Privacy Policy
mcfiddles inc. · Last updated: 2026-10-16
McFiddles (mcfiddles.ai) is a platform for running AI agents that work on your behalf: they read and answer messages, work with your documents, and carry out tasks you set up and approve. This policy explains what data the McFiddles platform collects, how we use, store and share it, how long we keep it, and how you can remove it. It describes what the platform does today.
McFiddles is in private preview. The McFiddles Browser Relay Chrome extension has its own policy: Browser Relay privacy policy.
Who we are
McFiddles is operated by mcfiddles inc. Questions about this policy or your data: gcp-developers@mcfiddles.ai.
A McFiddles workspace belongs to a customer organization. The workspace's administrators decide which agents exist, which accounts those agents connect to, and what the agents may do. If you write to an agent that a McFiddles customer runs (for example, you email the agent's inbox), that customer controls how your message is used; you can contact them, or us.
What we collect
- Account information: your name, email address and sign-in details. Passwords are stored only as a salted hash. If you sign in with Google, we receive your name, email address and profile picture from Google.
- Content: the messages, conversations, files and instructions you and your agents exchange, the memory an agent keeps between conversations, and your workspace's configuration.
- Data from services you connect: for example Gmail and Google Drive (see Google user data below), Slack, Telegram or other channels, and the credentials needed to reach them.
- Billing information: payments are processed by Stripe. Card details go to Stripe, not to us; we keep the billing records Stripe returns.
- Technical and security data: IP addresses, browser and device details, and audit logs of sign-ins and of the actions agents take.
- Voice: if you use voice features, your audio is sent to the speech provider your workspace uses. Transcripts of calls to a public phone line are kept for 90 days.
How we use data
- To provide the service: run your agents, deliver their messages, and carry out the actions your workspace configures and approves.
- To keep the service secure: authentication, abuse prevention, and audit logs.
- To bill for the service.
- To understand how the product is used, with our own first-party analytics. We use no third-party analytics or advertising trackers.
We do not sell personal data, and we do not use it for advertising.
AI model providers
Agents run on large language models from third-party providers. Your workspace chooses the model each agent uses; the providers McFiddles supports include Anthropic, OpenAI, Google, xAI, DeepSeek, Groq, Mistral and OpenRouter. When an agent works on something, the content it needs (the conversation, and tool results such as an email or a document it read) is sent to that provider to produce the agent's response. The request uses either your workspace's own API key with that provider or ours.
The platform also sends stored content to two providers for features you see in McFiddles:
- OpenAI, on our account, scores the sentiment of stored messages (the first 2,000 characters of each) for conversation analytics.
- Voyage AI computes embeddings of agent memory so agents can search what they remember.
We do not use your content to train or fine-tune AI models.
Google user data
This section describes how McFiddles uses data it receives through Google APIs.
McFiddles' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we access
| When | Google permissions | What McFiddles accesses |
|---|---|---|
| You sign in with Google | openid, email, profile |
Your name, email address and profile picture, to create and sign in to your account. |
| You connect a Gmail mailbox to an agent | https://mail.google.com/, openid, email |
The mailbox's address, and the mail in it, as described below. |
| You connect Google Drive, Docs and Sheets (read) | drive.readonly, documents.readonly, spreadsheets.readonly, openid, email |
Your file list and the files, documents and spreadsheets the agent opens. |
| You connect Google Drive, Docs and Sheets (read and write) | the read permissions plus documents, spreadsheets, drive.file |
The above, and the documents, spreadsheets and folders the agent creates or edits. |
Gmail. Gmail requires the full-mail permission for the mail protocols (IMAP and SMTP) the agent uses. With a mailbox connected:
- About once a minute, the platform reads new unread messages in the folder you choose (Inbox by default), including their full content, delivers each one to the agent as a message in its conversation, and marks it read.
- When your workspace gives the agent these tools, it can search and read messages, archive them, apply labels, and follow a message's own unsubscribe link.
- The agent sends replies from your address only if you turn on automatic replies for that mailbox. Automatic replies are off by default.
- The agent cannot delete mail or move it to Trash or Spam. The platform refuses those operations.
Google Drive, Docs and Sheets. With a read connection, an agent can list your files and read or export them. With a read-and-write connection, it can also create and edit documents and spreadsheets, create folders, and copy, move and share the files it created.
How we use it
We use Google user data only to provide the features you set up and can see in McFiddles: your agent reading, sorting and answering your email and working with your documents as you direct, and the conversation analytics and agent memory described above. We do not use it for any other purpose.
- We do not sell Google user data.
- We do not use it, or transfer it, to serve advertising, including personalized, retargeted or interest-based advertising.
- We do not use it to determine creditworthiness or for lending.
- We do not use Google user data to develop, improve or train generalized AI or machine-learning models, and we do not transfer it to anyone for that purpose.
- People at McFiddles do not read your Google user data unless you ask us to (for example, to help with a support request about a specific message), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or it has been aggregated and anonymized for our internal operations.
How we store it
- Google access and refresh tokens are encrypted at the application layer (AES-256-GCM, with keys protected by Google Cloud Key Management Service) before they are written to our database.
- Emails the agent receives, and content it reads from Gmail or Drive, become part of the agent's conversation and are stored in the McFiddles database. The platform does not keep separate copies of your Drive files.
- McFiddles runs on Google Cloud in the United States (us-central1).
Who we share it with
- The AI model provider your workspace selected, to produce the agent's response, and OpenAI and Voyage AI for the features described in AI model providers. These transfers are only for providing those features.
- Google Cloud, which hosts the platform.
- The people and services your agent writes to on your instructions, for example when it replies to an email or shares a file.
- Anyone else only if the law requires it, or as part of a merger, acquisition or sale of our business after obtaining your explicit prior consent, where the data stays under this policy.
Keeping and deleting it
- Google tokens are kept until you disconnect the account or close your McFiddles account.
- When you disconnect a Gmail mailbox, we revoke the token at Google and then delete our stored copy. When you disconnect a stored Google Drive account connection, we delete our stored token. For a single-agent account binding, we also attempt to revoke the token at Google; that attempt can fail even when the local disconnect succeeds. Disconnecting a shared resource from an agent removes that agent's access but does not revoke the Google account's consent. To revoke Google's consent, use the Google Account link below.
- You can revoke McFiddles' access at any time from your Google Account at myaccount.google.com/permissions. After that, McFiddles can no longer reach your Google data.
- Messages and content already in an agent's conversation stay until your workspace's account is closed and deleted (see How long we keep data), or until you ask us to delete them.
How long we keep data
- We keep account data and conversation content while your workspace's account is open. Messages are not currently deleted automatically on a schedule.
- When a workspace administrator closes the account, there is a 30-day grace period in which it can be restored. After that, the account is scheduled for deletion from the platform's database. We retain a record of the deletion and limited payment-event identifiers, types and timestamps; payment-event payloads are removed. Some operator-only migration rollback records of tool and skill assignments also remain outside the account-deletion process.
- Database backups are kept for up to 30 days (daily backups) and up to one year (monthly backups), so deleted data can remain in a backup until that backup expires.
- Transcripts of calls to a public phone line are deleted after 90 days.
Security
- Data travels over encrypted connections (TLS), including between our services and our database.
- Credentials and OAuth tokens are encrypted at the application layer with keys protected by Google Cloud Key Management Service.
- Access is limited by role, and sign-ins and agent actions are recorded in audit logs.
No system is perfectly secure. If we learn of a breach that affects your data, we will notify you as the law requires.
Cookies
McFiddles uses first-party cookies only:
- a session cookie that keeps you signed in;
- during the private preview, a cookie that remembers your access code;
- short-lived cookies used while you sign in;
- a first-party analytics identifier, kept for up to one year, that we use to understand how people get started with the product.
We use no advertising or third-party tracking cookies.
Your choices and rights
- Access, correction, export and deletion: email gcp-developers@mcfiddles.ai. We respond within 30 days.
- Closing an account: a workspace administrator can close the account in the account settings.
- Disconnecting a service: disconnect it in McFiddles, or revoke access from the service itself (for Google, see above).
Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA, including the right to complain to a data-protection authority.
Children
McFiddles is a professional tool and is not directed to children. We do not knowingly collect data from children under 16.
International transfers
McFiddles stores data in the United States. If you use McFiddles from elsewhere, your data is transferred to and processed in the United States.
Changes to this policy
When this policy changes, we update the date at the top of this page. For a material change, we will tell workspace administrators before it takes effect.
Contact
mcfiddles inc. · gcp-developers@mcfiddles.ai