Privacy Policy
This policy covers Slater, a privately operated, self-hosted AI assistant (“Slater”, “the app”, “we”). It explains what data Slater handles, why, where it is stored, and how it is deleted. It applies to this website and to the assistant application.
1. Who operates Slater
Slater is operated by Darryl Dawkins as a personal, single-user application. It is not a commercial service and has no customers or end users other than its operator. Privacy questions: [email protected].
2. This website
This site is static. It sets no cookies, runs no analytics, and loads no third-party scripts, fonts, or trackers. Standard web-server and CDN logs (IP address, timestamp, requested URL, user agent) are generated by the hosting provider for security and abuse prevention and are retained for a short period under that provider’s policy.
3. Data Slater accesses
Slater works only with data the operator supplies directly, plus data the operator explicitly authorizes through Google:
- Google Calendar (read-only). When the operator connects a Google account, Slater requests read-only calendar access. It may read event titles, start and end times, time zones, locations, descriptions, and attendee display names as needed to describe the operator’s schedule.
- Conversation content. Messages the operator types into Slater, and the assistant’s replies.
- Notes and reminders. Items the operator creates inside Slater.
Slater requests the narrowest Google scopes needed for the features in use. Read-only Calendar access is requested; write access is not.
4. How the data is used
- To answer the operator’s questions and display their own schedule back to them.
- To maintain continuity of the operator’s own notes and conversations.
- For security, debugging, and error diagnosis of the operator’s own instance.
Data is not used for advertising, profiling, or resale, and is not used to train or improve machine-learning models.
5. Google API Services Limited Use disclosure
Slater’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- Google user data is used only to provide or improve the user-facing features described in this policy.
- Google user data is not transferred to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice.
- Google user data is not used for advertising, including personalized or interest-based advertising.
- Google user data is not used to train or improve generalized AI or machine-learning models, and no human reads it except the operator, or where required for security, legal compliance, or with explicit consent.
6. Storage, location, and retention
Slater runs on a server owned and physically controlled by the operator. Access to that server is restricted to the operator and protected by encrypted transport (TLS) and private-network access controls.
- Calendar data is cached only in memory or in the operator’s local database and is refreshed from Google when needed.
- Conversations and notes are retained until the operator deletes them.
- OAuth refresh tokens are stored locally on the operator’s server with file permissions restricted to the operator’s account.
7. Sharing
Slater does not sell, rent, or share personal data. Google user data is not disclosed to third parties, except where the operator directs it (for example by asking the assistant to send a message) or where required by law.
Infrastructure providers process traffic on the operator’s behalf: Cloudflare (DNS, TLS termination for this website and for the encrypted callback endpoint) and, where the operator uses remote models, the model provider that receives only the prompt content the operator submits — never Google account data.
8. Your choices and deletion
- Revoke access: remove Slater’s access at myaccount.google.com/permissions. Slater’s stored refresh token becomes unusable immediately and is deleted when the operator removes it or when Google reports it invalid.
- Delete local data: email the address below and any stored conversations, notes, and cached calendar data will be deleted from the operator’s server. Because the operator is the only user, this is normally done directly.
- Deletion timeline: on request, within 30 days, except records that must be retained for legal or security reasons.
9. Security
Slater uses TLS for all network traffic, keeps credentials out of source code, stores OAuth tokens with restricted filesystem permissions, and exposes only the minimum network surface required. No system is perfectly secure; if you believe you have found a vulnerability, please report it to the contact address.
10. Children
Slater is not directed to children and is not intended for use by anyone under 13 (or the minimum age of digital consent in your jurisdiction). It does not knowingly collect data from children.
11. Changes to this policy
Material changes will be posted on this page with a new effective date. Because Slater has a single user, changes are normally communicated to that user directly as well.
12. Contact
Darryl Dawkins — [email protected]