Privacy policy

Who operates Vesper

Vesper is a personal assistant operated by Arsha Niksa. This policy covers its Google account connection, Apple snapshot bridge, Telegram briefings, and these public information pages. Contact: arshanyxaa@gmail.com.

Data accessed and why

Gmail access uses Google OAuth with the read-only scope https://www.googleapis.com/auth/gmail.readonly. This permission allows reading email; Vesper’s current implementation requests message and thread identifiers, headers (including subjects, senders, recipients, and dates), snippets, labels and unread state, and history identifiers. It checks the authorized email address to ensure the intended account is connected. It does not request full message bodies or attachments.

These data are used only to prepare the owner’s unread-mail overview, identify relevant daily-report alerts, link items to their source, and maintain refresh state. Vesper does not send, modify, archive, or delete Gmail messages.

With macOS authorization, Vesper also reads selected calendar event titles and times, per-list open-reminder counts, and extracted lines from the selected Backburner note. Only this selected Apple snapshot and collection timestamps are uploaded to the briefing server; individual reminder titles and raw Notes HTML are not included in the upload.

Storage and protection

OAuth credentials, cached Gmail metadata, selected Apple snapshots, generated reports, and delivery state are held in private application directories on the owner’s Mac and private server as applicable. Credentials and application databases are protected by operating-system file permissions. This is file access control, not a claim that the application encrypts its databases at rest. Google and Telegram requests use HTTPS; Apple snapshot uploads use authenticated SSH.

The public website contains project information, not mailbox records, private tasks, or credentials. Operational logs record status and error classes rather than access tokens or message bodies.

Sharing and human access

Relevant subjects, brief snippets, alert summaries, calendar items, reminder counts, and selected note items may appear in the briefing sent via Telegram’s Bot API to the owner’s paired private chat. Telegram processes these messages under its own privacy policy; bot chats are not end-to-end-encrypted Secret Chats. The server’s hosting provider processes stored data as part of providing infrastructure.

Vesper does not sell user data, use it for advertising or credit decisions, or send it to an external language model. Human access to Google user data is limited to the owner and specifically authorized troubleshooting, or access necessary for security or legal compliance. Data are not published on this website.

Vesper’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Retention and deletion

During routine data purges, cached snippets and report copies in the application database expire after seven days by default; minimal source and action metadata expire after 90 days. Active records may be refreshed and retained as they remain relevant. Purging runs as part of briefing preparation.

Exported briefing files, server or device backups, and messages already delivered to Telegram are separate copies and may remain until the owner deletes them. Database deletion is logical and does not guarantee forensic erasure of storage or backups.

The owner can disconnect Vesper in Google Account connections. Revoking access stops future Google reads but does not erase existing copies. To remove stored data, delete Vesper’s credentials, application databases, snapshots, exported reports, and relevant backups on the configured devices/server, and delete delivered messages separately in Telegram. For help with access or deletion, email arshanyxaa@gmail.com.

These public pages

These pages are served by GitHub Pages and use the personal website’s shared stylesheet, which loads Google Fonts. Hosting and font providers may receive ordinary web-request information, such as an IP address and browser details. These Vesper pages add no analytics scripts, account forms, or tracking cookies, and visiting them does not connect a Google account.

Changes

This policy will be updated when Vesper’s data practices change. Material changes to Google data access or use require updated disclosure and any consent required by Google before the new use begins.