Privacy Policy — Workspace CLI by EYAL.CC

Effective date: 8 September 2026. Last updated: 8 September 2026.

This Privacy Policy describes how Workspace CLI by EYAL.CC (“the Application”) handles information. The Application is operated by Eyal Avitan, EYAL.CC, Israel (“we”, “us”).

1. Summary

The Application is a command-line tool that runs on the operator’s own computer. It holds no server, no database and no user accounts. It does not collect analytics, it does not profile anyone, and it transmits no Google user data to us or to anyone else. The only party that receives your data is Google, when the Application calls Google’s own APIs on your behalf.

2. Who this applies to

This policy covers the Application only, and no other product or website. It applies to any person who signs in to the Application with a Google Account and grants it permission to act on that account.

3. What data the Application accesses

Only what the authorising Google Account already contains, and only the categories covered by the permissions you approve on the Google consent screen. Depending on the commands used, this may include:

Google Docs, Sheets and Slides — document, spreadsheet and presentation content you name in a command.
Google Drive — file and folder metadata, and file content you name in a command.
Gmail — message metadata and content, when a mail command is run.
Google Calendar and Tasks — events, calendars and task lists.
Google Forms, Keep, Chat and Workspace admin data — where those commands are used.
Basic profile data — the email address and account identifier of the signed-in account, used to label the stored credential.

The specific OAuth scopes requested, and the reason for each, are:

OAuth scope	Classification	Purpose
`auth/documents`	Sensitive	Open, read and edit a named Google Docs document.
`auth/spreadsheets`	Sensitive	Read and write cell ranges in a named spreadsheet.
`auth/presentations`	Sensitive	Read and edit a named presentation.
`auth/drive`	Restricted	Locate a file by name before opening it, and create, move or export files. Docs, Sheets and Slides are stored in Drive, so file-level access is required for any command given a file name rather than a raw ID.
`auth/gmail.modify`	Restricted	Read, search, label and draft mail. `modify` is requested instead of full access because the Application never needs to delete a mailbox or change mail settings.
`auth/calendar`	Sensitive	List, create and update events on the authorising account’s calendars.
`auth/tasks`	Sensitive	Read and write the authorising account’s task lists.
`auth/cloud-platform`	Sensitive	Read which Google APIs are enabled on the authorising account’s own Google Cloud project, reported by `gws auth status` for troubleshooting.
`openid`, `userinfo.email`, `userinfo.profile`	Basic	Identify the signed-in account so the stored credential can be labelled.

The Application never requests access to an account that has not authorised it.

4. How the data is used

Google user data is used for exactly one purpose: executing the specific command the operator has typed. A response is returned to the terminal, or written to a local file if the operator asked for that. The data is not used for advertising, not used to build profiles, not sold, not rented, and not used to train any artificial-intelligence or machine-learning model.

5. Google API Services User Data Policy and Limited Use

Workspace CLI by EYAL.CC’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

Limited use. Google user data is used only to provide or improve the user-facing features of the Application that are prominent in its interface — that is, the command the operator ran and the output it returned.
No transfers. Google user data is not transferred to any third party, except: (a) as necessary to provide or improve those user-facing features, and only with the user’s consent; (b) for security purposes, such as investigating a suspected abuse; (c) where required to comply with applicable law; or (d) as part of a merger, acquisition or sale of assets, and then only after obtaining the user’s explicit prior consent.
No advertising. Google user data is never used for serving advertisements of any kind, including personalised, retargeted or interest-based advertising.
No AI or ML training. Google user data is never used to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models.
No credit or lending assessment. Google user data is never used for determining credit-worthiness or for lending purposes.
No human reading. No human reads Google user data, except: with the user’s affirmative agreement for specific items; where necessary for security purposes; where required to comply with applicable law; or where the data has been aggregated and anonymised for internal operations.

6. Storage and retention

The Application stores, on the operator’s own computer only:

An OAuth refresh token and access token, held in the operating system keychain or in an encrypted file under ~/.config/gws/.
A cache of Google’s public API schema definitions, which contains no personal data.

Google user data itself — the contents of your documents, mail or calendar — is not retained. It exists in the terminal output of the command that fetched it, and in any file the operator explicitly chose to write.

We operate no server, so we hold no copy of your data at any time.

7. Sharing

We do not share Google user data with anyone. There are no third-party processors, no sub-processors, no analytics vendors and no advertising partners. Network traffic goes only to Google’s API endpoints.

8. Revoking access and deleting data

You may withdraw permission at any time:

Run gws auth logout to erase the stored credentials from the computer.
Visit myaccount.google.com/permissions and remove access for this Application. Revocation takes effect immediately.
Delete the ~/.config/gws/ directory to remove every trace of the stored token.

9. Security

Credentials are stored in the operating system keychain where one is available, and in an encrypted file otherwise. All communication with Google uses HTTPS. Because the tool runs locally, its security also depends on the physical and account security of the computer it is installed on.