Privacy policy

For the gcal MCP server at gcal.g.dobrochai.com. In force since 13 October 2026.

Who runs this, and for whom

The server is operated by its owner, a private individual, for the owner's own use. The only Google account it is authorised for is the owner's. Nobody else can sign in, and no one else's data is processed.

What Google user data it accesses

Through the Google Calendar API, with the scope https://www.googleapis.com/auth/calendar: the list of calendars the account can see and their settings; the events in those calendars, including titles, times, descriptions, locations, attendees and reminders; free/busy information; the sharing (access control) settings of the account's own calendars; and the account's calendar settings, such as its time zone.

How it is used

Only to carry out requests the account owner makes to an AI assistant connected to the server: reading events to answer a question, creating or changing events, managing calendars. The data is not used for advertising, analytics, profiling, the training of any model by the operator, or any purpose unrelated to the owner's own request.

Where it is kept

The server keeps exactly one piece of Google data permanently: the OAuth refresh token the owner granted, stored in a configuration file on the operator's own computers, on a private network. Access tokens derived from it live in the server's memory for at most an hour. Calendar data itself is fetched when a request needs it, returned, and not retained: the server has no database and keeps no copies of events. Its logs record the time, the address called and the HTTP status of each request, not the contents of any event.

Who it is shared with

Calendar data the server reads is returned to the AI assistant the owner is talking to, as part of the owner's own conversation, where it is subject to that assistant provider's terms; at the time of writing the assistant is Anthropic's Claude. The operator does not sell, publish or otherwise share Google user data with anyone, and does not transfer it to any other party.

Google's policies

The server's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Withdrawing access

The account owner can revoke the server's access at any time at myaccount.google.com/permissions. From that moment the stored refresh token is useless, and it is removed from the server's configuration.

Changes and contact

If this policy changes, the new version is published at this address with a new date. Questions go to the operator at berrymorr@gmail.com.