Outbound-only version

Privacy policy

Effective date: November 6, 2026

This policy covers Capability Workshop Bridge, the Bridge & Atlas website, and support inquiries. The outbound desktop implementation awaits supervised Gmail authorization and live sending. No public account-registration service is offered.

Purpose and permission

Capability Workshop Bridge sends report emails approved by its operator. It requests only Gmail's gmail.send scope. It does not use the Gmail API to read incoming or existing messages, contacts, or attachments, change mailbox labels, or receive instructions. The current tool is prepared for a supervised first connection and send; this policy does not claim a live unattended service.

Information used

• Report content and recipient address supplied and reviewed locally by the operator.
• The proposed sender address and account choice confirmed by the operator.
• Google OAuth authorization material needed to submit email, including refresh and temporary access tokens, and desktop-client configuration.
• Local delivery and audit metadata such as request identifiers, timestamps, sender and recipient addresses, outcome states, payload fingerprints, and Gmail message identifiers.

The tool does not retrieve inbox contents for report creation. The operator is responsible for choosing appropriate report content and recipients.

Storage and protection

Refresh tokens and the desktop-client secret are stored locally as Windows CurrentUser DPAPI ciphertext. Access tokens are held in process memory while needed. These protections are scoped to the Windows user; they are not a guarantee against compromise of that account or device. Tokens and credential secrets are not intentionally included in reports, application audit logs, or this website.

Locally prepared report files and delivery receipts remain on the operator's device. There is no implemented automatic deletion schedule. The operator controls their retention, review, and removal. Pending or uncertain delivery evidence needs careful handling to avoid accidental duplicate sends.

Where information goes

Sending requires transmission to Google's Gmail service. Google processes the submission and routes the email to the approved recipient, whose mailbox provider may also process and retain it. An API acknowledgement does not establish recipient delivery.

Authorized recipients may choose to process reports through separately configured AI or notification services. Those services operate under their own terms, privacy policies, and account settings. The bridge does not automatically give them OAuth tokens or access to the sender's mailbox.

Limits on use

Google API information is used solely for the approved reporting function. This bridge does not sell it, use it for advertising, or repurpose it to train general-purpose AI models. Its use and transfer of Google API information is subject to the Google API Services User Data Policy, including its Limited Use requirements. This statement is not a claim that Google has verified the application.

Revocation, retention, and deletion

The account holder can revoke the app's Google access in Google Account third-party connections and stop using the local tool. Requests to remove local authorization material or report copies should be directed to the operator. Revocation does not delete local files, previously delivered email, recipient copies, or data retained by separately connected services. Their respective account holders must manage those copies.

Local audit and delivery records are retained until an operator-reviewed retention or deletion decision. No fixed deletion deadline or automatic purge is promised. Credential protection and retention practices should be reviewed before adding more users.

This public website

Cloudflare Pages is the selected hosting provider for this website. Cloudflare may process visitor IP addresses and ordinary browser, request, and traffic information to deliver and protect the site, as described in the Cloudflare Privacy Policy. These static pages contain no application analytics, advertising, login forms, cookies set by page code, or tracking scripts.

Support email and Cloudflare Email Routing

If you email support@bridgeandatlas.com, Cloudflare Email Routing processes and forwards your message to the operator's designated support mailbox. Cloudflare and the receiving mailbox provider may process your sender address, message headers, content, and any attachments you supply to route, deliver, secure, and retain the correspondence under their applicable policies. The forwarding destination is not published.

The operator uses support correspondence to answer questions and handle privacy requests, retaining it until an operator-reviewed deletion or retention decision. No automatic deletion deadline is implemented. Please avoid sending passwords, authorization codes, tokens, or unnecessary personal information. The routing rule is configured, but actual delivery has not yet been verified.

Support forwarding is separate from Gmail API access. It does not give the outbound bridge permission to read Gmail messages, accept tasks, or execute commands.

Future features

Inbound mailbox access, task delegation, and remote approvals are not included in the present Gmail permission or this implementation. A future change would require an updated disclosure and any additional authorization required for that feature. Receiving an email will not itself authorize arbitrary commands.

Questions and requests

Contact support@bridgeandatlas.com for privacy questions or requests to the operator. Please specify the request without including credentials. Support delivery testing is pending; no response-time guarantee is made.