Privacy Policy

Google workspace Readonly MCP · Last updated 25 August 2026

Who runs this app

Google workspace Readonly MCP is operated by Prateek Bhandari as a private tool. It is not a commercial service and is not offered to the public. Contact: me@prateekbhandari.com.

What the app accesses

When you grant access, the app can read the following, and nothing else. Every permission it requests is read-only.

Permission requested	What it is used for
`drive.metadata.readonly`	Reading file names, types, owners and modified dates in Google Drive, so a specific file can be found by name before it is opened.
`spreadsheets.readonly`	Reading tab names and cell values from Google Sheets nominated by the operator.
`documents.readonly`	Reading the body text of Google Docs nominated by the operator.
`adwords`	Reading campaign and performance reporting from Google Ads accounts the operator already has access to.

The app cannot create, change, delete, move, download in bulk, share, or alter the permissions of anything. It has no write capability of any kind.

Where data goes

The app runs entirely on the operator's own computer. There is no server, no hosted backend, and no database.
Data read from Google is held in memory for the duration of a single task and is used to answer the question being worked on. It is not collected into a store.
The OAuth token issued at sign-in is written to a file on the operator's own machine with owner-only file permissions. It is never committed to version control and never leaves that machine.
No data is sold, rented, or shared with any third party.
No data is used for advertising, profiling, or training any machine learning model.
No human other than the operator reads the data, except where the operator is personally reviewing their own work.

Limited Use disclosure

This app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

The app keeps no copy of your Google data after a task finishes. The only thing retained between sessions is the OAuth token, and only so the operator does not have to sign in repeatedly. Deleting that local token file removes all stored access immediately.

How to revoke access

You can withdraw this app's access at any time, without contacting anyone, at myaccount.google.com/permissions. Revoking takes effect immediately and the app loses all ability to read anything.

Children

This app is not directed at children and is not made available to them.

Changes to this policy

If this policy changes, the revised version will be published on this page with a new "Last updated" date.