Privacy Policy

This Privacy Policy describes how Corsair (“Corsair,” “we,” “us,” or “our”) handles information in connection with our managed OAuth infrastructure and developer SDK (collectively, the “Service”), including our hosted platform at hub.corsair.dev and the Corsair SDK (corsair and associated plugin packages such as @corsair-dev/gmail, @corsair-dev/googlecalendar, and @corsair-dev/googlesheets).

Please read this policy carefully. If you have questions, contact us at dev@corsair.dev.

1. Who This Policy Applies To

Corsair is developer infrastructure. Our direct customers are developers and companies (“Customers”) who integrate the Corsair SDK into their own applications (“Customer Applications”) to connect their own end users' (“End Users”) Google Accounts. This policy explains:

• What information Corsair itself collects and processes as the operator of hub.corsair.dev, and
• What our architecture is designed to ensure Corsair does not access, regardless of which Customer Application an End User is using.

Customers are independently responsible for their own privacy disclosures to their End Users. This policy does not govern how a Customer Application uses End User data once obtained — that is between the Customer and their End Users, and Customers must independently comply with Google's API Services User Data Policy for their own use of that data.

2. End User Consent Screen

When an End User connects a Google Account to a Customer Application through Corsair, they first see a Corsair Hub connect screen before being redirected to Google's OAuth consent screen. That connect screen explicitly identifies the Customer Application by name and states that the application is powered by Corsair.

The connect screen explains that the named Customer Application will receive access to the Google data and permissions the End User approves on Google's consent screen. Corsair manages the OAuth authentication flow on the Customer Application's behalf but does not access the substantive content of the End User's Google Account (such as email body text, calendar event details, file contents, or spreadsheet data).

Corsair Hub supports OAuth connections to Google services including Gmail, Google Calendar, Google Drive, and Google Sheets. The specific scopes requested depend on the Customer Application's implemented features and appear on Google's consent screen before the End User approves access.

3. How Our Architecture Handles Google Account Data

Corsair's system is deliberately structured to minimize what our infrastructure can see:

• Tokens are stored by the Customer, not by Corsair. When an End User authorizes a Customer Application to access their Google Account, the resulting OAuth access token and refresh token are stored exclusively within the Customer's own database, encrypted at rest using envelope encryption. Corsair does not maintain a copy of these tokens.
• Corsair's hub is invoked only to refresh expired access tokens. When an access token expires, the Customer's application (via the Corsair SDK) sends the refresh token to hub.corsair.dev over an encrypted, signed channel. The hub exchanges that refresh token, together with Corsair's registered OAuth client ID and secret, for a new access token from Google, and returns the new access token to the Customer's application. The hub does not initiate this process independently and cannot do so without the Customer's application first contacting it.
• Corsair never makes API calls on any End User's behalf. All calls to Google APIs (Gmail, Calendar, Drive, Sheets, etc.) are made directly from the Customer's own infrastructure to Google, using the SDK. Corsair's servers are not in this request path and do not receive, log, or store the content of these requests or their responses.
• Corsair does not access Google Account content. Because of the above, Corsair does not see, store, or process the substantive content of any End User's emails, calendar events, files, or spreadsheets accessed through the Service.

4. Information Corsair Does Collect

In operating hub.corsair.dev, we collect and process the following limited categories of information:

• Token refresh metadata. When a refresh request is made, we necessarily process the refresh token (transiently, to complete the exchange with Google) and the resulting access token before returning it to the Customer's application. We do not persist tokens after the refresh operation completes.
• Operational and diagnostic logs. We may log metadata about refresh requests (e.g., timestamps, response codes, project/API key identifiers) for the purpose of operating, securing, debugging, and improving the Service. These logs do not contain Google Account content.
• Customer account information. We collect information necessary to administer Customer accounts, such as project API keys, signing secrets, billing information, and developer contact details.
• Hub account profile information. When you sign in to Corsair Hub using Google or GitHub, we receive basic profile information from that provider as described in Sections 5 and 6 below.

5. Google Sign-In (Corsair Hub)

When you sign in to Corsair Hub using your Google account, we receive the following information from Google, with your permission:

• Your name
• Your email address
• Your profile picture (if available)
• A unique Google account identifier

We do not request or receive access to your Gmail, Google Drive, Google Calendar, or any other Google data beyond your basic profile information through Hub sign-in.

6. GitHub Sign-In (Corsair Hub)

When you sign in to Corsair Hub using your GitHub account, we receive the following information from GitHub, with your permission:

• Your name or username
• Your email address
• Your profile picture (if available)
• A unique GitHub account identifier

We do not request or receive access to your repositories, organizations, gists, or any other GitHub data beyond your basic profile information.

7. Compliance with Google API Services User Data Policy

Corsair's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In accordance with that policy, we do not:

• Use or transfer Google user data for serving advertisements;
• Sell or share Google user data with third parties, except as strictly necessary to provide the core functionality of the Service (e.g., completing a token refresh with Google);
• Use Google user data to train or improve any machine learning or artificial intelligence model, whether foundational, frontier, or otherwise;
• Allow human review of Google user data, except where necessary for security purposes (e.g., investigating suspected abuse), to comply with applicable law, or where an End User has separately and affirmatively consented.

We limit our use of any Google-derived data we do process (per Section 4) to operating, securing, and improving the token-refresh functionality of the Service.

8. How We Protect Information

• All data in transit between the Corsair SDK and hub.corsair.dev is encrypted and authenticated using a pre-shared signing secret unique to each Customer project.
• Any credentials or tokens transiently handled by our infrastructure are encrypted in transit using industry-standard protocols (TLS).
• We require Customers to encrypt tokens at rest in their own databases using envelope encryption, and our SDK is designed to facilitate this by default.
• We maintain internal access controls limiting employee access to production systems and logs.
• Account information received through Google or GitHub sign-in is stored securely and protected using industry-standard security measures. We retain it only for as long as your account remains active, or as needed to provide Corsair Hub to you.

9. Data Retention

We do not retain access or refresh tokens beyond the duration of a single refresh operation. Operational logs described in Section 4 are retained for 90 days for security and diagnostic purposes, after which they are deleted or anonymized.

10. Data Sharing

We do not sell Google user data. We may share the limited operational information described in Section 4 with:

• Infrastructure and hosting subprocessors who help us operate the Service, bound by confidentiality and data protection obligations;
• Government or regulatory authorities where required by law;
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply or the End User being notified and given the opportunity to consent to any change.

11. Your Rights

If you are an End User of a Customer Application built on Corsair, you should direct requests regarding your personal data (access, deletion, correction) to the Customer Application you interacted with directly, as they control that data. You may revoke Corsair's (or any Customer Application's) access to your Google Account at any time via your Google Account permissions page.

If you are a Corsair Customer or Hub account holder, you can:

• Revoke Google or GitHub access using the links in Sections 5 and 6
• Request that we delete your account and associated data by contacting us at dev@corsair.dev
• Request a copy of the data we hold about you by contacting us at dev@corsair.dev

12. Children's Privacy

The Service is not directed to children under 13 (or the relevant age of digital consent in your jurisdiction), and we do not knowingly collect data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes to how we handle Google user data, we will update this page and, where required, seek renewed consent before making use of data in a new way.

14. Contact Us

Corsair

dev@corsair.dev