Privacy Policy

What This Project Does

pisces-ai-oauth provides a verified OAuth 2.0 client that allows users to access Google Agent Platform (Vertex AI) large language models using their own Google account and their own GCP project. Setting up OAuth verification for Vertex AI scopes is a complex process; this project handles that on behalf of users so they can connect without managing service account keys.

Google User Data Accessed

When a user signs in through this OAuth client, the following Google user data is involved:

cloud-platform scope: Grants the user's own browser or application the ability to call Vertex AI APIs under the user's own GCP project. This is the minimum scope required by Google's Vertex AI API.

cloudplatformprojects.readonly scope: Allows the user's own browser or application to list the user's GCP projects (name and ID) so they can select which project to use.

The user's email address is received as part of the standard OAuth 2.0 sign-in flow, used solely to identify the authenticated session within the user's own application.

How Google User Data Is Used

Google user data accessed through this OAuth client is used for the following purposes and no others:

Email address: Displayed within the user's own application to confirm which Google account is currently signed in. Not transmitted to any external server.

GCP project list (via cloudplatformprojects.readonly): Presented to the user within their own application so they can select which GCP project to bill Vertex AI API usage to. The project list is retrieved from Google's Resource Manager API and displayed locally; it is not stored persistently or transmitted elsewhere.

Vertex AI API access (via cloud-platform): Used to send the user's input (such as text prompts) to Google's Vertex AI endpoints and receive generated responses. All API communication occurs directly between the user's device and Google's servers. The content of prompts and responses is never seen by, transmitted to, or stored by this project.

Google user data is not used for advertising, analytics, profiling, market research, AI/ML model training, or any purpose unrelated to the functionality described above.

What We Can and Cannot See

What we can see: Aggregate OAuth traffic statistics available in the Google Cloud Console, such as the total number of consent grants. This is standard for any OAuth client registration and contains no individual user data.

What we cannot see: Any individual user's email address, GCP project list, API requests, API responses, or any other Google user data. All such data flows directly between the user's device and Google's servers without passing through any infrastructure operated by this project.

Data Protection

The following security mechanisms protect Google user data throughout the OAuth flow and subsequent API usage:

Transport encryption: All communication between the user's device and Google (OAuth endpoints, Vertex AI API) occurs exclusively over HTTPS/TLS. The library enforces HTTPS for all Google API requests.

OAuth 2.0 token security: Access tokens are short-lived (typically 1 hour) and automatically refreshed, minimizing the window of exposure. Refresh tokens are stored only on the user's side and are never transmitted to any third party.

PKCE (Proof Key for Code Exchange): The Rust implementation for native applications (Android, desktop) uses PKCE, which prevents authorization code interception attacks. No client secret is embedded in native applications.

Browser same-origin policy: In browser environments, OAuth tokens stored in localStorage are protected by the browser's same-origin policy, preventing access from other domains.

No server-side storage: This project operates no server, database, or backend infrastructure. Google user data exists only on the user's own device or in the user's own infrastructure, meaning there is no centralized data store that could be breached.

Scope minimization: The OAuth client requests only the scopes strictly required for Vertex AI access. No additional Google user data (such as contacts, files, or calendar) is requested or accessible.

Data Sharing

Google user data is not shared with any third party. This project never receives Google user data, so there is no data to share. The only data exchange occurs directly between the user's device and Google's servers.

Data Storage

This project does not store any Google user data. OAuth credentials that enable the user's connection are stored solely on the user's side: in their browser's localStorage, in their own application memory, or in their own database (such as PostgreSQL), depending on how the library is integrated. The choice of storage and its security configuration are under the user's or integrating developer's control.

Data Retention and Deletion

Since this project holds no user data, there is nothing to retain or delete on our end. Users control their own data:

Browser: Clear the application's localStorage or use the host application's sign-out function.

Server/database integrations: Delete token records from the user's own database.

Google Account: Revoke this OAuth client's access at any time via Google Account Permissions, which immediately invalidates all issued tokens.

Google Sign-In

Authentication is performed directly between the user and Google via Google Identity Services. Google's handling of user data during sign-in is governed by Google's Privacy Policy.

This Website

This website (pisces-ai-oauth.layream.dev) is a static informational page. It contains no analytics, cookies, or tracking scripts. It is hosted on Vercel, which may collect standard access logs per its own privacy policy.

Open Source

Source code is publicly available at github.com/shittim-plana/vertex-ai-oauth.

Contact

Questions about this privacy policy can be raised via GitHub Issues.