隐私说明

ENGLISH

Privacy notice

Updated: 2026-10-27. Applies to public previews 0.12.0-preview.4, 0.13.0-preview.2, and 0.14.1-preview.11. Storage differences in prior 0.12.0-preview.3 are identified below.
Maintainer: 牛村木木山 (oxmumu3). Contact: experts@finvo.ai.

Purpose and access

DSH Dot is a community plugin running in DeepSeek Harness on your computer. It supports project assistance and questions about sources you authorize, through Harness or a connected WeChat conversation. Google access supports visible email questions and summaries, calendar queries, and file search and questions. The maintainer does not operate a Dot backend that centrally stores users’ Google tokens or private content.

• gmail.readonly: limited matching message metadata and snippets, plus bounded plain text from a message you select. The current implementation does not download attachments or send, modify, or delete mail.
• calendar.events.readonly: primary-calendar events for a bounded period. The default is the next 24 hours, with up to seven days and ten events supported. It does not create, modify, or delete events.
• drive.readonly: file search metadata and supported content from a specified file, such as document or slide text and a specified spreadsheet range. It does not modify, delete, or share files.

OAuth scopes cover more than a single query. Dot also bounds operations and result size. Only actually granted and enabled sources can be used. Connecting Google does not itself read mail or file bodies or start continuous scanning or private-source pushes.

Processing and recipients

Login takes place on Google’s official pages. Token exchange and Google API requests go directly from your computer to Google. Retrieved results may enter Harness conversations, host records, and the context sent to your configured model. Cloud models receive relevant content. Answers delivered through WeChat also pass through the configured bridge service and WeChat channel. Local authorization storage does not mean all content always stays on your computer.

Before enabling Google sources, use a model service that restricts this data to your requested features and does not use it to train general-purpose AI models or for other uses outside Google’s Limited Use requirements. If you cannot confirm this, do not enable Google sources. The maintainer cannot guarantee independent providers’ retention, human-access, or training policies. User consent does not waive the application’s own Google-policy obligations. Dot has no feature to sell Google data or use it for advertising, credit decisions, or general-purpose training for the maintainer.

Storage and retention

In 0.12.0-preview.4, 0.13.0-preview.2, and 0.14.1-preview.11, OAuth records saved through the ordinary Google suite and Google Calendar login flows are encrypted using AES-256-GCM in the local Harness profile. Separate random encryption keys are stored in macOS Keychain; access tokens are cached only in the authorization controller’s memory. The ordinary flow does not fall back to cleartext storage when Keychain access or ciphertext validation fails. This protection covers only those two ordinary Google login flows, not manually entered advanced refresh tokens, flomo or Dida credentials, context-brief records, Harness conversations, or historical backups.

Prior public preview 0.12.0-preview.3 saved ordinary authorization in the local profile without an application-level encryption-at-rest guarantee. Installing an upgrade does not automatically migrate all old credentials. The two ordinary Google records are migrated through guarded native configuration transactions only when an explicit query needs to obtain a Google token; merely viewing or refreshing status does not migrate them. Reconnecting can replace an old record with new authorization. Historical backups are not rewritten.

Local authorization references remain until cleared. To avoid making a possibly committed record undecryptable, a Keychain key may remain when a host-write outcome is uncertain. Clearing the profile is not deletion of all residual Keychain items, conversations or backups. Google-side permission may also expire or be revoked.

In 0.14.1-preview.11, a single source read does not by itself automatically copy the complete Google API response into project memory. When you explicitly request a context brief and it succeeds, Dot stores the bounded query scope, generated summary and items, and source references including identifiers, timestamps, titles and verbatim excerpts of up to 300 characters in local Harness context-brief storage. An excerpt may contain the entire content of a short item. The brief may be used for a later handoff for that project or follow-up you explicitly enable. If model processing fails, a bounded source-excerpt response may be returned; that fallback itself does not create the above brief record, but it may still remain in conversations or host records. Limited user or assistant message excerpts may also enter recent records for a watched project. There is no unified automatic retention period. Manage your own copies, backups, and content sent to other services at those locations separately.

Stopping access and deleting records

1. In DSH Dot → Connections and settings, select “Stop this source” to stop further reads through that source in the current conversation.
2. In advanced credential settings, select “Clear Google suite authorization” or “Clear Google Calendar authorization”, then save the connection credentials. Clear both separately if both were saved.
3. Revoke DSH Dot in your Google Account’s third-party connections page. Stopping a source or removing its local record does not itself revoke Google-side permission.
4. Stopping a source or revoking Google authorization does not automatically delete saved context-brief loops, summaries, source excerpts, conversations, or backups, and cannot recall data already sent to a model provider or WeChat. You may ask Dot to stop and forget the relevant project’s context-brief loop; separately manage any handoff records, host conversations, project records, backups, and copies held by third-party services. Available deletion actions depend on the actual entry point and permissions. Contact the maintainer for help locating local records; do not post tokens or private content in public issues.

Google data-use rules

The maintainer requires this project’s use and transfer of information received from Google APIs to adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data must be used only for that user’s requested, visible features. It must not be sold, used for advertising or credit decisions, or used to train AI beyond an appropriate personalized use for that specific user. The configured model and other recipients must satisfy the same purpose limitations.

This notice describes current behavior and project rules; it is not a claim of completed Google verification or a security assessment. See also the Google Workspace user data and developer policy.

This website and changes

This static website contains no analytics scripts, advertising, external fonts, third-party CDN resources, or login forms. Its hosting provider, GitHub Pages, may process request information under its own policies. Changes to purposes, permissions, or recipients require an updated notice and renewed consent where applicable. Contact experts@finvo.ai for privacy questions.