OpenClaw privacy policy

Scope and operator

This policy covers Abhi Alate’s personal, self-hosted OpenClaw installation and its Google account integration. It does not describe every OpenClaw installation or Google’s own services. This installation is for the owner’s personal use.

Information accessed

Only authorized accounts and granted permissions are used. Depending on that grant and the requested task, information may include:

• Account identity and email address.
• Gmail message content, metadata, and attachments.
• Calendar events, attendees, and scheduling details.
• Drive files and metadata, including Google Docs and Sheets content.
• Contacts and related contact information.
• OAuth credentials and tokens used to maintain the connection.

How information is used

Google data is used to carry out the owner’s assistant requests and configured automations, such as finding messages, summarizing information, managing appointments, and working with documents. Granted write permissions can allow sending messages and creating, editing, or deleting data. Data is not sold, used for advertising, or used to train generalized AI or machine-learning models.

Processing and sharing

OpenClaw runs on the owner’s computer. Relevant task content may be sent to the AI model providers or other services configured for that task, and their processing terms also apply. Depending on enabled integrations, assistant responses may be delivered through the owner’s configured messaging services. When the owner requests an email, invitation, document share, or other external action, the required information is sent to the selected recipients or service. Data is not otherwise shared except as required by law.

Storage, security, and retention

OAuth tokens are stored in the installation’s credential store, such as the macOS Keychain used by the Google CLI. Task content may persist in local assistant history, logs, generated files, and backups, and in configured providers’ records under their retention settings. There is no fixed automatic deletion period for local records; the owner manages retention and deletion. Credentials and account data should not be placed in this public website or its source repository.

Revocation and deletion

The owner can disconnect the app through Google Account connections. Revocation stops future authorized Google access but does not erase previously stored content. The owner can remove local credentials, assistant histories, logs, files, and backups, and use configured providers’ deletion controls where available. Copies sent to recipients or retained in Google services must be managed separately.

Google API Limited Use

This app’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Website visits

These public information pages do not initiate Google OAuth or request access to a visitor’s Google account. The portfolio website includes Vercel Analytics and Speed Insights for website usage and performance measurements; these are separate from the assistant’s Google account connection.

Changes and contact

This policy will be updated when the installation’s data practices change. Questions or deletion requests can be sent to Abhi Alate at abhishekalate91@gmail.com.