Privacy Policy

SULF PROD Promotion · Effective date: September 27, 2026

1. Purpose

SULF PROD Promotion is an owner-operated utility for controlled deployment and verification of Google Apps Script code used by the Personal Finance Management System (SULF).

2. Google user data accessed

The application requests only the Google OAuth permissions required for its deployment workflow:

• basic account identity and email, to verify the authorized deployment account;
• Google Drive metadata read access, to verify the identity and edit capability of bound files;
• Google Sheets read-only access, to verify environment markers and deployment safety conditions;
• Google Apps Script project access, to read bound script projects and, only after explicit authorization, update the production Apps Script project.

3. How Google user data is used

Google user data is used only to authenticate the authorized operator, verify that the correct TEST and PROD resources are targeted, compare source and runtime state, perform safety checks, and carry out an explicitly authorized production deployment.

4. Storage and processing

The OAuth refresh token is stored in Google Secret Manager in the operator-controlled Google Cloud project. Short-lived access tokens are used transiently by the deployment workflow. Deployment checks may transiently process Google resource metadata and Apps Script source on GitHub Actions runners. The application is designed not to publish OAuth credentials or raw Google user data to public repositories or logs.

5. Sharing

Google user data is not sold, rented, used for advertising, or shared for unrelated purposes. Data is processed only by infrastructure necessary to operate the deployment workflow, including Google Cloud, Google APIs, and GitHub Actions.

6. Retention and deletion

OAuth credentials are retained only while required for the deployment workflow and may be rotated or revoked by the operator. Short-lived access tokens expire automatically. The operator can revoke the application's Google Account access and delete stored credentials from Google Secret Manager.

7. Security

The deployment workflow uses a dedicated production identity, restricted Google Cloud permissions, secret isolation, explicit production authorization gates, and readback verification. Secrets are not intended to be stored in source control.

8. Changes to this policy

This policy will be updated if the application's Google data access or processing practices materially change.

9. Contact

Privacy questions may be directed to the developer contact address configured for SULF PROD Promotion in the Google Auth Platform.