject lines and short content previews (snippets) of received emails.
Label data: the category labels currently applied to each message, and the ability to add category labels.
Example of the data accessed: "Our application will access the data in your Gmail account, including the subject line and content snippet of received emails, and the labels applied to them."
The Application does not access email bodies in full, attachments, contacts, calendar data, or any other Google services.
2. How the Data Is Used
The accessed data is used exclusively to provide the user-facing feature of the Application: automatically organizing my own Gmail inbox. Specifically:
"We will use your data to provide the service you requested — namely, automatically categorizing received emails into predefined Gmail labels (e.g., Newsletter, Receipt, Bank, Urgent)."
Subject lines and snippets of uncategorized emails are sent to Google's Gemini API (a Google service) to determine the appropriate category label, and the resulting label is applied to the message within Gmail.
Use of Google user data is limited to providing and improving this user-facing feature. Google user data is not used for any other purpose.
3. Data Storage and Retention
No database storage: The Application does not store, cache, or archive email content in any database, file, or cloud storage. Email content exists only in memory transiently during processing.
What is stored locally: The only persistent data is an OAuth2 authentication token, stored on the operator's local machine, used solely to re-authenticate with the Gmail API.
Retention: Email data is not retained after the categorization run completes. The OAuth2 token is retained until access is revoked or the token is deleted by the operator.
Deletion: Because no email data is stored, there is no stored email data to delete. The OAuth2 token can be deleted at any time by revoking access (see Section 6).
4. Data Sharing, Transfer, and Disclosure
"We do not transfer or disclose Google user data to any third party for purposes other than operating the Application."
Email subject lines and snippets are transmitted only to Google's own Gemini API for classification. This is a transfer to the same data controller (Google) that originated the data, under Google's own terms.
We do not sell, rent, or share Google user data with data brokers, advertisers, information resellers, or any external third party.
Google user data is never used for targeted advertising, selling to data brokers, providing to information resellers, determining credit-worthiness, lending purposes, or any form of advertisement targeting or retargeting.
AI/ML Affirmation: The Application does not use Google Workspace APIs (including Gmail API data) to develop, improve, or train any generalized, non-personalized AI and/or machine learning models. Category classification is a per-message, transitory inference call to Google's Gemini API; no email data is used as training data, stored for later training, or fed back into any model.
5. How the Data Is Protected
"Security procedures are in place to protect the confidentiality of user data."
All communication with the Gmail API and the Gemini API occurs over encrypted HTTPS/TLS connections.
OAuth2 credentials (access and refresh tokens) and API keys are stored in local configuration files, restricted to the operator's user account on a personal machine, and are excluded from version control.
No Google user data is exposed through any public endpoint, website, or log aggregation service.
No humans review Gmail data. Processing is fully automated and initiated only by the account holder.
6. Access, Control, and Revocation
The Application processes data only from the account holder's own mailbox; it is not offered as a multi-user service.
Access to Google user data can be revoked at any time via Google Account settings: myaccount.google.com → Security → Third-party apps with account access, or at myaccount.google.com/permissions.
Upon revocation, the stored authentication token stops working and can be deleted by the operator; no other Google user data is held.
7. Website (marlsantos.com)
The website uses Google Analytics to collect anonymous, aggregate usage statistics (pages visited, approximate geography, browser type).
Google Analytics cookies are used solely for aggregate analytics. No personally identifying information is collected by the operator.
This website data is entirely separate from the Gmail data described above.
8. Children's Privacy
The Application and website are not directed at children under 13, and no personal data is knowingly collected from children.
9. Changes to This Policy
Any material changes will be posted on this page with an updated revision date. Continued use of the Application after changes constitutes acceptance of the updated policy.