Privacy Policy

1. Scope of this policy

This Privacy Policy applies to Amazon Ops Gmail Alerts, a private operational utility used to send automated email notifications about Amazon Ops Weekly runs. It also applies to this public informational website.

This website is static. It contains no sign-in, form, advertising, analytics script, or application-set cookie. If the site is deployed on Cloudflare Pages, Cloudflare may process standard technical request data as the hosting provider under its own policies.

2. Google user data the application accesses

The application requests only this Google OAuth scope:

This scope is used to send operational alert emails from the Google account authorized by the operator. The application supplies the outgoing message content needed for that alert and submits it through the Gmail API.

3. How Google user data is used

Google authorization is used solely to deliver these Amazon Ops Weekly notification types:

• a successful production run;
• a failed or retryable production run; and
• a condition that requires manual handling.

The application does not use Google user data for advertising, profiling, unrelated communications, or training generalized artificial intelligence or machine-learning models.

4. Credential storage, notification outbox, and production logging

OAuth credentials

The OAuth Client JSON for Amazon Ops Gmail Alerts is currently saved locally under the Windows local application-data area for Amazon Ops. This client configuration identifies the OAuth application, but it is not a Gmail sending token and does not by itself authorize the application to send email.

The OAuth Client configuration does not provide Gmail sending access by itself. A Gmail Alerts sending token is obtained only after an authorized user completes the OAuth flow. When generated, the sending token is stored locally in the Gmail Alerts area and kept separate from the existing Gmail read-only credential. OAuth tokens, client secrets, and credential files are not included in this website, its source files, or its public deployment assets.

Notification outbox

Eligible operational events are written to a local notification outbox before delivery. Outbox items may contain the business period, workflow stage, status, reason code, reason, next step, whether user action is required, and—when applicable—the local report path. The outbox supports duplicate suppression, retry, and manual resolution.

Production logs

Production events are stored as structured local records for operational audit and troubleshooting. The logging policy forbids storing OAuth tokens, secrets, passwords, authorization headers, cookies, Gmail message bodies, and signed URLs. Delivery failure does not alter the recorded result of the Weekly workflow.

5. Data retention

• Production event records: retained for 90 days.
• Successfully delivered notification items: may be removed after 30 days.
• Pending, failed-delivery, and manual-action notification items: retained until sent or manually resolved.
• OAuth Client configuration: retained locally while the Gmail Alerts OAuth application is configured.
• Future sending token: if generated after user authorization, retained locally while authorization is needed and invalidated when the application's Google Account access is revoked.

6. Sharing and transfers

The application does not sell Google user data or share it with advertisers, data brokers, or unrelated third parties.

Only after a user has completed authorization and enabled the notification channel, Amazon Ops Gmail Alerts will submit an outgoing notification through the Google Gmail API for delivery to the recipient email address or addresses configured by that user. A notification may contain the relevant business period, run status, error reason, and recommended handling action. This transfer is performed only to provide the requested operational alert and does not occur before both authorization and channel enablement are complete.

If disclosure is required by applicable law, the minimum information legally required may be disclosed. No such disclosure changes the application's stated purpose or permission boundary.

7. Security practices

The currently saved OAuth Client configuration is not placed in public web files. If a Gmail Alerts sending token is created after future user authorization, it will be stored separately from the production Gmail read-only credential and will not be placed in public web files. Sensitive values are excluded from production logs, and known credential and signed-URL patterns are redacted by the operational logging process.

No method of storage or transmission is completely secure. Access should be revoked promptly if the authorized Google account or the host computer is suspected to be compromised.

8. User choices and control

Authorization is voluntary. An operator can revoke the application's access at any time through the security settings of the connected Google Account. Revocation prevents future Gmail API sends unless the application is authorized again. Operational items that have not been delivered may remain in the local outbox until they are sent or manually resolved under the retention rule above.

9. Google API Services User Data Policy

Amazon Ops Gmail Alerts' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Policy changes and contact

This policy will be updated if the application's data practices materially change. The effective date at the top of this page identifies the current version. Questions about this policy may be directed to the support contact displayed in the application's Google OAuth consent screen.