Forge

Privacy Policy

Last updated: May 17, 2026 · Operator: Justin Wiebelhaus · Contact: justin@justinwieb.com

1. Plain-English summary

Forge is a personal automation tool that I, Justin Wiebelhaus, built and run for my own use. It is not sold, not offered to other users, and not part of any company. It accesses my Google account to act as an assistant on my own email, calendar, contacts, YouTube channels, Tasks, and files that it itself creates in my Drive. Nobody else has access to the data Forge sees. This policy explains, in detail, what data is touched, why, where it lives, how long it stays, and how to make it go away.

2. Who runs Forge

• Operator: Justin Wiebelhaus, an individual.
• Location: Austin, Texas, USA.
• Contact: justin@justinwieb.com.
• Forge is not affiliated with Google or with any other company.

3. Whose data Forge accesses

Forge accesses only Google accounts owned by Justin Wiebelhaus. There is no public sign-up, no other authorized users, and no mechanism for any third party to grant Forge access to their data. The OAuth consent flow is only ever completed by the operator on his own accounts.

4. Google API scopes used, and why

Forge requests the following Google API scopes. Each is used solely to provide the assistant features described in the right-hand column.

Gmail

Scope	What Forge uses it for
https://www.googleapis.com/auth/gmail.modify	Read incoming mail to summarize, classify, draft replies, label, archive, and (on request) move messages to trash. Forge does not permanently delete mail.
https://www.googleapis.com/auth/gmail.send	Send mail on the operator's behalf only after the operator has explicitly approved a draft.
https://www.googleapis.com/auth/gmail.settings.basic	Create and manage filters, a vacation responder, signatures, and label settings so the inbox stays organized as the operator's habits change.

Google Calendar

Scope	What Forge uses it for
https://www.googleapis.com/auth/calendar	Read events to describe the operator's schedule; create, edit, and (on explicit request) delete events; find free time for planning.

Google Contacts

Scope	What Forge uses it for
https://www.googleapis.com/auth/contacts	Read and update contacts so the assistant can recognize people in email and calendar context, and add or merge contacts on request.
https://www.googleapis.com/auth/contacts.other.readonly	Read "other contacts" (people the operator has corresponded with but not formally added) so the assistant can identify them in conversation context.

YouTube (operator's own creator channels)

Scope	What Forge uses it for
https://www.googleapis.com/auth/youtube	Manage the operator's channel: read and update video metadata (titles, descriptions, tags), manage playlists, retrieve channel details.
https://www.googleapis.com/auth/youtube.upload	Upload videos to the operator's own channels, always as private or unlisted drafts. Forge never publishes a video without the operator manually setting it public.
https://www.googleapis.com/auth/youtube.force-ssl	Manage comments on the operator's videos (review, reply, moderate), and create or update captions.
https://www.googleapis.com/auth/yt-analytics.readonly	Read view counts, watch time, and audience metrics for the operator's channels to generate weekly performance reports.

Google Drive

Scope	What Forge uses it for
https://www.googleapis.com/auth/drive.file	Create new Docs, Sheets, and other files that Forge itself authors (notes, summaries, reports) and save them to the operator's Drive. Forge can read and update only the files it has created; it has no access to any other Drive content.

Google Tasks

Scope	What Forge uses it for
https://www.googleapis.com/auth/tasks	Read and write items in the operator's Google Tasks lists when the operator wants lightweight task capture outside of Notion.

5. How data is stored and processed

• Where it runs. Forge runs on hardware physically owned and controlled by Justin Wiebelhaus at his home in Austin, Texas. No part of Forge runs on a third-party cloud provider.
• Processing. Google data is fetched on demand, processed in memory, and used to fulfill a specific request (for example, summarize today's email or draft a reply).
• Local persistence. Summaries, metadata, and derived artifacts that the operator chooses to keep (such as a saved email summary, an extracted task, a contact note, or a generated report) may be stored in a private local database that only the operator can access.
• Raw email and document content is not retained beyond what is needed to complete a requested task.
• Encryption at rest. The operator's server uses encrypted storage; the local Forge database sits on encrypted volumes.
• No analytics or tracking on this website or in the Forge tool itself.

6. Third parties and data sharing

• Forge does not sell, rent, share, or otherwise disclose Google user data to any third party.
• Forge does not transfer Google user data to advertising networks, data brokers, or analytics providers.
• To produce natural-language summaries and responses, Forge sends task-relevant text to a large language model provider (Anthropic) under the operator's own account. The operator's contract with Anthropic governs that data; Anthropic does not use the operator's API content to train models.
• Forge does not use Google user data to train any machine learning model.

7. Data retention and deletion

• The operator can revoke Forge's access to any Google account at any time via Google Account permissions. On revocation, Forge can no longer fetch new data.
• The operator can purge the local Forge database at any time, which removes any cached summaries, metadata, or derived artifacts.
• Raw API responses are kept only as long as needed to complete the request that triggered them.
• To request deletion of any Google-derived data held by Forge, contact justin@justinwieb.com. Requests will be honored within seven days.

8. Google API Services Limited Use disclosure

Forge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Forge uses Google user data only to provide the assistant features described in section 4.
• Forge does not transfer Google user data to others except as necessary to provide or improve those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets (none of which apply, since Forge is a personal project with no commercial activity).
• Forge does not use Google user data for serving advertisements, including retargeted or personalized advertising.
• Forge does not allow humans to read Google user data unless the operator has given affirmative consent for specific messages, doing so is necessary for security purposes such as investigating abuse, the data is required to comply with applicable law, or the data is aggregated and used for internal operations and reviewed in accordance with applicable privacy and confidentiality obligations.

9. Security

• OAuth refresh tokens are stored in restricted-permission files on the operator's server, outside of any source control.
• The operator's server is firewalled and only accessible over the operator's private network or via authenticated tunnels.
• All transit to Google APIs and to the LLM provider is over HTTPS / TLS.
• The operator periodically rotates credentials and reviews account permissions.

10. Children

Forge is for the sole personal use of Justin Wiebelhaus, an adult. It is not directed to children, does not collect data from children, and is not designed for use by children.

11. Changes to this policy

Any changes to this policy will be posted on this page with an updated revision date at the top. Material changes will additionally be reflected in the OAuth consent screen when Forge requests new scopes.

12. Contact

Questions about this policy or about Forge's handling of Google data can be sent to justin@justinwieb.com.