This policy covers Rin Google Tasks Connector, the owner-only personal tool maintained by nexost. The public information pages on nexost.io do not connect to Google Tasks or collect task content.
Information the connector handles
- Google Tasks data needed for a request, including list and task identifiers, titles, notes, status, due dates and related metadata. Requested changes are sent to the Google Tasks API.
- The dedicated OAuth client ID and client secret entered by the owner, Google's refresh token, granted scope, and connection timestamps. These keep the authorized connection working.
- A Site-scoped user identifier and the authenticated email supplied by OpenAI Sites, used to check that requests come from the configured owner. This identity check does not request Google email or profile scopes.
- Short-lived authorization state, form-security records and a secure authorization cookie, used to protect setup and sign-in requests.
The app requests only https://www.googleapis.com/auth/tasks. Google authorizes access to the connected account's Tasks data, not just the tasks mentioned in a conversation. No Gmail, Drive, Calendar or Contacts access is requested.
Use and sharing
Google Tasks data is used to provide the owner's requested task features. Results pass through the connector to Rin in ChatGPT, where they may become part of the conversation. Requests and credentials are exchanged with Google as needed for authorization and API calls. OpenAI Sites and Cloudflare provide the hosting, identity and database services involved in this processing.
The connector does not sell task data, use it for advertising, or run generalized model training. ChatGPT conversation retention and other provider processing are governed by the relevant account settings, agreements and provider policies; this policy does not promise provider-wide zero retention or zero logging.
Rin Google Tasks Connector follows theGoogle API Services User Data Policy, including its Limited Use requirements, when using or transferring information received from Google APIs.
Storage and protection
Connection credentials and security records are stored server-side in the connector's Sites-provisioned Cloudflare D1 database. The platform encrypts storage at rest and connections in transit. This is not end-to-end encryption: authorized infrastructure operators and account administrators may access stored information.
Google access tokens are used transiently for API requests and are not saved in the app database. The connector does not cache task content in that database. Its application code does not deliberately log task content, credentials, request bodies or authorization codes. Hosting providers may retain operational metadata and backups under their own policies.
Connection credentials are retained until removed. Authorization state is single-use and valid for ten minutes; form-security tokens are single-use and valid for one hour. Expired security records are cleaned up on later relevant requests, so expiry does not mean immediate physical deletion.
Revocation and deletion
- Use Disconnect Google Tasks on the private connector page. It first attempts to revoke the Google token, then removes the saved connection and associated authorization-attempt records.
- If revocation cannot be confirmed, the app keeps the connection records and reports the problem. Revoke the app yourself in Google account connections, then choose Remove saved credentials only on the private connector page. That button alone does not revoke Google access.
Revoking access in Google does not itself erase the connector's stored client configuration. Removing the local connection does not delete your Google tasks, undo earlier task changes, or erase ChatGPT conversations. Manage those in their respective services. Form-security records and provider backups may remain after connection deletion; no immediate backup-erasure deadline is promised. Revocation invalidates the Google grant even if a backup retains an old token.
Questions and changes
For privacy questions, use the developer support contact shown on the app's Google authorization screen. The maintainer's existing public profile is linked on the nexost contact page. Do not send credentials or task content in a public message. Updates to this policy will appear here with the date below. A new use of Google data requires an updated disclosure and the required consent.