Privacy Policy

1. Scope and operator

Mason is a private, personal-use assistant operated for the condominium board at 537–545 W. Roscoe. It is available only to board members individually authorized by the system operator. It is not a public software service. This policy also covers Board Invoice Archive and its separate Board Invoice Uploader, operated for the same board.

Questions about this policy or Mason’s handling of board data may be sent to 537.545.W.Roscoe@gmail.com.

2. Data access and separate authorizations

Mason’s read-only Google integration

Mason requests only read-only Google OAuth permissions. Depending on use, it may access:

• The authorized Google Account’s email address and basic identity information.
• Gmail messages in received and sent mail, message metadata, complete threads, and attachments.
• Google Drive file names, metadata, folders, and file contents.
• Content from Google Docs, Sheets, and Slides stored in the board’s Drive.

Board Invoice Archive

The separately authorized Board Invoice Uploader requests only https://www.googleapis.com/auth/drive.file. This scope allows access to files selected for or created by the app, rather than all files in the account. The operator selects the exact Invoices destination through Google Picker. The setup verifies folder identity, ownership, and write capability; the uploader reads managed file metadata and content as needed to verify uploads and detect changes.

Uploader software restricts operations to archive folder/file creation and managed-record verification. It does not change sharing, delete, arbitrarily move, or overwrite invoice originals. These limits are enforced by the application; drive.file is not a create-only permission. Mason’s Google authorization is unchanged.

A separate Buildium collector retrieves invoice attachments and transaction information, including journal identifiers, dates, accounting basis, categories, vendors, amounts, and filenames. The uploader receives completed files and their provenance, not the Buildium login or browser session.

3. How Google data is used

Mason uses Google data only to provide board-facing features requested by authorized board members, including:

• Finding governing documents, rules, prior correspondence, decisions, and commitments.
• Answering questions with citations to the board’s source records.
• Tracking open projects, due dates, owners, follow-ups, and supporting evidence.
• Preparing suggested communications for board review without sending or creating Gmail drafts.
• Creating concise board digests after that feature is expressly enabled by the operator.
• Archiving original invoice attachments in year folders with date-prefixed filenames, avoiding duplicate copies of identical file bytes, and linking invoices to supporting transactions.
• Comparing invoice evidence with financial records and board approvals, with source citations and explicit uncertainty where links are unresolved.

Neither service uses Google data for advertising, audience profiling, credit or lending decisions, sale, resale, surveillance, or any unrelated product.

4. Storage and AI processing

Gmail

Gmail is searched live when needed and is not bulk-downloaded or embedded into a search index. Selected messages, threads, or attachments may be retrieved to answer a board request. A specifically requested attachment may be cached in Mason’s private workspace until it is replaced or removed by the operator.

Google Drive

Drive files are mirrored to a privately operated server as originals or Google exports. Text is derived locally for search, including OCR of scanned PDFs. This mirror is a cache, not a backup; Google Drive remains the source of truth.

OpenAI and Telegram

Relevant portions of board requests and retrieved Google content may be sent to OpenAI services to generate responses and search embeddings. Mason’s answers are delivered through Telegram to authorized board members. These providers receive data only as needed to provide those user-facing functions and process it under their applicable terms and account settings.

Separately authorized board communications and scheduled reports may be delivered through Sender to approved recipients. Relevant report or message content is processed by Sender and its email delivery infrastructure for that purpose; this does not grant write access to Gmail.

Invoice files and provenance

Downloaded originals are staged on private persistent server storage. Separate collector inventory and uploader registry files retain content checksums, source observations, transaction relationships, upload status, and Drive file identifiers and links. Daily snapshots support recovery. A sanitized read-only index exposes invoice evidence and citations to Mason, not credentials. Identical bytes share one archived original; different versions remain separate.

Originals are uploaded to the board’s selected Invoices folder under year folders. Existing Drive mirroring and local text extraction, including OCR for supported invoice images and PDFs, make uploaded evidence available to Mason separately from upload completion. Relevant retrieved invoice content may be processed by OpenAI and included in authorized board responses and reports as described above.

Local board records

Mason stores a project ledger, source identifiers, digest state, and limited operational records on privately operated infrastructure. Mason’s Google OAuth credentials are stored in an encrypted keyring separate from the conversational agent. The separate uploader’s OAuth client and refresh credentials are stored as a Kubernetes Secret mounted only into the uploader. The uploader does not store the Google account password or MFA seed. Cluster administrators can access Kubernetes Secrets; this policy does not claim that those Secrets have independently verified encryption at rest.

5. Sharing and human access

Neither service sells Google user data. Data may be disclosed only:

• To OpenAI, Telegram, Google, Sender and its email delivery infrastructure, and hosting providers as necessary to operate the board-facing features described here.
• To board members who are authorized to access the board account and Mason.
• To people granted access to archived originals under the board’s Google Drive folder permissions. The board manages sharing; the uploader does not make files public or change permissions.
• To the system operator when the board requests support or when access is necessary for security, troubleshooting, or legal compliance.
• When required by applicable law.

Both services’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. Retention and deletion

• Current Drive mirror content is retained while the corresponding material remains in the board’s Drive and Mason remains in use.
• When a Drive item disappears from the active inventory, its local mirror becomes a non-searchable tombstone and is purged after 30 days.
• Project ledgers and digest records are retained until the board or system operator removes them.
• Successfully uploaded invoice staging content is eligible for cleanup after 30 days. Pending, failed, or quarantined content is retained for resolution rather than automatically pruned.
• Invoice inventory and registry daily snapshots are retained for 30 days. Provenance and registry records are retained independently of staging-file cleanup until removed by the operator.
• Archived Drive originals are not automatically deleted by the uploader. They remain under the board’s control, including when access is revoked or either service is disabled.
• OAuth credentials are retained until removed by the operator when access is revoked or the corresponding service is decommissioned.

An authorized board representative may request deletion of locally held Google-derived data, invoice staging content, or provenance by contacting the address above. Deleting a local cache does not delete source material in Gmail, Drive, or Buildium.

7. Your choices and controls

The board may revoke either application independently under the Google Account’s third-party access settings. Revoking Board Invoice Archive stops its future authorized uploads, but does not delete archived originals or retained local provenance. The board may also ask the system operator to disable collection or uploading, disable Mason, remove an authorized Telegram user, remove stored credentials, or delete locally stored data.

8. Security

Mason uses read-only OAuth scopes, an encrypted OAuth keyring, access-controlled local storage, restricted network destinations, individually authorized Telegram access, and multiple software-level blocks against Google mutations. No system can guarantee absolute security, but Mason is designed to minimize both access and action authority.

Invoice collection and uploading run in separate restricted workers with separate credentials and network access. Only the Buildium authentication worker receives the Buildium login credentials; the collector receives a session, and the uploader receives neither. Mason receives neither the uploader’s OAuth credential nor Buildium credentials or browser session. The automated invoice workflow does not initiate payments. Application restrictions are safeguards, not a guarantee against administrator access or a compromised system.

9. Changes to this policy

If either service’s access, use, storage, or sharing of Google data materially changes, this policy will be updated before the new use begins and affected users will be asked to authorize the change when required.