Privacy Policy

This Privacy Policy describes how the google-connector NocoBase plugin ("the Plugin") handles data when users connect their Google accounts. The Plugin is open-source software distributed under the MIT License.

What data we collect

When a user connects their Google account, the Plugin stores the following in the NocoBase database (googleConnections table), encrypted at rest:

The Plugin does not persistently store Gmail message content (subjects, bodies, headers) or Google Calendar event content (titles, descriptions, times, attendees, locations) in the NocoBase database. This data is fetched from Google, processed transiently in memory for the duration of the requested action, returned to the user or AI employee that requested it, and then discarded by the Plugin — it is not written to any Plugin-managed table. Where that data ends up afterward (e.g. an email body summarized by an AI employee, or shown in a chat transcript) is subject to the data-handling and retention behavior of your NocoBase instance and its configured AI provider, not the Plugin itself.

Google OAuth scopes requested

• openid, email, profile — identifies the connected account.
• https://www.googleapis.com/auth/gmail.readonly — restricted scope. Reads email messages and settings, so the AI employee can list the inbox and read an individual message. Grants no ability to alter or delete anything.
• https://www.googleapis.com/auth/gmail.send — sends email on the user's behalf. Send-only: it confers no read, label, or delete authority of its own.
• https://www.googleapis.com/auth/calendar — read and write the user's calendars and events, including shared calendars.

The Plugin requests the narrowest scope set that supports its features. In particular it does not request gmail.modify, which would additionally permit labelling, archiving, marking read, and trashing messages — the Plugin performs none of those actions, so that authority is never requested.

Google User Data Access

Depending on which AI tool is invoked, the Plugin accesses the following Google user data on behalf of the connected user, and only at the moment a user-requested action needs it — data is not accessed in the background or on a schedule:

Gmail data

• Google account email address (for account identification)
• Email messages
• Message bodies / content (plain text and HTML)
• Subject lines
• Sender and recipient (From / To) information
• Message and thread IDs
• Labels (read-only, e.g. to determine read/unread status)
• Other message metadata required for the requested Gmail functionality (e.g. date, snippet)

Google Calendar data

• Calendar metadata (e.g. calendar id, name, access role)
• Calendar events
• Event titles (summary)
• Event descriptions
• Start and end times
• Attendees
• Locations
• Other event information required for the requested Calendar functionality

The Plugin only requests this data when a user (via an AI employee or a Connect Google block action) triggers a specific Gmail or Calendar operation. It does not run background sync jobs and does not pull Gmail or Calendar data without an explicit, user-initiated action.

How Google User Data Is Used

Google user data retrieved by the Plugin is used solely to carry out the specific action the user requested, and for no other purpose. Depending on the feature used, this includes:

• Listing and reading emails, including summarizing their content
• Preparing draft replies
• Sending emails and replies (including threaded replies) on the user's behalf
• Reading message state and metadata (e.g. read/unread, sender, subject, thread)
• Listing the calendars the user has access to
• Reading calendar events, including on calendars shared with the user, to check schedules and availability
• Creating, updating, rescheduling, or deleting calendar events, including inviting or notifying attendees when requested

The Plugin does not modify Gmail labels, mark messages read/unread, or delete emails. This is not merely a matter of the Plugin choosing not to: because it requests only gmail.readonly and gmail.send, the OAuth grant it holds carries no authority to perform those actions at all. Enabling any of them would require requesting a broader scope, re-obtaining user consent, and an update to this policy.

Sharing, Transfer, and Disclosure of Google User Data

• Google user data is not sold, under any circumstances.
• Google user data is not used for advertising, and is never shared with advertising networks.
• Google user data is not shared with unrelated third parties. The Plugin does not transmit Gmail or Calendar data to any service other than those described below.
• When a user invokes an AI-powered feature (for example, asking an AI employee to summarize an email or check their availability), the relevant Gmail or Calendar data retrieved for that request is passed to the NocoBase AI Employee feature (part of NocoBase core) and is then processed by the AI model/provider configured for that NocoBase instance (e.g. an LLM API such as OpenAI, Anthropic, or another provider selected by the instance administrator), solely to generate the response to the user's request.
• The specific AI provider that processes this data depends entirely on how the administrator or user has configured their NocoBase instance — the Plugin itself does not choose or bundle an AI provider.
• Outside of this AI-employee request/response flow, the Plugin itself does not independently send Google user data to advertising networks, analytics platforms, or data-broker services.
• Google user data may also be visible to the NocoBase instance administrator to the extent NocoBase's own logging or audit features capture request content — this is governed by the administrator's NocoBase deployment, not by the Plugin.

Data isolation between users

Every API call is scoped to the individual NocoBase user who initiated the request. The Plugin verifies the caller's identity before each API call and uses only that user's stored tokens. No user can access another user's email or calendar data through the Plugin.

Data storage and security

• The only persistently stored data is the OAuth access token and refresh token (plus the connected account's email address, scope list, and token status) in the googleConnections table, using NocoBase's encrypted field type (AES encryption at rest).
• Gmail messages and Calendar events themselves are never written to this or any other table — see "What data we collect" above.
• OAuth Client ID and Secret are stored in NocoBase Variables & Secrets, separate from application data.
• Transport between your NocoBase server and Google APIs uses HTTPS.
• The Plugin does not log token values or email/event content to application logs.

Data retention and deletion

• User disconnect: Clicking "Disconnect" in the Connect Google block revokes the access and refresh tokens with Google and immediately deletes the corresponding row from the googleConnections table. No Gmail or Calendar content was retained in the first place, so there is nothing further to delete.
• Plugin disable: All stored tokens are revoked with Google and deleted from the database.
• Plugin uninstall: All tokens are revoked and the googleConnections table is dropped entirely.

Your rights

You may revoke the Plugin's access to your Google account at any time:

• Within NocoBase: Use the "Disconnect" button in the Connect Google block.
• Directly with Google: Visit myaccount.google.com/permissions and revoke access.

Third-party services

The Plugin's own code communicates exclusively with Google APIs (accounts.google.com, www.googleapis.com) to authenticate and to make Gmail/Calendar calls — it does not independently contact any other external service. Separately, when an AI-powered feature is used, Gmail or Calendar data needed for that request is passed through NocoBase's own AI Employee feature to the AI model/provider configured in that NocoBase instance, as described in “Sharing, Transfer, and Disclosure of Google User Data” above. That AI provider is chosen and configured by the NocoBase administrator, not bundled by the Plugin.

Children's privacy

The Plugin is not directed at children under 13. It is intended for deployment within enterprise or personal NocoBase instances administered by adults.

Changes to this policy

Material changes will be reflected by updating the "Last updated" date and noted in the GitHub repository's release notes.

Contact

For questions or data deletion requests, open an issue on the GitHub repository.