Effective 21 October 2026
Privacy Policy
01 · Who we are
Max Praesens is a private software agent, not a company and not a public service. It is operated by, and exists solely for, Jim Panehal ("the operator"). It has exactly one user: the operator. There is no sign-up, no account creation, and no mechanism by which a third party can grant the agent access to their data.
This policy explains what the agent does with information it receives from Google APIs. It is written to be read by a person, not to survive a court.
02 · What we access
The agent accesses Google user data only through Google's official APIs, with the account owner's explicit consent, and only the surfaces needed to perform its work:
| Surface | Data | Purpose |
|---|---|---|
| Gmail | Message headers, bodies, attachments, labels | Read and classify mail, draft replies, send mail the operator has authorised |
| Google Calendar | Events, attendees, availability, reminders | Schedule, move and summarise commitments |
| Google Drive, Docs, Sheets | Files the operator creates or opens with the agent | Draft, format, version and maintain working documents |
| Google Contacts | Names, addresses, organisation | Identify who a message or meeting is from — read only |
The agent does not access Google Photos, Google Pay, location history, browsing history, password manager data, or any Google service not listed above.
03 · How we use it
- To perform the task requested. Reading a message to summarise it, a calendar to find an open hour, a document to revise it.
- To maintain context between sessions, so the operator does not have to restate facts he has already given. This context is stored on the operator's own server, described below.
- To draft. Outbound correspondence addressed to a real counterparty is prepared as a draft and sent by the operator. The agent sends directly only where the operator has authorised a standing instruction.
We do not use Google user data to train machine-learning models, we do not build advertising profiles from it, and we do not use it to determine creditworthiness or eligibility for any purpose.
04 · Limited Use disclosure
In practice that means: data obtained through Google APIs is used only to provide or improve the user-facing features described on this site; it is not transferred to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to the user; it is not used for serving advertising; and it is not read by any human being other than the operator himself, who is the data subject.
05 · Where data is stored, and how
- Location. A single private server operated by the operator, hosted in Amazon Web Services' US West (Oregon) region. No other infrastructure holds Google user data.
- Credentials are stored in files readable only by the agent's operating-system user (mode 0600) and are never written to logs, transcripts or third-party services.
- Message content may be processed in memory by a third-party large-language-model API solely to generate the output requested (a summary, a draft, a classification). We do not use Google user data to train models. How such a provider handles the request is governed by its API terms, which we review before use; a provider is not sent Gmail content where that review is outstanding.
- Transport to Google is over TLS. There is no analytics, advertising or tracking script on this website, and this site sets no cookies.
06 · Sharing and disclosure
We do not sell, rent, trade or otherwise disclose Google user data. We share it only:
- with service providers strictly as needed to run the agent (hosting and model inference, described above), under terms that prohibit them from using it for any other purpose;
- where required by law, subpoena or a binding order, limited to what is legally required;
- to protect against fraud or abuse, or to protect the safety of a person.
There is no other recipient. There is no advertising partner, no data broker and no affiliate network.
07 · Retention and deletion
- Working context derived from Google data is retained only while it is useful to the operator, and is reviewed and pruned.
- Revoking the agent's access stops all further collection immediately.
- On request, all stored data derived from Google APIs is deleted from the server within 30 days, and confirmation is sent by email.
- Backups are overwritten on a rolling cycle not exceeding 90 days.
08 · Your controls
If you are the account owner — which, in practice, means the operator — you can, at any time and without asking anyone:
- Revoke access at myaccount.google.com/permissions. Revocation takes effect immediately.
- Invalidate an application password at myaccount.google.com/apppasswords.
- Request deletion of stored data by emailing the address below.
- Ask what is held. A plain-language inventory will be provided.
09 · Contact
Privacy questions, access requests and deletion requests: maxpraesens@gmail.com.
Postal contact and identity verification are available on request.
10 · Changes to this policy
If this policy changes in a way that affects what happens to Google user data, the effective date above changes and the operator is notified directly. The current version is always at maxpraesens.com/privacy.
11 · Children
The agent is not directed at children and does not knowingly process their data.