AVERY READER Privacy Policy

Effective November 10, 2026 · Operated by Heights Legacy Group LLC

Who uses AVERY

AVERY READER ("AVERY") is a private application used by a single person: the Chief Executive Officer of Heights Legacy Group LLC (the "owner"). It connects only to the owner's own Google accounts, with the owner's explicit consent on Google's authorization screen. It is not available to anyone else.

Google data AVERY accesses

• Gmail (read-only): message metadata (sender, recipients, subject, Gmail's short preview, labels and dates) for recent messages, used to identify communications and decisions that need the owner's attention. AVERY does not read attachments or store message bodies.
• Google Calendar (read-only): event times, titles, locations, response status and free/busy status, used to list appointments and detect scheduling conflicts. AVERY does not store event descriptions.
• Briefing delivery: if enabled by the owner, AVERY places its own briefing message into the owner's personal mailbox. It never sends email to anyone else.

How the data is used

• Only to produce the owner's private daily briefing and related alerts: features the owner sees and uses directly.
• Not sold, rented or shared for advertising, and not used for any purpose unrelated to the briefing.
• Not used to create, train or improve any machine-learning or artificial-intelligence model.
• No person reads the owner's Google data, except the owner, or when required for security or by law.

Service providers

• Hosting and database: the application runs on Netlify and stores its operational records in a dedicated Supabase database with access limited to the application's servers.
• AI classification (limited): for a small number of ambiguous business emails, the sender, subject and short preview may be sent to Anthropic's API to classify urgency. Anthropic does not use API data to train its models by default. Personal-account email is classified by rules only and is not sent to an AI service.

Storage, security and retention

• Google authorization tokens are encrypted (AES-256-GCM) with separate keys for each account, and are never written to logs.
• For the personal account, AVERY keeps only message identifiers and one-way fingerprints used to avoid processing the same message twice, not the sender, subject or preview.
• For the business account, message metadata is kept for up to 14 days to track commitments and avoid re-processing, then deleted.
• Briefing text is deleted from AVERY's database within 24 hours after delivery; only counts and cost figures are kept for performance reporting.
• Access to the database is limited to the application's server functions; public access is denied by row-level security.

Control and deletion

The owner can revoke AVERY's access at any time from Google Account → Security → Your connections to third-party apps & services. When access is revoked, AVERY stops reading the account, and its stored records for that account are deleted on request.

Compliance

AVERY's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes and contact

Material changes to this policy will be dated above. Questions: Heights Legacy Group LLC, Office of the CEO.