Natty the Nocrastinator™ — Privacy Policy

Effective date: 2026-09-30 Previous version: 2026-08-28 Operator: JJJJJ Enterprises, LLC ("JJJJJ", "we", "us", "our") Service: Natty the Nocrastinator™, a Google Workspace Add-on for Google Calendar (the "Service")

This Privacy Policy explains what data the Service accesses, how it is used, and with whom it is shared. By installing or using the Service you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, do not install or use the Service.

For most information processed through the Service, you decide which Calendar events to track, what effort level and notes to supply, what reminder channels to enable, what recipients or endpoints to use, and what third-party services to connect. JJJJJ provides the software tool that operates under your Google account credentials. You retain control over the calendar content, milestone schedules, recipients, destinations, integrations, and other processing instructions that you configure through the Service. You remain responsible for determining whether you have the legal right and authority to process the content you select and to send reminders to the recipients, endpoints, and third-party services you configure.

The parties' legal roles may vary depending on the type of information involved, the feature being used, the applicable law, and the specific relationship between you, JJJJJ, Google, and any user-selected third-party service. Nothing in this Privacy Policy is intended to assign a legal role that does not apply under the facts or applicable law. Section 9 describes the roles in more detail.

The Service is designed for individuals, students, professionals, and teams who want to break their own deadlines into milestone reminders, and is offered to organizations under a Business license covering a Google Workspace domain (see Section 3.1). It is not intended for centralized employee monitoring, resale, managed-service deployment, or regulated workflows without a separate written agreement (see Section 10). A Business license does not give an administrator access to any individual's Calendar content, milestones, or settings — Section 3.1 sets out exactly what an administrator can and cannot see. This Privacy Policy applies to the Service, its Google Workspace Marketplace listing, related support communications, and the legal and product pages JJJJJ operates for the Service; it does not apply to other JJJJJ products unless they expressly link to it.

1. Architecture Summary

Natty the Nocrastinator™ runs inside your own Google Apps Script environment, under your own Google account credentials. Your Calendar content, milestone records, settings and credentials reside in PropertiesService.getUserProperties(), which is private to your Google account and script project. You can view and audit everything the Service stores by inspecting UserProperties in the Apps Script editor.

We do not operate any server, database, or backend that receives or stores your Calendar content. That is true on every plan and there are no exceptions to it.

Two narrow, user-initiated exceptions send account-level information — never Calendar content — to a service JJJJJ operates:

Neither exception is enabled by default. Enter no key and the Service never contacts any JJJJJ system at all. Sections 3.1, 5 and 5.3 describe the license check in full.

2. Data We Access

When you use the Service, the following data from your Google account is accessed:

The Service does not read or transmit: - Gmail messages or any email content; - contacts, address book, or Calendar event attendees; - Calendar events you have not opened in the Natty the Nocrastinator™ side panel; - any data from Google Drive, Sheets, or Docs.

3. Data You Provide

3.1 License Validation and Business Licenses

When it happens. Only if you enter a license key in Settings. On the Free plan, and on any installation where the key field is empty, the Service never contacts a JJJJJ system for licensing at all. Entering a key is a deliberate act, in the same way that redeeming a promo code is.

What is sent. Your license key, your Google account email address, and the add-on version. Nothing else: no Calendar event titles, no notes, no alert plans, no milestone records, no API keys or SMS credentials, and no recipient details.

How often. Once when you enter the key, then at most once a day while the key remains in place. The answer is cached in UserProperties, and if the license service cannot be reached the Service keeps using the last answer it received rather than downgrading you.

What we keep. A record of the license, the account addresses that have checked in against it, the add-on version each reported, and when each was last seen. This is used to operate licensing and support — to know a license is live, to count seats against a Business band, and to help you when something goes wrong. It is never used for advertising, never sold, and never shared beyond the subprocessors listed in Section 5.3. Retention is set out in Section 6, and you may request deletion under Section 9.

Business licenses. An organization may license the Service for a Google Workspace domain. Anyone with an email address at that domain is entitled without needing their own key, once one person has entered it. Seats are counted by account address so the organization can be held to the band it purchased.

An administrator of a Business license can see, for their own domain: which account addresses have used the Service, the add-on version each ran, and when each last checked in. An administrator cannot see any individual's Calendar events, milestones, alert plans, notes, settings, SMS recipients or Chat spaces. None of that ever leaves the user's own Google account, on any plan.

Organization-supplied Gemini keys. A Business license may include a shared Gemini API key so that AI features bill to the organization rather than to each person. Three points you are entitled to know plainly:

• When your organization supplies the key, the Service tells you so in Settings. The key spending your AI usage is then not yours, and your own key may be ignored depending on the policy the organization chose.
• The shared key is delivered to your installation so that the add-on can call Google directly. It is therefore readable by anyone the license covers. It is a shared organizational credential, not a secret between JJJJJ and an administrator, and an organization should treat it accordingly — restrict it to the Generative Language API and rotate it as it would any shared credential.
• Your prompts still go straight from your installation to Google. Event titles, notes and alert plans are never routed through, seen by, or stored by JJJJJ, whoever owns the key.

We hold the shared key encrypted at rest and serve it only to installations entitled under that license.

4. Google API Services User Data Policy

The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• The Service only accesses, uses, stores, and shares Google user data for the purposes described in this Privacy Policy and that are necessary to provide or improve user-facing functionality of the Service.
• The Service does not use Google user data for advertising, including retargeting, personalized advertising, or interest-based advertising.
• The Service does not sell Google user data.
• The Service does not use Google user data for generalized AI model training.
• The Service does not allow humans to read Google user data, except (a) with your affirmative agreement, (b) as necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for internal operations where the data has been aggregated and de-identified.
• The Service does not transfer Google user data to third parties except as necessary to provide the Service (Gemini milestone generation, outgoing reminders, and — only if you enter a license key — validating that license), as directed by the user, or as required by law.

4.1 OAuth Scopes and Restricted Scope Status

The Service requests only the OAuth scopes it needs to operate. Each scope is actively used:

None of the scopes used are classified as restricted scopes by Google (the Service does not use gmail.readonly or other restricted scopes). No Cloud Application Security Assessment (CASA) is currently required, and the Service is not subject to the annual CASA cycle applicable to restricted-scope applications. The Service does not request Calendar extended-property scopes, Drive scopes, Sheets scopes, or any Gmail scope.

4.2 Gemini API — Content Handling and Retention

When you generate AI milestones (Pro plan), the Service sends the event title, event type, effort level, and any notes you enter to the Google Gemini API using the API key you supply. This data is governed by Google's Gemini API Additional Terms of Service, not by this Privacy Policy.

The same applies to the in-app help assistant ("Ask Natty," available on any plan once you configure a Gemini API key): the question you type is sent to the Gemini API with your own key, together with the Service's own bundled product documentation as reference material. No Calendar content is added to a help request — only the text you type into the question box. Your most recent question and its answer are stored in UserProperties so the answer survives redrawing the Help card, and are deleted when you press Clear answer, when a new question replaces them, or when you uninstall. Questions are not written to the activity log.

As of the effective date above and based on Google's then-current public representations: - The Gemini paid API does not use your prompts or responses to train Google's generative models. - The Gemini free tier may cache prompts and responses for a limited period, and Google may use free-tier content to improve Google services, consistent with the Gemini API Additional Terms. - Google may log API requests for abuse prevention, debugging, and to comply with law.

Because you supply your own Gemini API key, the data processing relationship for milestone generation is between you and Google under your own Gemini API terms — not between us and Google on your behalf. If your Calendar events contain sensitive information, use a paid Gemini API key (which opts into paid-tier data protections), or use template milestones (which make no Gemini calls). Verify current policy at ai.google.dev/gemini-api/terms.

4.3 Google Workspace Marketplace Compliance

As a condition of being listed on the Google Workspace Marketplace, JJJJJ Enterprises, LLC:

• maintains compliance with Google's API Services User Data Policy and Workspace Marketplace Developer Policies;
• submits to Google's OAuth verification re-review whenever Google requests;
• accepts that Google may, at its sole discretion, suspend, restrict, or revoke the Service's Marketplace listing or its OAuth grants at any time. A Google-initiated suspension will interrupt the Service; we are not liable for interruptions attributable to Google actions beyond the 90-day notice commitment in the Terms of Service § 6.11 for Founding-member lifetime holders.

5. Third-Party Data Sharing

The Service shares data with third-party services only when you explicitly enable the integration. The last two rows are services JJJJJ Enterprises, LLC operates itself; both are inert unless you choose to use them, and neither receives Calendar content.

The Google-native channels (Calendar, Tasks, Chat) do not send data to any third party operated by us — they write to services within your own Google account using your own OAuth credentials.

SMS — controller vs. processor roles. You, not JJJJJ Enterprises, LLC, decide whether SMS reminders are sent, which phone numbers receive them, and which provider delivers them. For purposes of applicable U.S. state privacy laws, you are the controller (or "business," under the CCPA) of any recipient phone numbers you supply. We transmit your data (recipient numbers and milestone text) to the SMS provider you select, acting as a data conduit; the SMS provider processes that data as an independent processor or sub-processor on your behalf, under its own contract with you. See § 5.3 for our subprocessor list.

We do not share any data with analytics services, advertising networks, data brokers, or any party not listed above. No Calendar content — event titles, notes, alert plans or milestone records — is sent to any JJJJJ-operated service on any plan.

5.1 SMS Messaging Consent and Mobile Information — No Sharing

If you provide mobile phone numbers and opt-in information in connection with the SMS reminder channel, no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as the SMS provider you configure to deliver messages, is permitted solely to carry out the reminders you have set up. All other use-case categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties for their own marketing purposes.

The phone numbers and opt-in records associated with the SMS reminder channel are never sold, rented, or shared with data brokers, advertising networks, or any third party for that party's own marketing. SMS reminders are one-way notifications sent only to numbers you explicitly configure in Settings; message frequency varies with the milestones you schedule. Message and data rates may apply. Reply STOP to a message to opt out, or HELP for help; you can also disable SMS at any time by turning off the SMS channel or deleting your SMS provider credentials in Settings. Additional sender obligations are described in our Terms of Service §§ 4.1–4.2.

5.2 Links to JJJJJ Enterprises Related Products

Our website may display links to other products operated by JJJJJ Enterprises, LLC, including emAIl Sentinel™ (a Google Gmail add-on), PilotTrainerHQ (pilottrainerhq.com), and PlaneFacts (planefacts.online). Those products are independent services with their own privacy policies. Visiting those products is governed solely by their respective privacy policies. Natty the Nocrastinator™ does not share your personal data with those other JJJJJ products.

5.3 Subprocessors

A "subprocessor" is a third party that processes personal data on behalf of another processor. The Service uses the following subprocessors:

We will notify registered users at least 30 days in advance before we add or replace a Google-level subprocessor that processes personal data (for example, if we introduce a non-Google model provider as an optional milestone generator in a future release). Notice will be posted at the URL where this Privacy Policy is hosted and, if you have subscribed to a paid plan, emailed to the Google account associated with your subscription. You may terminate the Service, with a pro-rata refund of unused prepaid fees, if you object to a proposed subprocessor change before it takes effect.

5.4 Payment Data

This subsection describes how payment data will be handled once the Service launches paid plans on the Google Workspace Marketplace. During private pre-launch testing (see Terms of Service § 1.1), no paid subscriptions are being offered and no payment data is collected or processed.

At launch: if you subscribe to the Pro plan or purchase the Founding-member lifetime option, your payment will be processed by Google LLC through the Google Workspace Marketplace. We do not receive, collect, or store your credit card number, bank account, or other payment details. Google provides us with limited subscription metadata (a tier entitlement and subscription status) so the add-on can unlock paid features. Google's handling of your payment data is governed by Google's Privacy Policy and the Google Workspace Marketplace terms.

6. Data Retention and Deletion

When you uninstall the add-on, onUninstall() calls deleteAllProperties(), which clears every nocrastinator.* key from your UserProperties — including any license key and the cached license answer.

Uninstalling does not delete the license record held by the license service, because that record is what entitles you if you reinstall, and on a Business license it is the organization's, not yours alone. Ask us and we will delete it; see Section 9.

To explicitly delete all Natty the Nocrastinator™ data: - One event: Open the Calendar event → "Remove All Milestones" — deletes milestone Calendar events, Tasks, and the tracking record for that event. - All data: Uninstall the add-on from your Google account, or, if you are running your own deployment, open Code.gs in the Apps Script editor and run resetUserPropertiesForTesting().

Milestone Calendar events and Tasks already created in your own Google account are real Google items. If you delete the tracking record without using "Remove All," those items remain in your Calendar and Tasks until you delete them yourself.

7. Data Security

• Encryption at rest. All UserProperties values are encrypted at rest on Google's infrastructure (AES-256, Google infrastructure default). The Service does not implement its own encryption layer, and we do not offer customer-managed or bring-your-own encryption keys. For workloads that require FIPS 140-2 validated cryptography, customer-managed keys, or HSM-backed key storage, the Service is not suitable.
• Encryption in transit. All outbound network calls from the Service use HTTPS (TLS 1.2 or higher).
• Credential handling. Your Gemini API key and SMS provider credentials are stored in UserProperties alongside other settings. They are not separately masked in the Settings UI, for usability reasons, so treat the Settings card as sensitive. Credentials are never written to the activity log, and each is transmitted only to the provider it belongs to. On a Business license with an organization-supplied Gemini key, that key reaches your installation from the license service and is then sent only to Google — see Section 3.1, which also explains why a shared key is readable by everyone the license covers.
• Attack surface. No JJJJJ system can read your UserProperties store, and no JJJJJ staff can see your Calendar content, milestones, settings or credentials on any plan. The attack surface is your own Google account, the third-party APIs you configure, and — only if you have opted into them — two JJJJJ-operated endpoints: the promo-validation Web App (Section 3), which receives a promo code and your account email when you redeem, and the license service (Section 3.1), which receives a license key, your account email and the add-on version if you enter a key. Both are inert on an installation with neither a promo redemption nor a license key.
• Operational telemetry. Uncaught exceptions may flow to Google Cloud Logging via exceptionLogging: STACKDRIVER in the add-on manifest so we can diagnose crashes. These logs may include function names, error messages, stack traces, and timestamps. They do not include your Calendar event content, your Gemini API key, your SMS credentials, or recipient phone numbers. Logs are retained per Google Cloud Logging's default retention policy and are accessed only to investigate errors or abuse.
• Cookies and tracking — none. The Service does not set cookies. Our public marketing website does not set cookies, does not use third-party analytics, does not embed tracking pixels, and does not load fonts or scripts from third-party CDNs.
• Certifications. JJJJJ Enterprises, LLC does not currently hold SOC 2 Type II, ISO 27001, HIPAA, or PCI DSS certifications. The Terms of Service § 16 describes the security documentation we make available on request.

7.1 Incident Notification

If we become aware of a security incident affecting data the Service processes on your behalf, we will notify affected users without undue delay — and in any event within 72 hours of becoming aware of the incident where required by applicable U.S. state breach-notification law — via the email address associated with your Google account, and will describe the nature of the incident, the data potentially affected, and the steps you can take.

8. Children and Young Users

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18, or under 13 in the United States as defined by the Children's Online Privacy Protection Act (COPPA). The Service provides no age-gating mechanism; parents, guardians, and educators who allow a minor access to a Google account on which the Service is installed remain responsible for supervising that use.

If we learn that we have collected personal data from a child in violation of applicable law, we will take steps to delete it promptly. Contact legal@jjjjjenterprises.com if you believe a child's data has been collected.

9. Geographic Scope and Your Privacy Rights

The Service is currently offered exclusively to users located in the United States (see Terms of Service § 2). The Google Workspace Marketplace listing is region-restricted to the United States. We do not target the European Economic Area, the United Kingdom, Switzerland, or any other jurisdiction outside the United States, and we do not currently maintain an EU/UK representative, a Data Processing Agreement (DPA), or a Standard Contractual Clauses framework for transfers from those jurisdictions. If we expand availability in the future, this Policy will be updated and existing users will be notified before any cross-border transfers begin.

Your data is processed by Google (Apps Script, Calendar, Tasks, Chat, Gemini API) and, if you enable SMS, by your chosen SMS provider, in the United States and other regions where those subprocessors operate data centers. See § 5.3.

Controller / processor roles. For personal data contained in the Calendar events and milestone configuration you process through the Service (the event title, dates, effort level, notes, any phone numbers you supply as SMS recipients, etc.):

• You are the controller. You determine the purposes and means of processing by selecting which Calendar events to open, what effort level to assign, and which reminder channels to enable.
• JJJJJ Enterprises, LLC acts as a service provider / processor on your behalf, performing the milestone generation and reminder dispatch you directed. We do not independently decide which events to process or where to send reminders.
• Google (Apps Script, Calendar, Tasks, Chat, the Gemini API) and your chosen SMS provider act as subprocessors (or, for SMS providers selected by you, as independent processors under a direct contract between you and them). See § 5.3.

For account-level data (your subscription tier, billing entitlement status received from Google, promo-code redemption records, license records created when you enter a license key, and support correspondence with us) JJJJJ Enterprises, LLC acts as a controller.

For a Business license, the organization holding the license is the controller of the account addresses it licenses, and JJJJJ acts as its processor for the seat and check-in records described in Section 3.1. The organization decides who to license; we count and report seats to it. Neither the organization nor JJJJJ becomes a controller of the individual's Calendar content, which never leaves that person's own Google account.

9.1 Your Rights Under CCPA / CPRA (California Residents)

Notice at Collection (Cal. Civ. Code § 1798.100(b)). At or before the point at which the Service first collects personal information from you — which occurs when you install the add-on and open its Settings card — this Privacy Policy is linked from the add-on Help card and from the Google Workspace Marketplace listing. The categories of personal information we collect, the purposes for which they will be used, the categories of third parties with whom they may be shared, and your CCPA rights are described below and in Section 2 (Data We Access), Section 3 (Data You Provide), and Section 5 (Third-Party Data Sharing).

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the rights described below.

Categories of personal information we process.

Sources. All personal information comes from your own Google account, from the settings, credentials, and event input you enter directly into the Service, from Google (subscription status only), or — where you entered a license key — from your own installation at license check-in.

Business purposes. Milestone generation, reminder delivery via the channels you configure, basic operation of the Service, and subscription entitlement. We do not use personal information for advertising, profiling, or any purpose beyond the Service functions you enable.

Sale or sharing of personal information. We do not sell or share personal information as those terms are defined under CCPA/CPRA, and we have not done so in the 12 months preceding the effective date of this Policy. The Service has no advertising integrations and no cross-context behavioral advertising.

Your rights. - Right to know — request disclosure of the categories and specific pieces of personal information we process about you - Right to delete — request deletion of your personal information (exercise by uninstalling the add-on or emailing legal@jjjjjenterprises.com with "CCPA Request") - Right to correct — request correction of inaccurate information - Right to opt out of sale/sharing — not applicable; we do not sell or share - Right to non-discrimination — we will not discriminate against you for exercising any CCPA right

How to exercise your rights. Email legal@jjjjjenterprises.com with the subject "CCPA Request" and your Google account email address (see Section 13). We will respond within 45 days (extendable by 45 days with notice).

Authorized agents. You may designate an authorized agent to submit a request on your behalf. To verify the agent's authority, we require: (1) a copy of a written permission signed by you (or a valid power of attorney issued pursuant to California Probate Code §§ 4000–4465); (2) a signed declaration under penalty of perjury from the agent confirming their authorization; and (3) confirmation directly from you that you authorized the agent. We may deny an agent's request if the above verification is not satisfied. These requirements do not apply to agents who are attorneys licensed in California acting within the scope of their representation.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their direct marketing purposes; a Shine the Light request will return a "no disclosures" response.

9.2 Residents of Other U.S. States with Comprehensive Privacy Laws

A growing number of U.S. states have enacted comprehensive privacy laws that grant residents rights similar (but not identical) to those granted under California's CCPA/CPRA. These include, as of the effective date of this Policy: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA — our home-state law), Oregon (OCPA), Montana (MTCDPA), Tennessee (TIPA), Delaware (DPDPA), New Jersey (NJDPA), Iowa (IPDPA), Indiana (INPDPA), New Hampshire (NHPA), Kentucky (KCDPA), Maryland (MODPA), Minnesota (MCDPA), Nebraska (NDPA), Rhode Island (RI-DTPPA), and any additional state laws that enter into force after the effective date.

Rights typically available to residents of these states include the right to:

• access / confirm whether we are processing your personal data;
• correct inaccurate personal data;
• delete personal data we hold about you;
• port your personal data in a portable, machine-readable format;
• opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects about you (we do none of these, so the opt-out is automatically satisfied);
• appeal our response to a rights request under laws that provide an appeal mechanism (Virginia, Colorado, Connecticut, Texas, Oregon, and others).

To exercise any of these rights, email legal@jjjjjenterprises.com with your Google account email address and the state under whose law you are making the request. We will respond within 45 days (some states allow an additional 45-day extension for complex requests; we will notify you in writing if an extension is needed). If we decline your request, you may appeal that decision by replying to the response email; we will review appeals within 60 days and, where a state law requires, inform you of your right to contact the state attorney general.

As with CCPA, we do not sell or share personal information, engage in targeted advertising, or conduct automated profiling producing legal or significant effects.

9.3 Do Not Track and Global Privacy Control

The Service does not track users across websites or services and does not respond to Do Not Track signals because it has no occasion to do so. The Service honors Global Privacy Control signals in the sense that it does not sell or share personal information regardless.

10. Not for Regulated or High-Risk Data

The Service is not designed for, and JJJJJ does not hold the Service out as compliant with, HIPAA, PCI DSS, SOX, GLBA, FERPA, or similar regulated-data regimes. Unless JJJJJ expressly approves a particular regulated-data use case in a separate written agreement, the Service should not be used to schedule reminders derived from protected health information, cardholder data, student education records, regulated financial records, children's data, classified information, export-controlled information, or other highly regulated information.

A separate written agreement may permit a specifically approved regulated-data workflow only if the parties have identified the applicable legal and technical requirements and confirmed that the relevant Google configuration, Gemini tier, reminder channels, integrations, security measures, service providers, and contractual protections are appropriate. The availability of such an agreement is not guaranteed and must be determined case by case before regulated information is processed through the Service.

For HIPAA specifically: JJJJJ is not acting as a Business Associate, does not offer a Business Associate Agreement for the Service, and does not intend the Service to be used for PHI. If you are a healthcare provider, health plan, healthcare clearinghouse, business associate, subcontractor, or other party subject to HIPAA, you must not use the Service to track events containing PHI unless JJJJJ has first entered into a separate written agreement that expressly authorizes the specific HIPAA-related workflow and includes any required Business Associate Agreement or other safeguards. The Service is also not a medication-reminder system or any other clinical tool.

You are responsible for choosing which Calendar events to track, disabling inappropriate reminder channels, and ensuring that you do not send sensitive or regulated content to the Gemini API, SMS providers, webhooks, or other third parties without a lawful basis and appropriate safeguards. The Service is not intended to process attorney-client privileged communications, court or statutory docketing deadlines, trade secrets, employment records, personal financial data, government identifiers, biometric data, genetic data, precise geolocation, or other sensitive personal information unless you have independently determined that the use is lawful and appropriate. Treat milestone reminders as potentially containing confidential information — a milestone title derived from an event title may be surfaced on a lock screen, in a shared calendar, or in a Chat space.

11. Business Transactions, Legal Requests, and Protection of Rights

If JJJJJ is involved in a merger, acquisition, financing, reorganization, asset sale, bankruptcy, or similar transaction involving the Service, limited information related to the Service may be transferred as part of that transaction, subject to this Privacy Policy and applicable law. Because JJJJJ operates no backend storing your Calendar content, milestones, settings or credentials, the information available for transfer is limited to account-level records: customer and license records, promo redemptions, and support correspondence.

We may disclose information we hold if we reasonably believe disclosure is necessary to comply with law, respond to valid legal process, cooperate with regulatory requests, enforce our agreements, investigate misuse, prevent fraud or security threats, protect the rights or safety of users or the public, or establish, exercise, or defend legal claims. Any disclosure will be limited to what we reasonably believe is necessary for the applicable purpose.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that reduce your rights or expand the categories of data processed, we will notify you by email to the Google account associated with your use of the Service at least 30 days before the change takes effect. We will obtain affirmative consent where required by applicable law before implementing new uses of your data not described in this Policy. The "Effective date" at the top will reflect the latest revision.

We commit to reviewing this Privacy Policy at least annually.

13. Contact