Maxfiylik siyosati

🔹 Google user data (English) Last updated: October 3, 2026 🔹 What we access With your explicit consent we request only these scopes: openid, email and https://www.googleapis.com/auth/calendar.events. We store your Google account email address and the OAuth refresh token needed to keep the connection working. We do not request access to Gmail, Drive, Contacts or any other Google service. 🔹 How we use it We use this access only to provide features you use inside 2-Miya: • to create, update and delete calendar events that correspond to reminders you created in 2-Miya, and to read changes you make to those same events so the bot stays in sync; • to read the titles and times of events in your primary calendar when you ask about your schedule or free time and for your daily summary, so that we can show you your day. These events are read on demand and are not copied into our database; we never modify or delete events that 2-Miya did not create. 🔹 Limited Use 2-Miya's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. 🔹 Sharing We do not sell or rent Google user data, do not use it for advertising, and do not transfer it to third parties, except as needed to show it to you inside Telegram (the messenger through which 2-Miya works) or when required by law. Google user data is not sent to any AI service, and data obtained through Google Workspace APIs is not used to develop, improve or train generalized artificial intelligence or machine learning models. 🔹 Data protection and security We protect Google user data and other sensitive information with the following measures: • Encryption in transit: all data between your device, our servers and Google APIs is transmitted over HTTPS (TLS 1.2 or higher). Plain HTTP requests are redirected to HTTPS and HTTP Strict Transport Security (HSTS) is enabled. The application server is not exposed to the internet directly; it is reachable only through the TLS-terminating reverse proxy. • Encryption at rest: OAuth refresh tokens are encrypted with AES-256-GCM before being stored in our database. The encryption key is kept separately from the database, in the server's environment configuration, and is not included in database backups. Short-lived Google access tokens are never written to disk, and refresh tokens are never shown in any user or admin interface or written to logs. • Access control: access to production servers and the database is restricted to authorized personnel (the service operator) on a least-privilege basis, only to operate, support and secure the service. The admin panel requires a password stored only as a bcrypt hash, limits sign-in attempts and uses signed HttpOnly, Secure session cookies. Each user's calendar is accessed only with that user's own token, and calendar connection links are cryptographically signed. • Data minimization: we request only the scopes listed above (calendar.events, not full calendar access) and store only your email address, the token, and the identifiers of events that 2-Miya created for you. • Monitoring: sign-ins to the admin panel are logged with time, account and IP address. • Incident response: if a security breach affecting your data occurs, we will notify affected users without undue delay through the bot and, where available, by email, and we will take steps to contain and remediate it. 🔹 Retention and deletion • The refresh token and email address are kept only while your Google account is connected. • You can disconnect at any time in the Mini App (Google Calendar → “Uzish” / Disconnect): we revoke the token with Google and delete it from our database immediately. • You can also revoke access at myaccount.google.com/permissions; the token then stops working at once and is removed from our database the next time the service tries to use it. • Messages the bot sends you (for example, a daily summary that may include your event titles) are kept in our message log for up to 90 days and then deleted automatically. • You can delete all of your data at any time with the /malumotlarim command in the bot (“Delete account”); deletion is immediate. You can also email dodash9898@gmail.com and we will delete your data within 30 days. Residual copies in server backups are overwritten within 14 days. 🔹 Contact Privacy questions and data requests: dodash9898@gmail.com or https://t.me/muhriddinorzimatov.