Privacy Policy

Effective 8 November 2026

Donna is a personal assistant that one individual (the "owner") built and runs for their own use. It is not offered to the public. This policy explains what Donna does with data, including data it gets from Google APIs.

Who can use Donna

Only the owner. Donna's chat accepts messages only from the owner's own account, and only the owner's Google account is connected. Donna does not offer sign-up and does not collect data about anyone else as a user.

Google data Donna accesses

After the owner grants permission on Google's consent screen, Donna uses read-only access to:

• Gmail: search messages, and read messages, threads and labels.
• Google Calendar: list calendars, read events and check free/busy times.
• Basic profile: the account's email address, to know which account is connected.

Donna does not request permission to send, delete or change email, or to create, change or delete calendar events.

How the data is used

Google data is used only to answer the owner's own questions in the owner's private chat, for example to summarise today's schedule or find a particular email. Donna reads it when the owner asks a question that needs it. It is not used for advertising, sold, or used to build profiles.

Where the data goes

• The owner's server. Donna runs on a private server that the owner controls. Google's access tokens are stored there in a directory that only Donna's service account can read.
• An AI model provider. To write an answer, Donna sends the owner's question and the relevant email or calendar content to a large-language-model API provider (routed through OpenRouter). The provider processes it to produce the reply. Donna does not use Google data to train AI or machine-learning models, and it does not allow the data to be used for that.
• Nowhere else. Google data is not shared with any other person or company, except where the law requires it.

Retention and deletion

Email and calendar content is fetched when a question needs it and is not copied into a separate database. Content that appears in a chat answer stays in Donna's chat history on the owner's server. That includes the server's nightly backups, which keep at most seven days. The owner can delete the history at any time.

To stop all access, revoke Donna at myaccount.google.com/permissions, and delete the stored tokens on the server.

Security

Access is read-only and limited to the owner's account. The server is administered over key-based SSH and exposes no public web interface for Donna. Google sign-in finishes on the server's loopback interface through an owner-only tunnel, never through a public web endpoint. Secrets and tokens are stored with owner-only file permissions.

Google API Services User Data Policy

Donna's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.

Contact

Questions about this policy: psriwattana@gmail.com.