Google sign-in data
Understand the information used for Google sign-in, its purpose, and your account controls.
This page covers data handling for Google sign-in only. It is not a privacy policy for the entire service. Google sign-in uses your unified MomAPI account; MomBench uses the same account identity.
Information received and stored
When you authorize Google sign-in, MomAPI receives your stable Google account identifier (sub), name, email address, and email verification status to establish your identity. Initial registration stores a local username, display name, email, and Google account association. Linking Google to an existing account adds the association; matching email addresses do not merge accounts.
The full Google account identifier is used for the association. If it is unsuitable as a local username, the service generates a separate local username.
How this information is used
This information is used to create or identify your account, display account information, link your Google sign-in method, and support unified sign-in to MomAPI and MomBench. Google authorization does not automatically grant administrator privileges.
Local sign-in security records include the sign-in method, time, IP address, and browser information for account security and troubleshooting.
Authorization tokens and permissions
A Google access token is used temporarily during sign-in to obtain identity information. The current implementation does not persist Google access, refresh, or ID tokens, or profile pictures. MomAPI manages its own local sign-in sessions.
The requested Google scopes are openid profile email. No permission to read Gmail messages or Google Drive files is requested. MomAPI does not receive your Google password.
Unlinking and deletion requests
After signing in, you can unlink Google in Account Security. Add another available sign-in method before unlinking. Unlinking does not automatically delete your local account.
To request deletion of your account or related data, sign in and submit a support ticket. If you cannot sign in or have a question about Google sign-in data, contact [email protected]. Do not send passwords, verification codes, or API keys in tickets or email.
Include a request ID and error message in your ticket. Never include your API key.