Ctrl + Cmd AI builds automation tools that work inside accounts you already own. This page says exactly what we touch, why we touch it, and how to shut it off. If a sentence here is unclear, that is our fault — write to us and we will fix the wording.

01Who we are

Ctrl + Cmd AI ("we", "us", "our") is a software studio operating from Washington State, United States. We can be reached at ctrl.cmd.ai@gmail.com. That address is also how you exercise every right described on this page.

02What our software does

We build and run automation tools — for our own operations and for clients who ask us to. These tools do work a person would otherwise do by hand: sorting an inbox, drafting a reply for review, filing a document, reading a calendar to plan a week, updating a spreadsheet.

Nothing runs on your account unless you personally connect it and grant permission. Nothing runs on a schedule you did not agree to.

03Google account data we access

When you connect a Google account, Google shows you the exact permissions being requested and you approve them one time. Depending on which tools you use, we may request:

• Gmail — read (gmail.readonly). To sort, label and summarize your mail so you see what matters first.
• Gmail — draft and send (gmail.compose, gmail.send). To prepare replies. Drafts wait for you unless you have explicitly turned on sending for a specific task.
• Google Drive (drive, drive.file). To create, file and organize documents in your own Drive, in folders you name.
• Google Calendar (calendar, calendar.events). To read your schedule and add or adjust events you asked for.
• Google Tasks — read (tasks.readonly). To show your existing to-dos alongside the rest of your week.

We request only the permissions the tools you actually use require. You can decline any of them, and you can revoke all of them later.

04How we use it — and what we never do

Your data is used for one purpose: performing the task you asked for. It is read while the task runs, and the result goes back into your own account — a draft in your Gmail, a file in your Drive, an event on your calendar.

We do not sell your data. We do not share it with advertisers or data brokers. We do not use it to train machine-learning or AI models. We do not build advertising profiles. We do not read your mail for any purpose other than the automation you turned on.

05Where it is kept, and for how long

Our design rule is pipe, not tank — data moves through our tools, it does not pool in them. Google content is processed to complete a task and is not copied into a separate database for later mining.

• Access tokens — the keys Google issues so a tool can act for you — are stored on our own private infrastructure, restricted to us, never included in any code we publish.
• Working output you asked for (a summary, a draft, a filed document) lives in your Google account, or in a private working folder if you asked us to keep it there.
• Operational logs record that a task ran and whether it succeeded. They are kept up to 12 months for troubleshooting and contain no message bodies or file contents.
• On revocation or request, tokens are destroyed and any working copies we hold are deleted within 30 days.

06Who else sees it

No one, with three narrow exceptions: Google itself, because that is where the data lives; infrastructure providers that host our tools and are bound to confidentiality; and a legal demand we are required by law to answer. If we are ever compelled that way and are permitted to tell you, we will.

07How to turn it off

You can disconnect Ctrl + Cmd AI from your Google account at any moment, without asking us, at myaccount.google.com/permissions. Access stops immediately.

To also have anything we still hold deleted, email ctrl.cmd.ai@gmail.com with the subject "Delete my data". We confirm in writing within 30 days.

08Your rights

You may ask what we hold about you, ask for a copy, ask us to correct it, or ask us to erase it. We do not charge for this and we do not require a reason. Residents of California, the EU and the UK have these rights by statute; we extend the same handling to everyone.

09Security

Credentials are stored outside of source control, transmitted only over encrypted connections, and scoped to the narrowest permission that completes the job. We run periodic internal security reviews of our own tooling. No system is perfect; if we ever discover a breach affecting your data, we will tell you directly and promptly.

10Children

Our tools are built for business use and are not directed to anyone under 16. We do not knowingly collect data from children.

11Changes

If this policy changes, the effective date at the top changes with it. If a change materially affects how Google account data is handled, we will notify connected users by email before it takes effect.

12Contact

Questions, requests, or a sentence that reads wrong: ctrl.cmd.ai@gmail.com.