MSA Messages privacy notice

Scope and operator

Cody Carr operates MSA Messages for Montana Summer Adventures. This notice covers MSA Messages and its Gmail connection. It is separate from public inquiry forms, client/file storage and optional screenshot AI. Contact summeradventures406@gmail.com for privacy, access or deletion requests.

Permissions and information collected

The connection uses Gmail read and send permissions. Google's read permission is broader than the interface's Inbox-only view of messages since activation. Manual checks store summaries, addresses, dates, threading identifiers, labels, authentication warnings and sorting results.

An individually confirmed import retrieves one message and stores accepted plain text, up to 24,000 bytes. The Gmail response may contain MIME, HTML or inline parts in transit. The app does not render imported email as HTML, fetch separate attachments or store attachments.

Unreviewed reply text stays in the browser tab. Preparing a review stores the recipient, text and operation state. Sending requires confirmation of that review. Provider acceptance and uncertain outcomes are recorded; uncertain sends are not automatically repeated.

How information is used

Information is used to display and organize MSA guest conversations, prepare owner-reviewed replies, enforce access and usage limits, and prevent duplicate actions. Email content is not used for advertising or sent to AI models. Email instructions cannot authorize account actions.

MSA Messages’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. This statement does not mean Google has verified the application.

Service providers and access

Google supplies authorization and mail transport, Vercel hosts the application, and Supabase stores private records. Saved email records and OAuth refresh tokens are encrypted by the application. This is not end-to-end encryption against administrators.

The authorized account has global Your Biz Buddy administrator authority, although this workflow checks the MSA owner and company. Infrastructure administrators have broader technical authority. Your Biz Buddy support may inspect content only for explicitly authorized troubleshooting; this notice grants no standing support access.

Retention, access and deletion

Saved history is retained indefinitely, with no automatic expiry, including after disconnect. Storage capacity and operational limits still apply.

Send access or deletion requests to summeradventures406@gmail.com. Identity and scope must be verified before fulfillment. Selected-message export and content removal follow a reviewed manual process. Minimal identifiers and operation records may be retained to prevent replay or reconcile unresolved actions; unresolved sends cannot be erased as if they never happened.

Removing selected MSA content does not itself erase original Gmail messages, other client records or provider backups. Those require separate handling. The scope completed and any remaining restrictions will be explained to the requester. No immediate backup erasure or automatic deletion is promised.

Disconnecting

Disconnect disables local connection use before requesting Google revocation. If Google revocation cannot be confirmed, the application reports that uncertainty and local access remains disabled. Saved history is retained.

Removing consent in Google does not erase saved MSA records. Reconnecting does not reset usage. Once the application grant is revoked, a new grant requires authorization rather than silently restoring the old one.