Updated September 9, 2026
Personal Productivity is personal-use software maintained by the owner of peterjgray.com. This policy describes the current Gmail metadata helper, the local workspace, and this informational website.
Information accessed from Google
Each account is connected through Google’s authorization screen. Metadata-only accounts use the gmail.metadata permission. Accounts enabled for label application use gmail.modify. Google’s gmail.modify permission also permits reading message bodies, sending mail, managing drafts, and moving messages to Trash; the helper does not expose those additional actions. These narrower restrictions are enforced by the local helper and are not a narrower Google authorization.
The helper reads the account email address, label information, message identifiers, sender and recipient addresses, message dates, and the fields needed to enforce its scan boundaries. Subjects are requested and included in search results only when enabled for an account. Selected metadata, including enabled subjects, may be shared with the assistant when the user requests its help, under the assistant provider’s terms and the user’s account settings. The helper does not request or expose snippets, message bodies, attachment contents, or attachment filenames.
Scans cover the union of selected labels within a combined message limit, with that limit divided across the labels. On request, the helper may add only locally approved existing custom labels to explicit messages from a recent scan. It checks that those messages still belong to the permitted collection before attempting the changes. Account settings, including subject access and approved label names, are stored locally. A limited activity log records action details and outcomes in memory while the helper runs. Failed label requests can have partial or uncertain outcomes; they are reported rather than described as rolled back.
How information is used
Metadata is used to find relevant email references by correspondent and date, identify which account a result belongs to, and report search coverage. Scans and searches specify the accounts to use. This version scans on request and does not monitor mail in the background.
The local workspace can also hold notes, transcripts, documents, and task context that the user chooses to import. The assistant can use selected context to answer questions, organize work, and prepare drafts.
Storage and retention
Reusable Google authorizations and the application configuration needed to renew them are stored separately for each account in macOS Keychain. The helper does not store Google passwords or expose Google tokens through its assistant-facing interface.
Account aliases, email addresses, selected labels, and message limits are saved in a local account registry. Short-lived access tokens, message indexes, and a limited recent activity log stay in the running helper’s memory and are cleared when it stops.
Material saved into task notes or source files remains in the local workspace until the user removes it. Copies included in backups or synced folders follow the user’s backup and sync settings. Keychain provides local credential storage; it is not complete isolation from other software running with the user’s permissions.
Sharing with an assistant and other services
When the user asks an assistant to use the Gmail capability, selected metadata results, account information, and relevant status information are provided to that assistant. Content the user imports or includes in a conversation may also be processed by the assistant provider under the terms and data settings of the user’s account.
Google receives the requests needed for authorization, token renewal, and Gmail API access. The local helper has no feature for uploading its entire message index to the public website. It has no advertising, data resale, or model-training feature.
Your controls
The user chooses which accounts to connect and each account’s label and message limit. Stopping the helper clears its in-memory data. Access can be revoked through Google Account connections.
Revoking Google access does not delete local records or material already shared with an assistant. Saved credentials can be removed from macOS Keychain, and local account records and workspace files can be deleted separately. The helper does not yet include an account-removal screen. Copies in an assistant service must be managed through that service’s controls.
This website
This website provides app information and this privacy policy. It has no Gmail connection form and does not receive Gmail authorizations or the helper’s message index. The site’s code adds no analytics or advertising trackers. Hosting infrastructure may process ordinary connection information, such as IP addresses and request logs, and any hosting access cookies under the hosting provider’s practices.
Changes and contact
This policy will be updated as integrations or data practices change. Its date identifies the current version. For questions about the app or its handling of Google data, use the support email address displayed on the app’s Google authorization screen.