OpenAgent privacy
Updated: 22 October 2026.
OpenAgent is a modular AI agent runtime and a standalone client/server product. Its official connectors let an authorized agent work with services such as Gmail, Google Drive, Google Analytics, Shopify and ClickUp. The same connector library can be embedded in independent host products.
Service contact: AI Agent, the commercial name used for the OpenAgent connector service. For support, privacy questions or requests concerning that service, email geroale2000@gmail.com.
What this notice covers
This notice describes the OpenAgent website, standalone product and shared authentication service at auth.openagent.uno. Each receiving product's operator controls its own server, user accounts, connection permissions and stored content. For any independently operated host installation, also consult that operator's privacy notice. A product appearing in the authorization disclosure is the intended recipient; its name does not mean OpenAgent endorses it.
Common OAuth enrollment is available as a limited beta for the profiles and operations recorded in the qualification status. Google's external app is published with verified Branding, but its data access remains unverified and subject to the observed 100-user cap; Google remains an explicit host opt-in. Its unlisted demonstration video is uploaded and Google has confirmed data access is in review. Approval and the security assessment required before approval are not complete. Publication, branding and bounded account trials do not qualify every receiving product, operation or data-processing configuration. Existing connections using a product's own app continue under that registration.
Information accessed and why
The connector you select requests permission to perform its listed functions. Depending on your authorized scopes and local tool permissions, Gmail can access messages, threads, attachments and drafts or send messages; Drive can access file metadata and content or perform permitted file operations; Analytics reads reports and account/property metadata. Shopify and other connectors access the resources described in the connector catalog. Token-based connectors use credentials supplied to the receiving server.
This information is used to carry out the agent tasks and automations you authorize. Depending on the explicit connection profile, API calls run on your receiving server or on the shared connector service described below. Connecting a service does not itself authorize every agent or every write operation; the product's access controls still apply.
Where information is processed
OpenAgent supports two distinct connector profiles. The setup disclosure and receiving product identify the selected profile; an existing connection does not silently change profile.
Local execution with the legacy shared OAuth broker: the authentication service handles consent, authorization-code exchange and renewals requiring the app secret. In this profile the broker processes tokens during these operations without maintaining a permanent token archive. The receiving product stores its credentials and makes ordinary provider API requests from its own server; their email, document, store and task response content does not transit the broker. In the standalone product, credentials are encrypted at rest and bound to the local owner, tenant and receiving installation.
Central execution (openagent-connectors-central/v1): the shared service keeps access and refresh tokens in its encrypted credential vault and performs the selected provider API operations. The receiving product receives an opaque connection handle and authorized results, rather than reusable provider tokens. Requested searches, message or resource identifiers, draft or send payloads and selected response content—including Gmail messages, threads and attachments when Gmail is admitted—therefore pass through the shared service. The connection is bound to the authenticated receiving installation and its recipient scope; the host is responsible for its current user, workspace, agent and operation permissions. Provider content is not retained as a durable invocation replay cache, although the receiving product may retain returned results. Service operation and infrastructure can produce request metadata as described below.
The central public catalog separately declares which connectors are available. As of this update, Gmail is not generally enabled in that catalog. A restricted operator-reviewed Gmail qualification lane is not public approval or evidence that all receiving products are qualified. A new central consent must explicitly disclose this credential custody and processing path; existing local tokens are not silently imported or relabelled as centrally authorized.
Provider tokens, authorization codes and raw provider response bodies must not be included in application logs. Agent sessions, memory, files, audit records and tool results may be retained by the receiving product according to its enabled features and storage configuration. Neither profile moves those local stores into the shared connector service.
When an agent uses connected content in a model request or an authorized tool action, that content can be sent to the model provider or destination configured for that task. A self-hosted server does not automatically make an external model local. Review your model configuration, enabled memory features, authorized tools and the receiving product's privacy information before providing sensitive content.
Shared service credentials and metadata
The shared service retains installation public identities, consent and authorization metadata, and authorized Shopify recipient associations. Central execution additionally retains encrypted provider credentials, connection/recipient bindings, admitted operations, credential grant revisions and minimized invocation outcome metadata. The vault is service-operated storage, distinct from the receiving product's databases. For the legacy Shopify profile the service also retains credential versions and fingerprints used to coordinate rotation, plus a durable queue of minimized, encrypted privacy and uninstall notifications. Fingerprints identify a credential generation; they cannot recover the token.
In the legacy credential-delivery profile, encrypted messages are addressed to one authorized installation and expire within ten minutes. Tokens remain with receiving servers; a server that misses a delivery can request a current copy from an authorized peer or require new consent if no current copy is recoverable. That delivery mechanism does not describe the central vault profile. Privacy notifications are acknowledged and deduplicated so an offline recipient can process them later.
Installation, authorization and delivery records are retained for operation, recovery, revocation and handling privacy requests. This release does not provide a universal fixed deletion period for that metadata or for independently operated product databases. Contact the service or the receiving product's operator to request removal of records they control. Disconnecting a connector is not a deletion request for existing agent history, files, backups or provider data.
Google user data
The intended use of Google data is limited to the user-facing connector tasks you authorize. OpenAgent's common Google app is not offered for advertising, sale of Google user data, credit decisions or training a generalized AI model. Embedding products and configured model providers must meet the applicable Google data-use restrictions before common-app access can be activated.
The Google API Services User Data Policy, including its Limited Use requirements where applicable, governs this integration. Publishing this notice does not establish verification or security-assessment completion. Google restricted-scope approval, recipient data-handling checks and the applicable security assessment remain release gates for the common app.
Revocation, deletion and privacy requests
Use Disconnect from this server to remove a product's connection. For central execution, disconnect disables that exact central handle and removes its usable token material from the active vault state; it does not claim erasure of every historical backup or provider-wide revocation. A legacy local connection follows its receiving product's local credential-removal flow. Revoking or removing the app in the provider's settings can affect all products connected through that app. None of these actions automatically deletes previously stored agent content, provider objects or the receiving product's backups.
For access, correction, export or deletion of data held by your receiving product, contact its operator. For OpenAgent's shared service, contact geroale2000@gmail.com, identifying the provider and receiving installation where possible; do not send tokens, passwords or other secrets. Requests may require verification of your authority over the relevant installation or account. Self-hosted administrators also control their local storage and backup retention.
Shopify privacy notifications are delivered to the authorized receiving products, which carry out actions on their own data. Server beta51 explicitly supports authenticated version-two receipts, including the original provider occurrence time and authorization-generation cutoff, with qualified processing for a fresh canonical text-history cohort. Configuration alone cannot attest that coverage. Historical content, media, Vault/files and other unqualified surfaces remain blocked.
General Shopify enrollment remains disabled. Bounded two-host lifecycle trials and synthetic privacy tests are recorded with their exact versions in the qualification status; synthetic notifications do not qualify genuine provider delivery or real-customer erasure. The dated beta50 trial also covers expiry and recovery. The genuine provider uninstall reached the broker and compatibility receiver, while native processing exposed a host ordering defect. The beta51 correction received and processed that same event on both already-disconnected profiles, with durable single records retained after restart; it does not establish event-caused credential erasure. Delayed provider obligations and same-app legacy-issuer handoff remain separately tracked there. An older direct issuer of the same app/shop must not race the shared broker. Existing grants are not silently reassigned or imported, and previously granted scopes must be preserved during an explicit migration.
Website and changes
The public website is hosted through GitHub Pages; the authentication service uses separate operator-managed infrastructure. Their hosting providers may process request metadata such as IP addresses and browser information to deliver and protect the services. This notice does not assert that infrastructure request logs have a particular retention period.
We update this page when the published data handling changes. Check the date above and the receiving product's own notice when reconnecting or enabling new capabilities.