Privacy policy

Last updated 2026-10-20. This policy is published by the project's developer, Nick Savov. It covers the DraftYak website and the Google test app DraftYak S8 spike.

This website

This website uses no cookies, analytics, forms, external fonts or embedded outside content. The WebOTP test page is the only page with a script. After you select Start, it asks your browser for a one-time code from an SMS bound to draftyak.com. It sends no SMS and never asks for a phone number. The code is used only in memory to show a fixed result: the page does not display, log, transmit or save it, and drops its references to a returned code when the request finishes. You can cancel the request, and it has a two-minute timeout. Other pages are plain HTML without scripts.

The website is hosted on GitHub Pages, which may log requests (such as IP addresses) under GitHub's own terms. The DraftYak project does not see those logs.

DraftYak, the software

DraftYak is an open-source (Apache-2.0) project in early development, with no release and no hosted service. It collects no data from anyone. Source code: github.com/draftyak/draftyak.

The Google test app: DraftYak S8 spike

DraftYak S8 spike is a short experiment (a "spike") that checks how Gmail handles sent mail, scheduled mail, bursts of requests and revoked access. It runs on the developer's own computer, and only the developer uses it, with one new Gmail account made for this test (not a personal or work account). Google has not verified the app.

Permissions it asks for

Three: sign-in with Google (openid), the account's email address (userinfo.email) and Gmail (gmail.modify, which lets it read, compose and send email).

What it reads

In the test account only: its email address; the IDs, labels, dates and a few headers (such as To, Subject and Date) of its messages; and the text of the test messages the program sent itself, to recognize them. The account is new and holds no real mail.

What it sends

Up to 8 short test emails (normally 2) with plain test text, from the test account to the developer's own other mailbox, plus one that the developer schedules by hand in Gmail.

What it is used for

Only this test. It is not used for advertising, not sold, and not used to train or improve any AI or machine-learning model. The program uses no AI.

Who it is shared with

No one. The program's requests go only to Google's sign-in and Gmail servers, and the project has no server that could receive them.

Where it stays, and when it is deleted

• Sign-in token and the app's credentials: in a file on the developer's computer that is never added to the repository. Deleted at the end of the test session; after that nobody can sign in to the test app.
• Permissions: all revoked with Google by the end of the session, and checked. Deleting the credentials ends any that remain.
• Working notes (the email addresses involved, the test account's name and the IDs of the test messages) and progress logs: in folders on the developer's computer, outside the public repository. Deleted after the results are recorded in the repository.
• Results: one file of measurements in the public repository, such as how many seconds Gmail took to list a message. It holds no token, email address, name or message text, and message IDs in it are one-way hashes. It is kept.
• Test messages: in the test account and the developer's other mailbox until the developer deletes them.
• To remove any app's access yourself: Google Account → Security → Your connections to third-party apps & services.

Google's Limited Use requirements

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Changes and questions

If DraftYak starts to handle Google user data in any other way, this page will be updated first. Questions: open an issue at github.com/draftyak/draftyak/issues (issues are public).