Privacy Policy

## Who this applies to

sergio.nyc is the personal website of Sergio Nahas. Besides its public pages it has private tools (an accounting ledger, a delivery tracker and a daily overview called Today) that only Sergio uses. They are not offered to the public, and no one else can sign in to them.

## Public visitors

Browsing the public pages of this site does not require an account. No personal information is collected beyond standard server logs kept by the hosting provider (such as IP address and browser type), which are used only to operate and secure the site. The site sets no advertising or tracking cookies.

## Google user data we access

The private tools connect to the site owner's own Google accounts through Google sign-in (OAuth). They ask for two permissions, and nothing else:

Gmail, read-only (gmail.readonly). The tools read card and bank alert emails under one Gmail label to keep the owner's accounting ledger, and shipping emails from carriers and retailers to show his deliveries. They never send, change or delete email.

Google Calendar events (calendar.events). The tools read the owner's events from yesterday through the next seven days to show them on Today. They also create, change or delete events that the owner's assistant puts on his calendar at his request. Those events are marked as created by the site, and other events are never changed.

## How the data is used

Google user data is used only to provide these features to the owner: the transactions in the accounting ledger, the delivery list, the calendar on Today, and answers from the owner's personal assistant, which can look up his transactions when he asks it over WhatsApp.

It is not sold, not used for advertising, not used to build profiles, not used to train AI or machine learning models, and not read by people other than the owner, except where needed for security or to comply with the law.

## Storage and sharing

Emails the tools read, the transactions and deliveries taken from them, and calendar events are stored in the owner's private database. The OAuth tokens that keep the connection to Google are stored there too. The database is encrypted at rest by its provider, and all data moves over encrypted connections (HTTPS/TLS).

The data is not shared with anyone, except service providers that host or process it only to run these features: Vercel (website hosting), Neon (database), Render (background jobs) and Anthropic (the AI model behind the owner's assistant, used through its API, which does not train on this data).

## Retention and deletion

Data is kept only as long as it's needed for these personal tools. Google access can be revoked at any time from the Google Account's Third-party apps & services page (myaccount.google.com/connections). After that the tools can no longer read anything new. Stored data is deleted on request, within 30 days.

## Google API Services User Data Policy

The use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

## Changes

If this policy changes, the date at the top of this page changes with it.

## Contact

Questions about this policy or requests to delete data: sergio.nahas@outlook.com