Privacy & Data Policy

Your data security is paramount. Here's exactly how OpsChaos Scanner works.

🔒 Read-Only Access Only

We request the minimum permissions needed to analyze your operational data. We can never modify, delete, or send data on your behalf.

Google Workspace

gmail.readonly — Read email metadata (sender, timestamp, thread structure). Never reads email body content.
calendar.readonly — Read calendar events (title, description, duration, attendees).
drive.metadata.readonly — Read file metadata (name, owner, folder structure). Never accesses file contents.

Slack

channels:read — List public and private channels.
channels:history — Read message counts and thread structure (not content).
users:read — Read user list for de-duplication.
search:read — Search for mentions of time-tracking tools.

ClickUp

Read-only access to workspaces, spaces, tasks, and custom fields.
Analyzes task lifecycle (created → done), assignees, due dates, and statuses.
Detects presence of time-tracking features.

Notion

Read access to pages and databases you explicitly grant during OAuth.
Analyzes page structure, database properties, and relation usage.
Detects duplicate pages and orphaned content.

⏱️ 72-Hour Ephemeral Storage

✓All scan data automatically deletes after 72 hours.
✓OAuth access tokens are cleared immediately after analysis completes.
✓We never store refresh tokens — one-time access only.
✓Only aggregated metrics are stored, never raw email/message content.
✓You can delete all data instantly at any time using the "Delete My Data" button.

🚫 What We Never Do

✗Read email body content or attachments.
✗Store Slack message content; only counts, timestamps, and thread structure are used.
✗Access Google Drive file contents.
✗Store or share your data with third parties.
✗Send emails, messages, or modify any data in your tools.
✗Use your data for training AI models.

Data Collection & Processing

We collect only aggregated operational metrics: message counts, meeting durations, task completion rates, file organization statistics. We do not store message bodies or file contents. Data is processed in-memory and only aggregated results are stored temporarily.

Data Retention

All session data (tokens, metrics, reports) is automatically deleted 72 hours after creation via an automated background process. You can delete your data instantly at any time by clicking "Delete My Data" on your report page. Once deleted, data cannot be recovered.

Third-Party Services

Aggregated metrics (never raw content) are sent to OpenAI's API for analysis during report generation. OpenAI does not store API input data for training purposes per their API data usage policy. No other third parties receive your data.

Your Rights

•Right to access: View your report at any time before the 72-hour expiration.
•Right to deletion: Instantly delete all your data via the report page.
•Right to information: This policy describes exactly what data we collect and how we process it.
•Right to object: Simply don't connect your tools — no data is collected until you explicitly grant OAuth access.

Cookies & Local Storage

We do not use tracking cookies. We use localStorage only for session management (session ID) and language preference. No analytics or advertising trackers are present.

Changes to This Policy

We will update this page if our data practices change. Last updated: April 2026.