Privacy Policy

Last updated: October 21, 2026

This Privacy Policy explains what information Ebedorian ("the App", "we", "us") collects, why we collect it, how we store and share it, and how you can have it deleted. Ebedorian is an AI assistant operated by Chaqar LLC that drafts and publishes content at the direction of the person who authorises it.

1. Who we are

Ebedorian is operated by Chaqar LLC. For any question about this policy or about your data, contact ebedorian@gmail.com. This policy applies to the App and to the Google APIs it accesses on your behalf.

2. Google user data we access, and why

We access Google user data only after you complete Google's OAuth consent flow and only for the permissions you approve on that screen. The table below lists every scope the App requests, the data behind it, and the single purpose we use it for.

Google scope	Data accessed	Why we access it
`gmail.modify`	Messages in the authorised mailbox: headers, sender and recipient addresses, subject lines, bodies and attachments; labels and read/unread state.	To read incoming mail you have asked Ebedorian to triage, draft replies to messages you ask it to answer, apply labels, and mark messages read. Actions are limited to mailboxes you explicitly connect.
`blogger`	Your Blogger blog identifier and the posts you ask Ebedorian to create or edit.	To create, save as draft, and publish posts on a blog you own, when you ask it to.
Basic profile (`openid`, `email`)	Your Google account email address and account identifier.	To tell which Google account has authorised the App and to associate the stored authorisation with that account.

We request the narrowest scopes that support the features you use. We do not request access to Google data the App does not need, and we do not read Google data for any purpose other than carrying out a task you asked for.

3. Information you give us directly

Instructions and content you send to Ebedorian through the channels listed on our home page.
Your contact details, when you email us.

4. How we use information

We use the information described above only to:

carry out the specific task you requested — reading, drafting, labelling, or publishing content;
keep the App working and secure — diagnosing errors, preventing abuse, and maintaining audit logs of actions taken on your behalf;
meet legal obligations.

Our use of Google user data is limited to providing and improving the user-facing features you request. We do not use Google user data for any of the following purposes:

targeted, personalised, retargeted, interest-based, or user advertising;
selling or transferring data to data brokers or information resellers;
determining creditworthiness or for lending purposes;
creating databases or datasets for purposes unrelated to the features you request;
developing, improving, or training generalised or non-personalised AI or machine-learning models.

Limited Use disclosure. Ebedorian's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data and we do not use it for advertising. Google Workspace APIs are not used to develop, improve, or train non-personalised AI and/or ML models.

5. AI processing

Ebedorian uses large language models to draft and process content at your direction. When fulfilling your request requires it, the specific content needed for that task — for example the body of an email you have asked Ebedorian to answer — is sent to a model provider over an encrypted connection. That processing is limited to producing the output you asked for. It is not used to train generalised AI models, and it is not retained by us beyond the retention periods in section 7.

6. How we store and protect information

Authorisation tokens are stored on servers operated by Chaqar LLC, in files readable only by the service account that uses them. They are never written to our public website, documentation, or logs.
Encryption in transit: all traffic between Ebedorian and Google APIs, and between our own services, uses HTTPS/TLS.
Encryption at rest: credentials and stored message content sit on encrypted storage volumes, with file permissions restricted to the service accounts that use them.
Access control: access to stored tokens and message content is limited to the automated services that need it to perform your requests, plus a single administrator account.
Logging: we keep operational logs showing that an action occurred, not the contents of your messages.

These procedures exist specifically to protect sensitive data — OAuth credentials, message bodies, and anything else we handle on your behalf. Access is reviewed when personnel or systems change, and credentials are rotated on a scheduled basis.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your data, we will notify affected users and, where required, the relevant authorities.

7. Retention

OAuth tokens: retained while your Google account remains connected. Tokens are deleted when you revoke access or ask us to delete your data.
Message and post content: processed to complete the task you asked for. Draft output is kept only until you publish it, discard it, or ask us to delete it.
Workflow execution records: retained for up to 30 days for troubleshooting and security review, then deleted automatically.
Correspondence with us: retained for up to 12 months.

8. Sharing

We do not sell, rent, or trade your information. We disclose it only in these circumstances:

Google, as necessary to perform the actions you authorise through Google APIs (for example, writing a post to your Blogger blog).
Infrastructure and AI-model providers that host or process data strictly to operate the App, under confidentiality and data-processing terms that prohibit them from using your data for their own purposes.
Legal requirements, where we are compelled by valid legal process, or to protect the rights and safety of our users or others.

We do not transfer Google user data to third parties for advertising, data brokerage, or creditworthiness purposes.

9. Your choices and rights

Revoke access at any time from your Google Account permissions page. Revoking access immediately stops any further use of Google data by the App.
Request a copy of the data we hold about you.
Request deletion of the data we hold about you.
Withdraw consent for future processing at any time.

Send any of these requests to ebedorian@gmail.com from the Google account concerned, or state the account address in your message.

10. How deletion works

When you ask us to delete your data we will:

revoke and delete the stored OAuth tokens for your account;
delete stored message content, drafts, and workflow execution records tied to your account;
confirm completion to you by email.

We complete deletion requests within 30 days. Residual copies may persist in encrypted backups for up to a further 30 days before being overwritten. Data we are legally required to retain is kept only for the period the law requires.

11. International transfers

Ebedorian's servers and its service providers may be located outside your country. Where data is transferred internationally, we rely on appropriate safeguards and require recipients to protect it to the standard described in this policy.

12. Children

Ebedorian is a business tool and is not directed to children under 13. We do not knowingly collect information from children.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above. If we change how we access, use, store, or share Google user data, we will notify connected accounts by email before the change takes effect, and the revised policy will be published on this page.

14. Contact

Chaqar LLC — ebedorian@gmail.com