1. Information We Collect
When you create an account we collect your name, email address, authentication records, and profile information you choose to provide. We also collect data you enter into skills (for example, golf scores, wine notes, recipes, tasks, and health or fitness entries) and limited operational events needed to secure and operate the service.
Google user data
Google connections are optional and separated by feature. If you connect Calendar, MyCrewAI accesses event titles, start and end times, all-day status, locations, and event links so it can show your schedule, find availability, and create events you request. If you connect Gmail, MyCrewAI accesses message identifiers, sender headers, subject headers, dates, unread labels, and snippets from messages matching the inbox search you request so it can display and summarize relevant mail. It can create a draft you request and send that existing draft only after your approval or an autonomy setting you deliberately enable.
MyCrewAI stores an encrypted Google refresh token, a short-lived encrypted access token, the granted scope list, and connection timestamps. Inbox and Calendar query results are processed for the active request and are not copied into the skill database. Email draft text and Calendar event details placed in the approval queue are retained for up to 30 days while pending and up to 7 days after a decision.
2. How We Use Information
We use information to:
- Provide, maintain, and improve MyCrewAI services
- Personalize your experience across skills
- Send transactional emails (account verification, password resets)
- Protect accounts, investigate abuse, and maintain reliable operations
- Analyze product usage that does not include Gmail message content or Calendar event content
We do not use Google user data for advertising, retargeting, lending or credit decisions, data brokerage, or sale. We do not use raw or derived Google Workspace data to train or improve a generalized AI or machine-learning model.
3. Data Storage & Security
Connections use HTTPS in transit. Google OAuth tokens are encrypted at the application layer with authenticated encryption and a server-managed key separate from the database. Access is restricted to the signed-in account and security-relevant actions are audited without copying Gmail or Calendar content into audit logs. No system can guarantee absolute security.
4. Data Sharing and AI Providers
MyCrewAI does not sell Google user data. When you use an AI assistant feature involving Gmail or Calendar, the minimum user-visible fields needed to answer the request may be sent to the model API provider you configured, such as OpenAI, Anthropic, or Google Gemini. Google message, thread, event, and source-link identifiers are removed from model tool results. Workspace tools are disabled unless the service operator has explicitly approved the provider configuration for this data. Providers process this information only to return the feature you requested, subject to their API data-processing terms. We may also disclose limited information to infrastructure providers that host the service, for security, when required by law, or as part of a business transfer with legally required notice or consent.
5. Retention and Deletion
Google OAuth tokens are retained until you disconnect Google, delete your account, or the grant becomes invalid. OAuth authorization transactions expire after 10 minutes. Pending approval content expires after 30 days and decided approval content after 7 days. Operational security logs are minimized and do not retain Gmail or Calendar content.
Disconnecting Google asks Google to revoke the grant and deletes the local token. Account deletion removes personal content, skills, connections, tokens, sessions, memberships, invitations, and identifiers from shared records. If you are the sole owner of a collaborative space, MyCrewAI will first ask you to transfer ownership or delete that space so other participants' data is not destroyed. If Google is temporarily unavailable during account deletion, local credentials are still erased and MyCrewAI directs you to confirm revocation in Google Account permissions.
6. Your Choices and Rights
You may:
- Access, update, or delete your personal data at any time from your account settings
- Connect Gmail and Calendar independently and disconnect Google
- Request a copy of your data by contacting us
- Delete your account, subject to resolving sole ownership of shared collaborative spaces
7. Google API Limited Use
MyCrewAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data is used only to provide or improve prominent user-facing features requested by the connected user. Humans do not read Google user data except with the user's explicit consent for a specific support purpose, when required for security, or when legally required.
8. Cookies
We use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies.
9. Children's Privacy
MyCrewAI is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised date.
11. Contact Us
If you have questions about this Privacy Policy, contact us at support@mycrew.club.