Privacy

What this site is

theleases.org is a private website for one household. There are no public accounts and no sign-ups. Only people the household invites can sign in.

Google sign-in

The site uses Google sign-in for two things: putting a family member's school quizzes, tests and due dates on her own Google calendar, and sorting promotions and newsletters out of the household owner's own Gmail inbox (described under Gmail below).

The only permission it asks for is https://www.googleapis.com/auth/calendar.events.owned. Google describes it as seeing, creating, changing and deleting events on the calendars the account owns, which is wider than the site uses. It gives no access to calendars that are only shared with her. What the site actually does with it:

• Before adding a school date, it reads the event titles on her own calendar for that one day, only to see whether the date is already there, so it is not added twice. Those titles are compared in memory and are never stored, logged or shown.
• It adds only its own events to her own calendar, each marked privately as made by this site, and changes the date of an event only when it made that event.
• It never deletes anything, never changes or reads the details of anyone else's events, and never reads or changes any other calendar.

The calendar permission gives no access to email, contacts or files.

What the site stores: a sealed (encrypted) sign-in token, the permission Google granted, and, for each school date it added, the date, its own title and Google's id for that event. This information is not sold, not shared, not used for advertising and not used to train AI models.

The use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Gmail

The household owner can connect his own Gmail, and only his own: the site checks the mailbox's address and refuses any other. It first asks for https://www.googleapis.com/auth/gmail.metadata, which lets it see message headers and labels but never the body of a message, and cannot change anything. Only if he later turns sorting on does it ask for https://www.googleapis.com/auth/gmail.modify, the narrowest permission Google offers for moving mail between labels. Google describes it as reading, composing and sending email, which is wider than the site uses. What the site actually does:

• Each hour it reads the sender, subject and date of new mail that Gmail's own Promotions and Updates tabs caught. It never reads the body of any message.
• Sign-in, verification and security emails, and subjects holding a code, are left alone and never leave the site. The sender and subject of the rest are sent to Anthropic's API (Claude) to judge whether each is a promotion, a newsletter, a receipt or a real person. Anthropic does not train its models on that data.
• Once he turns sorting on, a promotion or newsletter it is sure about gets the site's own Mailroom label and leaves the inbox. Anything it is unsure about stays. It never deletes, trashes, sends, forwards or drafts any email, and never changes Gmail settings or filters.

What the site stores, for 90 days, and never in its backups: for each message it looked at, Gmail's id for it, so it is not read twice. For a promotion or newsletter it sorted, also the sender, the subject and a short line, with any money or code removed. For anything else it judged (receipts, account notices, mail it was unsure about, senders kept in the inbox, anything about money owed or health), only the sender's address. For mail from a real person, sign-in or code emails, and Primary-tab mail it only checked the sender of, nothing but the id. It also keeps a sealed (encrypted) sign-in token, the permission Google granted, and the owner's own per-sender choices. This information is not sold, not shared beyond the judging described above, not used for advertising and not used to train AI models.

The use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Other connected services

The household's own accounts with services such as Spotify, Withings, Kroger, Tesla and Dropbox are connected only by the person who owns each account. They are used only to show that household its own information. Their sign-in tokens are stored encrypted, and each can be disconnected at any time from the site's settings.

How to disconnect

Use Disconnect on the site, or remove the site's access at myaccount.google.com/permissions. Disconnecting deletes the stored token.

How long things are kept

The sign-in token is deleted when the account is disconnected. School dates the site already added stay on her calendar until she deletes them. Mail the site filed stays under its Mailroom label in Gmail, where the owner can move it back; the site's own notes about sorted mail are deleted after 90 days.

Contact

Questions about this page: privacy@theleases.org.