Data Protection & Security
Orlixea uses technical and workflow controls intended to protect Google authorization data and limit processing to user-requested functionality.
Authorization security
- Google passwords are never requested or stored by Orlixea.
- OAuth access and refresh token records are encrypted before local storage.
- A unique OAuth state value is used to associate an authorization response with the correct Telegram user and expires after approximately 20 minutes.
- Google API requests are sent over HTTPS/TLS.
User isolation
Each connected Google authorization is stored against a unique Telegram user identifier. The bot checks the Telegram user associated with each workflow, keeping one user's stored authorization separate from another user's.
Temporary workflow data
Email drafts and selected YouTube targets are stored only as encrypted temporary workflow state while the user completes a requested action. That state is deleted after completion or cancellation and expires after approximately one hour if abandoned.
Least privilege and production scope
| Scope | Production use |
|---|---|
https://www.googleapis.com/auth/gmail.send | Send only a user-composed, user-confirmed email. |
https://www.googleapis.com/auth/youtube | Subscribe to a selected channel and like a selected video after explicit confirmation. |
Orlixea does not request any additional YouTube OAuth scope and does not implement YouTube comment posting or automated viewing.
Revocation and deletion
Disconnect Google removes the local authorization and temporary state associated with that user and attempts to revoke the Google OAuth authorization. Users can independently revoke access from their Google Account security settings at any time.
AI/ML data handling
Orlixea has no AI/ML integration. Google user data is not sent to any AI/ML provider, model gateway, model aggregator, self-hosted model, or offline model, and is not used for model training, fine-tuning, evaluation, or improvement.
Website privacy
This public documentation site does not include advertising scripts, behavioral analytics, or third-party tracking scripts.
Contact
Security questions: couck1114@gmail.com