Privacy Policy

Last Updated: September 13, 2026

1. Introduction

WinVoice ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how our desktop application processes your information, including your interactions with third-party services like Google and Spotify.

2. Google User Data We Process

To provide user-requested assistant capabilities, WinVoice requests authorized access to your Google account via OAuth 2.0. Specifically, we request the following permissions:

• Gmail (https://www.googleapis.com/auth/gmail.modify, https://www.googleapis.com/auth/gmail.send): To notify you of unread emails, summarize message threads upon your request, and draft or send emails on your behalf based on your direct voice or text commands.
• Google Calendar (https://www.googleapis.com/auth/calendar.events): To verbally remind you of upcoming meetings and schedule, modify, or delete calendar events upon your direct instruction.
• Google Drive (https://www.googleapis.com/auth/drive.readonly): To search for and locate your files and folders on Google Drive so the assistant can reference them when you ask.
• Google Docs & Sheets (https://www.googleapis.com/auth/documents, https://www.googleapis.com/auth/spreadsheets): To read, summarize, query, or update documents and spreadsheets as commanded by the user.
• Google Tasks (https://www.googleapis.com/auth/tasks): To read, create, update, and organize your to-do lists and tasks upon your request.

3. Permitted Use of Google User Data (Strict Limited Use)

WinVoice uses Google user data strictly and exclusively to provide and improve user-facing features and application functionality directly requested by the user.

Specifically:

• Google user data is used solely to execute user-initiated actions (such as sending a voice-dictated email, retrieving calendar agendas, querying files, or managing task lists).
• No Advertising: WinVoice does NOT use or transfer Google user data for serving advertisements, including personalized, retargeted, or interest-based advertising.
• No AI Model Training: WinVoice does NOT use Google user data to train, retrain, fine-tune, or improve generalized machine learning (ML) or artificial intelligence (AI) models. All AI inference is performed locally and ephemerally on the user's hardware.
• No Human Inspection: No human beings are permitted to read or inspect your Google user data unless you provide explicit permission for technical support, it is required for security investigations, or it is required by law.
• No Secondary Uses: Google user data is never utilized for any purpose other than providing the core assistant functionality explicitly invoked by the user.

4. Sharing, Transfer, and Disclosure of Google User Data

WinVoice does NOT share, sell, rent, trade, transfer, or disclose Google user data to any third parties under any circumstances.

• We do not transfer Google user data to third-party advertising networks, data brokers, analytics providers, or external cloud services.
• All Google user data fetched through authorized Google APIs is processed strictly locally on your personal computer.
• We do not employ any external cloud subprocessors or third-party servers to process or store your Google user data.

5. Data Protection and Security Mechanisms for Sensitive Data

WinVoice implements industry-standard technical and operational safeguards to protect sensitive and restricted Google user data:

• Encryption in Transit: All communication between the WinVoice desktop application and Google APIs is encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 and TLS 1.3) cryptographic protocols over HTTPS.
• Encryption at Rest: Google OAuth access tokens, refresh tokens, and user credentials stored locally on your device are encrypted at rest using operating system-level encryption (Windows Data Protection API - DPAPI with AES-256 equivalent), ensuring that only your authenticated Windows user account can access the stored tokens.
• Zero Remote Server Storage: WinVoice maintains no central servers or external databases containing your emails, calendar events, documents, or Google OAuth credentials. Tokens exist only on your local disk, and retrieved content exists only in local system memory during active execution.
• Access Control: Only the locally running WinVoice application process has access to decrypted API tokens. No other applications or remote entities are granted access.
• Data Retention and Deletion: Data fetched from Google APIs is processed ephemerally in memory and is not permanently stored. If you choose to disconnect your Google account or delete your session from the WinVoice settings, all locally stored OAuth tokens and cached data are permanently deleted from your computer immediately.

6. App Preferences & Non-Google Account Data

Any optional cloud synchronization provided by WinVoice is strictly limited to basic application preferences (such as custom keyboard shortcuts and UI theme settings) and account authentication (username and securely hashed password). No Google user data, emails, calendar events, documents, or Google OAuth tokens are ever synced or stored on our cloud servers.

7. User Control & Revoking Access

You maintain complete control over your data at all times:

• You can disconnect your Google account at any time within the WinVoice Settings window, which immediately purges all local OAuth credentials from your device.
• You can revoke WinVoice's access at any time through your Google Account permissions page at https://myaccount.google.com/permissions. Once revoked, WinVoice cannot access any Google APIs or user data.

8. Google API Services User Data Policy Compliance

WinVoice's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us at support.winvoice@gmail.com.