Privacy policy

Information accessed

With the owner's authorization, KessWin accesses the configured Gmail account's address and mailbox history, message identifiers, sender and recipient headers, authentication results, dates, subjects, snippets, and message bodies. Those reads can include unrelated mail encountered while identifying relevant messages. The monitoring adapter does not download separate attachment contents.

The application also uses the owner's configured entrant details and preferences, public organizer information, entry records, and Telegram decisions. Entrant details are supplied to organizers only for the relevant authorized entry or prerequisite.

Gmail permissions and actual operations

The background monitor uses the Gmail read-only permission, gmail.readonly. A separate owner-authorized connection requests full mailbox permission, https://mail.google.com/, for the same account. Google describes that broader permission as allowing mailbox reading, sending, editing, and deletion.

In the implementation described here, mailbox monitoring remains read-only. The full-mailbox connection verifies access and account identity; automated sending, editing, and deletion through Gmail are not enabled. Possessing that permission does not mean those operations are performed.

A required raffle, account, or newsletter confirmation may involve contacting the organizer's verified website. That is a separate action from modifying Gmail messages. Supported, verified newsletter unsubscribe actions may also contact the organizer's service after the relevant participation and retention requirements are satisfied.

How information is used

Mail information is used to match messages to existing entries or prerequisites, identify required confirmation steps, verify completion, detect possible win or organizer follow-up notices, and explain unresolved states. Local records support duplicate prevention, troubleshooting, and the owner's dashboard.

The background classifier applies local rules. It does not call an external AI model with message bodies. KessWin has no advertising, data-sale, credit-scoring, or general-purpose model-training feature using Gmail data. Information the owner independently gives to another assistant or support service is subject to that service's own terms and privacy practices.

Connections and disclosure

• Google: OAuth and Gmail API requests authenticate the account and retrieve mailbox data.
• Organizers and their service providers: Supported entry and initial confirmation actions send reviewed, owner-authorized entrant fields, including required fields and specifically approved optional fields, or a confirmation token to the reviewed destination. Supported newsletter cleanup can send an unsubscribe request to the verified organizer service. Organizers handle received data under their own notices.
• Telegram: When configured, the owner's chat receives raffle information, decision requests, and status or possible-win notifications. Possible-win notifications identify the public raffle; they do not include the email body or its private confirmation links.
• The local operator: The owner can inspect records. Authorized troubleshooting may require a limited review of relevant evidence; this does not make mailbox data public.

Possible prize claims, fulfillment steps, payment requests, and attachments are left for the owner. A possible-win notice is not permission for the application to accept a prize.

Storage and retention

OAuth credentials are stored locally using Windows data protection. Sensitive retained mail and organizer responses use encrypted local storage. Local database records retain status, timestamps, evidence references, and other operational metadata. The public information pages do not receive those records.

Entry history and selected evidence are retained to reconcile outstanding actions and avoid duplicate submissions. There is no fixed automatic deletion period for all local records. Revoking Google access stops future authorized API access but does not erase evidence already stored locally, the owner's backups, messages in Gmail, or data held by organizers and Telegram.

Local data removal must be handled by the installation's owner, including protected credentials, retained evidence, and backups as appropriate. This policy does not promise immediate deletion or recovery of deleted data.

Owner controls and contact

The owner can pause entry scheduling, stop the local service, and remove KessWin's authorization in Google Account connections. Pausing entries alone does not stop mailbox monitoring or Telegram decision collection.

This is a single-owner installation without public registration. Its operator is responsible for privacy questions and local data handling. The app's support contact is shown in Google's authorization screen; no private mailbox address is published on this page.

These information pages

These pages contain no analytics scripts, tracking pixels, forms, third-party fonts, or application cookies. A hosting provider may process ordinary request information when serving them; its own practices must be considered separately. The pages cannot connect to or control the local application.

Changes and Google policies

The operator must review this notice when data access or application behavior changes. The app is subject to the Google API Services User Data Policy, including its Limited Use requirements. This page is not a claim of Google verification, endorsement, or a guarantee that an authorization can never expire.