Privacy Policy: Workspace MCP

Effective date: 2026-10-21

This policy explains how Workspace MCP ("the tool"), operated by The One Game Studio Limited ("the Studio", "we"), handles Google user data. The tool is for internal use by Studio staff only.

1. Google user data the tool accesses

When a staff member signs in with their Google account and grants permission, the tool can access data in that person's own account through these Google services: Gmail, Google Drive, Google Calendar, Google Docs, Google Sheets, Google Slides, Google Forms, Google Tasks, Google Contacts, Google Chat, Google Apps Script and Google Programmable Search (Custom Search). The tool requests only the access the user approves on the Google consent screen. The data involved is:

• Gmail: email messages and metadata, labels and basic mail settings; the tool can also draft and send email on the user's behalf when the user asks.
• Google Drive, Docs, Sheets, Slides and Forms: files the user opens or creates through the tool, their content, and form responses (read only).
• Google Calendar, Tasks and Contacts: calendar events, task lists and contact entries.
• Google Chat: messages, spaces (including their settings) and space memberships. The tool can read, and when the user asks, post messages and manage spaces.
• Google Apps Script: script projects and their source code, deployments, execution processes and run metrics. The tool can read and update projects and deployments, and run scripts, when the user asks. Scripts may make external requests that the user's own script code defines.
• Programmable Search: search queries the user asks the tool to run through the Custom Search API, and the results returned.

2. Why we access it

The tool accesses Google data only to carry out actions that the signed-in user asks their AI assistant to perform, for example reading an email, searching Drive, posting a Chat message, updating an Apps Script project, running a search query, creating a calendar event or editing a spreadsheet. It has no other purpose.

3. Where data is processed and stored

• OAuth tokens are stored locally on the user's own workstation. No Studio server stores Google user data or tokens.
• Google data is passed to the AI model that powers the user's assistant only as needed to complete the task the user requested.
• Data is not copied into a Studio database, analytics system or data warehouse by this tool.

4. How we use and share data

• We do not sell Google user data.
• We do not use Google user data for advertising, including retargeting, personalized or interest-based advertising.
• We do not transfer Google user data to third parties, except as needed to provide the function the user requested, to comply with applicable law, or as part of a security investigation.
• No human reads Google user data obtained through the tool, except with the user's consent, where needed for security purposes (for example investigating abuse), or where required by law.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.

5. Limited Use disclosure

Workspace MCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention and deletion

The tool does not keep Google user data on Studio servers. Tokens remain on the user's workstation until removed. A user can stop access at any time by:

• revoking the tool's access at https://myaccount.google.com/permissions; and
• deleting the locally stored OAuth token files on their workstation.

To ask about deletion of any data, contact us at the address below.

7. Security

Tokens are kept in files on the user's own machine, readable by that user's account. Communication with Google APIs uses HTTPS. Staff are expected to protect their workstations and to revoke access if a device is lost.

8. Changes

We may update this policy. The effective date above shows the latest version. Material changes to how Google user data is used will be reflected here before they take effect.

9. Contact

The One Game Studio Limited, Unit 2202, 22/F., Causeway Bay Plaza I, 489 Hennessy Road, Causeway Bay, Hong Kong. Email: tuha@the1studio.org.