lemongraph

Privacy Policy

Last updated: September 10, 2026

This Privacy Policy explains how Lemongraph collects, uses and protects your information when you use the application and sign in with Google. Using the app means accepting the practices described here.

Information collected

When you sign in with Google, Google shares information based on the permissions you grant. Lemongraph collects account information:

  • Basic profile information including your name and profile picture.
  • Email address associated with your Google account.
  • Google account identifier used to recognize you on return visits.

Lemongraph runs agents that pursue a piece of work on your behalf over days or weeks, and that requires access to your mail and calendar. With your permission it also accesses:

  • Gmail messages including subjects, message bodies, attachments, labels, and the participants and timestamps of threads. Existing mail is read as well as mail that arrives while an agent is working.
  • Google Calendar events including titles, descriptions, times, attendees and conferencing links, across both past and upcoming events.

Your Google password is never collected. Authentication is handled entirely by Google through OAuth, and the access granted can be revoked at any time.

How your information is used

Account information is used to:

  • Create and secure your account.
  • Authenticate you and keep you signed in.
  • Personalize your experience within the app.
  • Reach you about your account or important service changes.

Your Gmail and Calendar data provides the features the product exists for. An agent reads the mail and events relevant to the work you have given it, so that it can understand what has happened and decide what to do next. Acting on your behalf it will:

  • Send email from your account, including replies within existing threads.
  • Apply labels to messages and archive them.
  • Create, update and cancel calendar events, and invite attendees to them.

Your mail is never permanently deleted, and this is enforced rather than promised. Permanent deletion requires the full Gmail scope. Lemongraph requested gmail.modify instead, which does not include it. See the security page for what else the granted scopes rule out.

Agents also keep a working memory of what they have learned about your workflows, so that they can resume correctly after waiting. That memory is scoped to your account and serves you alone.

Google API Services and Limited Use

Lemongraph’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In line with those requirements, Google user data serves only to provide and improve the user-facing features that are prominent in the app. Google user data is never:

  • Used for personalized or targeted advertising.
  • Sold.
  • Transferred to data brokers or used to determine creditworthiness or for lending purposes.
  • Used to train or improve generalized or non-personalized AI or machine learning models.

Humans do not read your Google user data unless you give affirmative agreement, it is necessary for security or to comply with the law, or the data is aggregated and used for internal operations in line with Google policy.

How information is shared

Your personal information is never sold. Data goes only to the service providers that make the product work, and only to the extent needed to deliver it. These providers are bound by contract to protect your data and to use it only on Lemongraph’s instructions.

Because Lemongraph is an AI product, some of these providers process the content of your mail and calendar:

  • AI model providers receive the message and event content an agent is reasoning about, in order to generate its decisions and replies. OpenAI is the current provider, under an agreement that does not permit your data to be used to train their models.
  • The observability provider receives records of those same requests, so agent behaviour can be debugged and improved. Email addresses, phone numbers, payment card numbers and similar identifiers are removed before these records leave the Lemongraph systems.
  • Cloud hosting and infrastructure providers store your data.

Some providers receive no mail or calendar content at all. When an agent searches the web, the search provider receives only the search terms it composed.

The sub-processor list names each of these providers, what it receives and why. Under a data processing agreement, notice goes out before a provider that processes your content is added.

Data retention

Your information is kept for as long as your account is active. Message bodies and attachments have no separate expiry. They live as long as the account, and deleting the account is what erases them.

You can delete your account yourself from Settings. On confirmation the Gmail and Calendar push channels stop, Google access is revoked, third party credentials are deleted and the account is deleted, all within that request. Everything else follows within a day: jobs, notes, ingested messages and events, agent memory, attachments and traces. Deleted rows can survive in encrypted database backups for up to seven days, which is how long those backups are kept, alongside whatever the law requires to be retained.

Deletion is not reversible. Signing in again with the same Google account gives you a new, empty account rather than the old one.

Your rights and choices

  • You can revoke access to your Google account at any time from your Google account permissions page.
  • You can delete your account and all of its data from Settings, without asking anyone.
  • You can request access to or correction of your personal data by writing to the address below.

Security

Your Google tokens are held in a database with no public address, reachable only from inside the private network. Tenant isolation is enforced by a tenant predicate on every query and covered by tests. The security page covers what an agent can and cannot do with your account, and what is still missing.

No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.

Children’s privacy

The app is not intended for children under 13, and data from them is never knowingly collected.

Changes to this policy

This Privacy Policy may change from time to time. The new version is posted on this page with the date above updated.

Contact

For questions about this policy or your data, write to hey@lemongraph.dev. The website is https://www.lemongraph.dev.