ARMS Gmail — Privacy Policy

Effective date: 1 November 2026

ARMS Gmail is a feature of ARMS, a local-first, open-source AI agent gateway. It connects to your Gmail account so your agents can read, organize, draft, and send mail on your behalf.

Data we access

With your consent via Google OAuth, ARMS Gmail requests Gmail read, modify, compose, and send scopes. It accesses message content, labels, threads, and drafts only to perform the actions you ask your agents to perform.

Where your data lives

Self-hosted / open-source use: your mail data and OAuth tokens stay on machines you control — an encrypted local vault, plus a database you choose (your own MongoDB Atlas or Aiven PostgreSQL). There is no ARMS-operated server in this mode; we cannot see, access, or share your data because it never reaches us.

Cloud tier (if offered): your data is stored per-tenant in isolated databases with per-tenant encryption keys, used only to operate the service.

What we never do

We never sell your data, never share it with advertisers, never use it to train models, and never access more mail than the task you requested requires. Deleted mail is moved to Trash (recoverable for 30 days); ARMS never permanently deletes mail on its own.

Your controls

Revoke access anytime at myaccount.google.com/permissions (this immediately stops ARMS Gmail). Delete local data by removing the ARMS state directory; request cloud-tier deletion by email and we confirm within 30 days.