Privacy Policy
Orlixea is a Telegram-based application that allows users to connect their own Google account through Google OAuth 2.0 and perform specific actions they explicitly request. This Privacy Policy explains what information Orlixea accesses, why it is used, how it is protected, how long it is retained, and how users can delete it.
1. Google data and permissions we access
Orlixea requests only the Google OAuth scopes required for its current production features:
| OAuth scope | Purpose | What Orlixea does not do |
|---|---|---|
gmail.send | Send an email only after the user enters the recipient, subject, and body and explicitly confirms the send action. | Does not read the Gmail inbox, messages, contacts, labels, or mailbox history. |
youtube | Subscribe to a user-selected YouTube channel and like a user-selected video, each after explicit confirmation. | Does not post comments, generate video views, perform bulk engagement, or perform background/incentivized engagement. |
2. Information processed by Orlixea
- Telegram user identifier: used to keep each user's authorization and workflow state separate.
- Google OAuth tokens: access and refresh tokens issued by Google after the user grants consent.
- Temporary action data: information needed to complete a user-requested action, such as email recipient/subject/body, a selected YouTube channel, or a selected video.
- OAuth state value: a short-lived anti-forgery value used to securely match the Google authorization response to the correct Telegram user.
Orlixea does not request, collect, or store the user's Google password.
3. How information is used
Information is used only to authenticate the user's Google connection, complete the specific action requested by that user, maintain an authorized connection when necessary, and allow the user to revoke that connection.
4. Data protection and security mechanisms
- Encryption at rest: OAuth token records and temporary workflow state are encrypted before local storage on the application host.
- Encryption in transit: communication with Google OAuth and Google APIs uses HTTPS/TLS.
- Per-user separation: authorization records are associated with the individual Telegram user identifier, preventing one user from using another user's stored authorization.
- Private-chat operation: Orlixea is designed to perform account-management workflows in private Telegram chats.
- Least privilege: Orlixea requests only the two OAuth scopes listed in this policy for its production features.
- No advertising or tracking use: Google user data is not used for advertising, behavioral profiling, or unrelated analytics.
- No AI/ML integration or training: Orlixea does not integrate with, transmit Google user data to, or otherwise use any third-party, hosted, self-hosted, or offline artificial intelligence or machine-learning service. Google Workspace or other Google API user data is never provided to AI/ML providers and is never used to create, train, fine-tune, evaluate, or improve general-purpose or personalized AI/ML models.
5. Retention
- OAuth authorization: encrypted authorization data is retained while the user keeps their Google account connected so that user-requested features can continue to work.
- OAuth connection state: expires after approximately 20 minutes if the connection is not completed.
- Temporary action state: is deleted after completion or cancellation and expires after approximately one hour if abandoned.
6. Data sharing and sale
Orlixea does not sell Google user data. Google user data is not rented, shared for advertising, or disclosed to unrelated third parties. Data is transmitted to Google APIs only as necessary to perform the authenticated user's requested action. Messages sent through Telegram are also subject to Telegram's own platform terms and privacy practices.
7. Artificial Intelligence and Machine Learning
Orlixea does not use or integrate with any artificial intelligence or machine-learning provider. No raw, aggregated, anonymized, or derived Google Workspace or Google API user data is transferred to OpenAI, Google Gemini, Anthropic, Microsoft, Meta, Hugging Face, model gateways, model aggregators, or any other AI/ML service. Orlixea does not operate a self-hosted or offline AI/ML model that processes Google user data.
8. User control, revocation, and deletion
Users can choose Disconnect Google inside Orlixea at any time. Orlixea then attempts to revoke the Google OAuth token and deletes the locally stored authorization record, pending OAuth state, and temporary workflow state associated with that Telegram user. Users may also revoke Orlixea directly from their Google Account security settings.
View detailed data deletion instructions →
9. Google API Services User Data Policy
Orlixea's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
10. Changes to this policy
If Orlixea materially changes the Google data it accesses or how that data is used, this policy will be updated before the changed functionality is made available.
11. Contact
Privacy and verification questions: couck1114@gmail.com