Overview
Jasper Timeclock MFA is a private, locally operated automation owned by Micheal Breedlove. It uses Google OAuth solely to retrieve a recent ExponentHR multifactor-authentication email after the operator deliberately requests a code.
Google user data accessed
The app requests https://www.googleapis.com/auth/gmail.readonly. This scope permits viewing Gmail messages and settings. The app’s implemented use is narrower: it searches for up to ten recent messages matching an ExponentHR sender and MFA-related terms, checks their timestamp, reads matching message content, and extracts a one-time verification code.
The app does not send, modify, label, archive, or delete Gmail data.
How Google user data is used
Matching message data is used only to identify the current ExponentHR verification code and complete the authentication step associated with the operator’s timeclock request. It is not used for advertising, analytics, credit decisions, profiling, or unrelated automation.
Storage and retention
- OAuth client configuration and the refresh token are stored in a local, git-ignored configuration file on the operator’s Windows computer.
- Fetched Gmail message content and the extracted code are processed in memory and are not intentionally written to the app’s logs or debug artifacts.
- Operational logs record success or failure events without intentionally recording the email body or MFA code.
- The refresh token is retained until it is replaced, revoked, or no longer needed.
Sharing and transfer
Google user data is not sold, rented, shared with advertisers, or disclosed to data brokers. The app communicates directly with Google’s OAuth and Gmail API endpoints from the operator’s local computer. The extracted one-time code is supplied only to ExponentHR for the authentication flow that caused the code to be sent.
Security
Access is limited to the operator’s local Windows account and the minimum OAuth scope used by the workflow. Secret configuration is excluded from version control. The automation fails closed if OAuth refresh, MFA retrieval, login state, or page state is uncertain.
Revoking access
The operator can revoke the app’s Google access at any time from Google Account third-party connections. Revocation prevents future Gmail API access until a new authorization is granted.
Google API Services User Data Policy
Jasper Timeclock MFA’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Changes
This policy will be updated if the app’s data access or handling changes. The effective date above identifies the current version.
Contact
Questions about this policy or Google data handling may be sent to the app operator.