Privacy policy

1. Who is responsible

PersonalWork is a personal application developed and operated by an individual developer ("the operator"), who is also its only user. The operator is the data controller for the information described here. Contact: hanyi.han@bytedance.com.

2. Information the application processes

PersonalWork processes only what the tasks it is given require. The table below names every category, what it contains, the purpose it serves and how long it is kept.

Categories of information processed by PersonalWork, their purpose and retention
Category	What it includes	Purpose	Retention
Google account identity	Google Account ID, display name, email address, profile image URL, account language.	To determine which account a task applies to and to label the results of a task.	While the authorization is active.
Google user content	The owner's own Drive files and documents, mail, calendar entries, contacts, tasks, chat messages, course material, photos created by the application, and reporting figures — read, created or modified only when a task requires it.	To perform the specific task the owner asked for, and nothing else.	Only as long as the task needs it. Working copies are deleted when the task finishes.
Authorization tokens	OAuth access and refresh tokens issued by Google.	To act on the owner's behalf without asking for the account password again.	Until the owner revokes access; revoked tokens are deleted immediately.
Operational logs	Timestamps, task names, success or failure, error messages and technical identifiers. Logs are designed not to contain message bodies or document contents.	To diagnose failures and keep the application working and secure.	30 days, then deleted automatically.
Configuration	Task definitions, scope choices and other settings the owner writes.	To know what the owner wants done.	Until the owner deletes it.

PersonalWork does not collect payment information, government identifiers, health information, precise location, or any special category of personal data. It does not build a profile of anyone. The only person whose data it processes is the owner, because the only account that can authorize it is the owner's.

3. What this website collects

This website is a static page. It sets no cookies, runs no analytics, loads no third-party scripts or web fonts, and contains no forms, accounts or tracking pixels. The hosting provider processes ordinary HTTP request data — IP address, user agent, requested URL, timestamp — in order to deliver the page and protect against abuse. That data is governed by the hosting provider's own privacy terms and is not used by PersonalWork to identify anyone.

4. How information is used

To carry out the tasks the owner asks for, using the owner's own account.
To keep the authorization working — refreshing tokens, detecting revocation.
To diagnose failures and keep the application secure.
To comply with the law where it applies.

Information is not used for advertising, profiling, credit or insurance decisions, resale, or to train or improve generalized artificial-intelligence or machine-learning models.

5. Legal bases

Where the GDPR or a comparable law applies, the operator relies on consent — given when the owner authorizes the application through Google's consent screen, and withdrawable at any time — and on legitimate interests in operating and securing a personal tool the owner has asked for. Where consent is the basis, withdrawing it stops the processing.

Google user data is not sold, rented, traded or shared for advertising. It is disclosed only:

to the infrastructure providers that run the application (currently Cloudflare, for hosting, compute and storage, and the owner's own server), strictly as data processors and only to the extent needed to run the service;
to Google, because Google is the source of the data and the endpoint of the API calls;
to an AI model provider, only when a task needs a model's help, only for that task, and only under terms that prohibit using the content to train general models;
where required by law, or to protect the rights, safety and security of the operator or others;
with the owner's explicit consent.

No human other than the owner is given access to the owner's Google content. There is no advertising network, no data broker and no analytics vendor in the chain.

7. Security

Access tokens are stored on the owner's own infrastructure with restrictive file permissions and are never committed to source control or published. All traffic between the application, Google and its providers uses TLS. Data at rest is encrypted by the infrastructure providers. Access to the production environment requires the operator's own credentials and multi-factor authentication. See Data and security for the fuller description.

8. International transfers

The infrastructure providers used by the application operate globally, so information may be processed in countries other than the owner's. Where required, transfers rely on the providers' standard contractual clauses or an equivalent safeguard.

9. Your rights

The owner — and anyone whose data the application processes — may request access to the information held, correction of it, deletion of it, a portable copy of it, or object to and restrict its processing. Requests go to hanyi.han@bytedance.com and are answered within 30 days.

10. Deleting your data

Deleting Google user data takes effect in two steps, and the owner controls both:

Stop the application's access. Visit Google Account → Security → Third-party apps with account access and remove PersonalWork. This immediately invalidates the tokens the application holds, so it can no longer read or change anything in the account.
Have the remaining copies erased. Email hanyi.han@bytedance.com and ask for erasure. Tokens, configuration and any task data are deleted within 7 days; operational logs are deleted within 30 days; encrypted backups age out within 30 days.

Deletion is complete and irreversible, with the exception of records the operator is legally obliged to keep — limited to what the law requires and never used for any other purpose.

11. Children

PersonalWork is a personal tool for one adult and is not directed at children. It is not offered to, and does not knowingly process the data of, anyone under 13 (or the minimum age in the relevant jurisdiction).

12. Changes to this policy

If this policy changes, the "last updated" date above changes with it, and the new version is published at this address. Material changes are also announced to the owner, who is the only user, before they take effect.

Google API Services User Data Policy — Limited Use

PersonalWork's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve user-facing features that are visible in the application, is transferred only if necessary to provide or improve those features, and is never used for advertising or sold to third parties. No human reads the owner's Google user data, except where the owner has given explicit consent, where it is necessary for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.