Privacy Policy

Last updated: May 20, 2026

This Privacy Policy applies to the Google OAuth applications hosted at paulxie.com: Code RAG Chatbot and Invoice Parse (collectively, the "Applications"). It describes how the Applications access, use, store, and share information received from Google APIs and from end users.

Summary: The Applications are browser-based demos. When you sign in with Google, the Applications request only permission to call Google's Gemini API on your behalf — no name, email, profile, contacts, or files. Your access token stays in your browser, is sent directly from your browser to Google, and is never transmitted to or stored on any server operated by the developer.

Information we collect

The Applications collect the following Google user data, and only when you choose to sign in with Google:

An OAuth 2.0 access token issued by Google to your browser, scoped to the Gemini API.

The Applications request only these OAuth scopes:

https://www.googleapis.com/auth/generative-language.peruserquota — call the Gemini API on your behalf using your own quota.
https://www.googleapis.com/auth/generative-language.retriever — use the Gemini API retriever feature on your behalf.

The Applications do not request or receive your name, email address, profile picture, contacts, calendar, Drive files, or any other personal information from Google.

The paulxie.com portfolio site itself collects no personal data, uses no analytics, sets no tracking cookies, and has no user accounts.

Use of Google user data

The access token described above is used solely to call Google's Gemini API endpoints from your browser, in response to actions you take in the Applications (for example, submitting a chat message in Code RAG Chatbot, or uploading an invoice image to Invoice Parse). The token is not used for any other purpose.

The Applications do not use Google user data to:

Train, fine-tune, or evaluate any machine learning model.
Serve advertising of any kind.
Determine creditworthiness or for lending purposes.
Sell or transfer the data to data brokers, information resellers, or any third party for those purposes.

Limited Use disclosure

The Applications' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How data is stored and retained

The OAuth access token is stored in your browser's localStorage for the duration of your session.
Tokens are sent directly from your browser to Google's API endpoints. They are never transmitted to, received by, or stored on any server operated by the developer.
Tokens expire automatically (typically within one hour) and can be revoked by you at any time (see "Your rights" below).
If you choose to provide a Gemini API key instead of signing in with Google, that key is also stored only in your browser's localStorage and is sent only to Google.

How data is shared

The Applications share Google user data only with Google itself, by calling Google's Gemini API endpoints on your behalf. No Google user data is shared with the developer, with any analytics provider, with any advertising network, or with any other third party.

The static files for paulxie.com are served by a third-party hosting provider, which may process standard request metadata (such as IP address and user-agent) for the purpose of delivering the site. The hosting provider does not receive Google user data.

Your interaction with Google's APIs is additionally governed by Google's Privacy Policy and the Gemini API Additional Terms of Service.

How data is protected

The Applications are served exclusively over HTTPS. Tokens never leave your browser except when sent directly to Google over HTTPS. Because no server operated by the developer ever receives Google user data, there is no developer-side data store that could be breached.

Your rights

You may revoke the Applications' access to your Google account at any time at myaccount.google.com/permissions.
You may clear your browser's storage for paulxie.com at any time to remove any stored token or API key.
Because the developer never receives or stores Google user data, there is no developer-held data for you to request access to, correct, or delete.

Changes to this policy

Material changes to this Privacy Policy, including any change to how the Applications use Google user data, will be posted on this page with an updated "Last updated" date. Continued use of the Applications after such changes constitutes acceptance of the revised policy.

Contact

Questions about this Privacy Policy or the Applications' handling of Google user data: paulxiep@outlook.com.