1. Summary
These applications are for strictly personal use. No third-party data is collected, stored or shared with any external entity.
The applications are operated by a single individual, for himself, on his own hardware. They have no users other than their operator, they are not offered as a service, and the data they handle is the operator's own data together with the data of the accounts he explicitly connects to them.
2. Scope
This policy applies to:
- the self-hosted n8n instance that runs personal workflow automation;
- the self-hosted Home Assistant instance that runs home automation;
- the OAuth applications and API credentials the operator creates with providers such as Google, Spotify, Telegram and GitHub in order to let those two instances act on his own accounts;
- this public website and its home page.
3. Information that is not collected
- No account is offered and no visitor registration exists on this site.
- No analytics, advertising, tracking pixels, fingerprinting or profiling are used.
- No personal data is sold, rented or shared for advertising purposes.
- No data of third parties is collected or processed: the applications have no users beyond their operator.
4. Information that is processed
4.1 Credentials and access tokens
To talk to third-party APIs, the instances store the OAuth client credentials and the access and refresh tokens issued by those providers (for example Google). These secrets are used only to authenticate the operator's own requests and are never shared.
4.2 Content the operator chooses to process
When a workflow or an integration is enabled, the instances read and write the data required by that workflow: calendar events, mail metadata and bodies, files, spreadsheet contents, home sensor readings, or similar records belonging to the operator's own accounts. Only the fields a workflow actually needs are requested, and no such content is sent anywhere except back to the provider it came from or to a service the operator explicitly configured.
4.3 Operational logs
The servers keep ordinary operational logs — timestamps, source IP addresses, request paths and user agents — as generated by the web server, the reverse proxy and the applications themselves. These logs exist to keep the services running, to diagnose failures and to detect abuse, and they are rotated automatically.
4.4 Google user data
When the operator authorizes these applications against his own Google Account, the instances may receive Google user data through the scopes he grants, limited to the ones each workflow needs (for example calendar, mail or drive scopes). That data is:
- used only to provide and improve the features the operator himself requested;
- stored only on the operator's own private infrastructure;
- never transferred to a third party except as needed to provide that feature, to comply with applicable law, or as part of a merger or acquisition;
- never used for advertising, and never sold;
- never used to train, fine-tune or otherwise develop machine-learning or artificial intelligence models.
These applications' use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. How the information is used
The processed information is used exclusively to run the automation and home-control features the operator configured for himself, to keep the services secure and available, and to diagnose errors. There is no secondary use, no profiling, no marketing and no automated decision-making about any third party.
6. Where the data is stored and how it is protected
All application data lives on the operator's private, self-hosted infrastructure. Credentials and tokens are stored in the applications' own configuration, reachable only by the operator, transported over TLS, and the servers are hardened and kept patched following documented security baselines. This website is a set of static files: it has no database, no forms and no server-side session.
7. Sharing
Nothing is shared with third parties except: (a) the provider of an API the operator has explicitly connected, in order to perform the operation he requested; and (b) the hosting and DNS providers that serve this static website and resolve its domain name, which necessarily see the traffic they carry. Legal obligations, if they were ever to apply, would also be respected.
8. Retention and deletion
Application data is kept only while it is useful for the workflow that created it, and operational logs rotate automatically. Because everything belongs to the operator, he can delete any stored record — including tokens and cached content — at any time, either from the application interface or by removing it from the host's storage. A request to delete data can also be sent through the contact address below, and it will be actioned as soon as it is read.
9. Revoking access
Access granted to these applications can be revoked at any time from the provider's own consent management page, which immediately invalidates the stored tokens. For Google Accounts, that page is myaccount.google.com/permissions. Revocation stops all future access; the operator may then also delete any cached copy of the data that was already retrieved.
10. Children
These applications are not directed at children and are not intended for use by anyone other than their operator. No data is knowingly collected from children.
11. Changes to this policy
If the way these applications handle data changes, this page is updated and the “last updated” date at the top is changed accordingly. The current version is always the one published at this address.
12. Contact
Questions, or requests to access or delete data, can be sent through github.com/jacanales.