Account privacy.

Google sign-in supplies your verified email, name and Google account identifier. Polywinkle uses these to create and secure your account and authorize access to services you request. We do not request Gmail, Drive or contacts access, and do not retain Google access or refresh tokens.

Account records remain until you request deletion. Web sign-in sessions expire within 16 hours. Connected desktop apps use one-hour access tokens and rotating refresh tokens with a maximum lifetime of 30 days; only verification hashes are stored. You can revoke those sessions using Sign out everywhere on your account page. Sign-in challenges expire after five minutes; one-use Security transfers expire after one minute. Essential secure cookies keep you signed in. Security request logs are retained for up to 180 days and security actions are audited.

We do not sell Google account data, use it for advertising, transfer it to data brokers or use it to train AI. Access is limited to operating and securing your account and complying with applicable law. Google data use follows the Google API Services User Data Policy, including its Limited Use requirements. Payment information is handled separately by the payment provider; Google account data is not supplied for payment processing.

Contact [email protected] to request access, correction or deletion. You can also remove Polywinkle access through your Google account settings.