Privacy Policy

Last updated: October 13, 2026.

Balabash (balabash.app) is a personal, self-hosted AI assistant. It is operated by a single person for their own use and runs on that person's own server. This policy explains what data Balabash accesses through Google APIs and how that data is used.

Who uses Balabash

Balabash is not offered to the public. The only person who connects a Google account to it is its operator, who connects their own account.

Google user data accessed

When the operator connects a Gmail account, Balabash requests these permissions:

• gmail.readonly — to search and read messages, threads and attachments;
• gmail.compose — to create, update and send drafts and messages.

Balabash does not modify labels, delete or move messages, and does not access other Google services.

How the data is used

Gmail data is used only to carry out the operator's own requests — for example, to find a message, summarize new mail, or prepare and send a reply — and to run checks the operator has scheduled. It is not used for advertising, not sold, and not used to build profiles.

Storage

OAuth tokens and the data Balabash works with — the assistant's conversation history, including excerpts of messages it has read, and attachments it has saved — are stored on the operator's own server. They are kept until the operator deletes them.

Sharing and third parties

Gmail data is not shared with anyone, with one exception: to carry out a request, the relevant content is sent to the AI model providers that power the assistant (Anthropic and OpenAI) for processing. No other transfer takes place.

Limited Use

Balabash's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

Access can be revoked at any time at myaccount.google.com/permissions. After that, Balabash can no longer access the account.

Contact

Questions about this policy: loysagienn@gmail.com.