Privacy Policy

kabu-station-gmail-otp-helper-site

Effective date: 2026-05-21

Overview

kabu-station-gmail-otp-helper-site is a personal local desktop helper for kabu Station login support. It uses Gmail read-only access only to find and read matching authentication emails on the user's local PC.

This tool does not make trading decisions, create orders, call broker order APIs, or submit orders.

Information Collected

The tool handles the following information only for local login support:

Google OAuth authorized user credentials JSON stored locally on the user's PC.
Gmail message metadata such as sender, subject, received time, and unread state.
The body of matching authentication emails, read temporarily on the local PC for two-factor authentication code extraction.
Local runtime logs and session status that do not include Gmail message bodies, authentication codes, passwords, OAuth token values, or account identifiers.

Gmail API Data Access

The tool uses only this Gmail API scope:

https://www.googleapis.com/auth/gmail.readonly

It reads:

Gmail labels list for a read-only credential smoke test.
Gmail message list filtered by configured sender, subject, unread state, and recency.
Metadata and body of matching candidate messages.

The tool does not send, delete, modify, or mark Gmail messages as read.

Purpose of Use

Gmail data is used only to extract an email two-factor authentication code locally and support the kabu Station login helper flow.

Gmail data is not used for advertising, marketing, user tracking, trading decisions, model scoring, scraping, order planning, or broker API calls.

Sensitive Data Protection Mechanisms

The following security and data protection measures are used to protect Google user data and other sensitive data:

Data minimization: the tool requests only the Gmail read-only scope needed for the login helper flow.
Local-only processing: matching email content and extracted authentication codes are processed on the user's local PC.
No third-party server storage: this tool does not upload Gmail data, authentication codes, OAuth credentials, passwords, or account identifiers to a third-party server.
Transport protection: communication with Google APIs uses Google's HTTPS/TLS endpoints.
Local credential storage: OAuth authorized user credentials are stored in a local secrets directory on the user's PC and should be protected by the user's operating system account and file permissions.
Secret redaction: logs, session status files, documentation, and debug artifacts must not contain OAuth token values, Gmail message bodies, extracted authentication codes, passwords, account identifiers, or webhook secrets.
Limited retention: Gmail message bodies and extracted authentication codes are not stored by the tool after local extraction.
User control: users can delete the local OAuth credentials file and revoke the app's access from their Google Account at any time.

The implementation policy is to keep sensitive Gmail data local, minimize access, avoid persistent storage of email content or authentication codes, and prevent sensitive values from being written to logs or artifacts.

Data Storage

Stored:

Google OAuth authorized user credentials JSON in a local-only directory on the user's PC.

Not stored:

Gmail message body.
Extracted authentication codes.
Gmail raw payload.
kabu Station login information.
OAuth token values in logs or status artifacts.
Broker order API requests or responses.

This tool does not sell, share, transfer, or disclose Gmail data to third parties. The current design is a personal local desktop tool and does not send Gmail data to a third-party server.

Credential Storage and Deletion

OAuth authorized user credentials JSON is stored on the user's local PC in the configured secrets directory. Default example:

C:\kabu\secrets\gmail_token.json

To delete it, close the tool and remove that local file. The OAuth grant flow can be run again later if access is needed.

Revoking Google Account Access

Users can remove this app's access from Google Account third-party access settings:

https://myaccount.google.com/permissions

Users should also delete the local OAuth credentials JSON file from their PC.

Google API Services User Data Policy

This tool is designed to comply with the Google API Services User Data Policy. Gmail data is used only for the disclosed purpose of local two-factor authentication code extraction and login support.

Gmail data is not used for advertising, is not sold to third parties, and is not intended for human review. Troubleshooting must not include email bodies, authentication codes, login information, OAuth credential content, or other sensitive values in logs or reports.