Danny Goh

Codex Gmail Manager Privacy Policy

Codex Gmail Manager · Privacy Policy · Terms of Use · Contact

Last updated: 13 October 2026

This Privacy Policy explains how Codex Gmail Manager accesses, uses, stores and shares Google user data.

Operator and scope

Codex Gmail Manager is operated by Danny Goh for personal use: Danny Goh’s own Gmail accounts and a small number of individually authorised users. There is no public registration. Contact: [email protected].

Data accessed and purpose

For each authorised Google account, the application can access:

  • the account’s email address;
  • mailbox totals;
  • labels;
  • filters, including their criteria and actions;
  • message identifiers;
  • selected email headers and content.

This data is used only for searches, analysis and mailbox organisation that the user requests. Email content can include personal information about the people who sent, received or are mentioned in the messages.

The application requests Google’s gmail.modify permission (to read and organise messages and labels) and gmail.settings.basic permission (to manage filters). Although gmail.modify also permits sending, the current tool exposes no sending, trashing or permanent-deletion commands.

Processing and sharing

Google supplies mailbox data to the application through the Gmail API. The MCP server running on the operator’s computer sends the relevant tool results to ChatGPT/Codex, which is provided by OpenAI, so that the user’s request can be fulfilled.

This means selected email content, together with related information such as label names and filter settings, can leave the local computer and be processed by OpenAI. How long OpenAI retains that data, and whether it may be used to improve OpenAI’s models, depends on the OpenAI product in use, the account’s settings and the applicable OpenAI terms.

The operator does not sell Google user data, does not use it for advertising, and does not independently use it to train a general-purpose AI model.

Codex Gmail Manager’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Local storage

  • OAuth tokens are encrypted using Windows Data Protection API (DPAPI), tied to the Windows user context on the operator’s computer.
  • The OAuth client configuration is stored locally.
  • Configuration audits, label and filter backups, and operation records may be saved locally as JSON files. These configuration files are not encrypted by the application.
  • Selected email content is retrieved on demand. The application does not maintain a complete local archive of email bodies.
  • ChatGPT/Codex conversations, and any reports deliberately saved from them, follow the retention controls of the service where they are held.

Credentials, tokens, account inventories and mailbox data are never published on this website.

Retention and deletion

  • OAuth tokens remain until they are removed, expire or are revoked.
  • Local audits and backups remain until the operator deletes them.
  • Users can ask the operator to remove locally stored data for their account by emailing [email protected].
  • Deleting local files does not erase earlier ChatGPT/Codex conversations or saved reports.

Your choices

You can decline to grant access. You can revoke access at any time in your Google Account at https://myaccount.google.com/connections.

Revoking access stops future access. It does not undo changes already made in Gmail, such as labels, filters or archived messages, and it does not erase records retained before revocation.

Changes to this policy

This policy will be updated when the application’s features or data practices change. The date at the top of this page shows when it was last updated.

Contact

Danny Goh, [email protected]. See also the Terms of Use.