Privacy Policy
Effective 25 October 2026
This policy covers Ilya Cloud: the scheduling service at cal.ilya.cloud and the AI-assistant tool
gateway at mcp.ilya.cloud. Ilya Subkhankulov ("we") runs both privately for himself and invited family
members. This policy explains what data we access, why, and how we protect it, with particular attention to data we
receive from Google APIs.
1. Who can use Ilya Cloud
Only people we have invited can sign in. Each user signs in with their own account on our private identity server. There's no public sign-up, and we don't sell or advertise the service.
2. Google user data we access
Connecting a Google account is optional, and each user connects their own. Google shows the requested permissions on its consent screen, and you can grant or decline each one. We request only the following:
| Permission (scope) | What we use it for |
|---|---|
Google Calendar: view your calendar list, view events, view free/busy, and create, change and delete events
(calendar.calendarlist.readonly, calendar.events.readonly,
calendar.events.freebusy, calendar.events, calendar.readonly) |
Scheduling: to show when you're free and add booked meetings to your calendar. AI tools: to let your assistant list, search, create, update, delete or respond to events when you ask it to. |
Gmail: read messages and settings, and manage drafts (gmail.readonly, gmail.compose) |
To let your assistant search and read your email and labels, and write drafts for you to review and send yourself. Ilya Cloud doesn't send email on your behalf. |
Google Drive: view files, and work with files the app creates (drive.readonly,
drive.file) |
To let your assistant search and read your files and save copies or new files you ask for. |
Basic profile and email address (openid, email) |
To record which Google account a connection belongs to. |
3. How we use Google user data
- We use it only to provide the features you ask for, at the moment you ask: answering your question, showing your availability, or making the change you requested.
- We don't use Google user data for advertising, sell it, or use it to build profiles.
- We don't use Google user data, including Google Workspace data, to develop, improve or train generalized or non-personalized AI or machine-learning models.
- Nobody reads your Google data except you. The only exceptions are when you explicitly ask us to (for example to debug a problem), when it's needed for security, such as investigating abuse, or when the law requires it.
Ilya Cloud's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Sharing and transfer
When you ask your AI assistant to use a Google tool, the gateway passes the result (for example, the text of the email you asked about) to the AI assistant you are using, such as Anthropic's Claude, so it can answer you. That's a transfer you initiate, made only to provide the feature you asked for. Your assistant provider's own privacy terms apply to it. We don't share Google user data with anyone else, except:
- when you direct us to;
- when the law requires it;
- as part of a security investigation.
We never sell it.
5. Storage, retention and security
- What we store: the OAuth tokens that let the gateway act for you, encrypted at rest in a database on a private server we control. The scheduling service also stores the bookings made through it.
- What we don't store: the contents of your email, files or calendar. They're fetched from Google when you make a request and aren't kept afterwards, apart from short-lived operational logs.
- Security:
- All traffic is encrypted with TLS.
- Secrets are encrypted at rest.
- Servers sit behind authentication and aren't directly reachable from the internet.
- Each user's Google connection is used only for that user's own requests.
- Retention: tokens stay until you revoke access or ask us to delete them. Logs are kept for no more than 30 days.
6. Your choices and deletion
- Revoke access at any time at myaccount.google.com/permissions. Once revoked, the gateway can no longer reach your Google data.
- Ask us to delete your stored tokens and account data by emailing privacy@megalabs.co. We delete them within 30 days and confirm by email.
7. Children
Ilya Cloud isn't directed at children under 13, and we don't knowingly collect their data.
8. Changes
If this policy changes, we'll update the date above and tell users directly before any change in how Google user data is used.
9. Contact
Ilya Subkhankulov · privacy@megalabs.co