Privacy Policy

How Gspace collects, processes, and protects personal data.

Last Updated: October 4, 2026

This Privacy Policy explains how RICH MEDIA Informatikai Szolgáltató Bt. (Limited Partnership) ("RICH MEDIA", "we", "our", or "us") collects and processes personal data when you use the Gspace website, desktop application, Chrome extension (Gspace Link Forwarder), newsletter, and related purchase and licensing flows.

Data Controller

Data controller: RICH MEDIA Informatikai Szolgáltató Bt. (Limited Partnership)

Registered office: 1126 Budapest, Böszörményi út 7. 2. em. 1. ajtó, Hungary

Tax ID (Adószám): 21135901-2-43

Company registration number: 01-06-746412

Privacy and support contact: richard@gspaceapp.com

Company contact: richard@richmedia.hu

Where Hungarian or EU data protection law applies, the competent supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), https://www.naih.hu.

Roles of Other Parties

  • RICH MEDIA is the controller for the Gspace website, desktop app settings we process, licensing metadata we handle, newsletter subscriptions, support correspondence, and the OAuth relay described below.
  • Polar acts as merchant of record for paid purchases. Polar is a separate controller (or joint controller, as applicable under Polar's terms) for payment, invoicing, VAT, and customer billing records.
  • Google is the controller of your Google account and Google Workspace content. When you use Gmail, Calendar, Drive, Meet, Chat, Tasks, Gemini, or related Google services inside Gspace, you do so under Google's terms and privacy policy.
  • Vercel hosts the website and provides basic first-party web analytics.
  • Plunk (UsePlunk) processes newsletter email addresses you submit on the website.

Personal Data We Process

Depending on how you use Gspace, we may process:

  • Contact details you submit, such as your email address when you contact us or join the newsletter
  • Purchase and licensing data processed through Polar, such as your email address, Polar customer ID, transaction status, trial end date, license key status, activation ID, and related billing records
  • Google Account identity data obtained during sign-in: email address, display name, and profile photo URL
  • OAuth tokens (access token, refresh token, expiry, and granted scopes) that transit our website during sign-in and token refresh, then are stored locally in the desktop app
  • Desktop app data stored locally on your device, such as account partitions, session cookies for Google sites, sidebar preferences, notification counts, calendar event metadata used for badges and reminders, theme settings, and local license state
  • Website usage and technical data from hosting and Vercel Analytics, such as page views, referrer, approximate region, and browser or device information
  • Chrome extension data limited to the current tab URL on supported Google Docs, Drive, and Meet pages, used only to open that URL in the desktop app
  • Support correspondence you send to us

We do not operate a general-purpose server-side database of your Gmail, Calendar, or Drive content.

Google Sign-In and API Access (Current Product)

Adding a Google account to the Gspace desktop app uses Google OAuth through gspaceapp.com. This is a current feature, not a planned one.

When you add or reconnect an account, the website:

  1. Sends you to Google to sign in and grant permissions
  2. Receives Google's authorization code on our server
  3. Exchanges that code with Google for tokens
  4. Reads your Google Account email, name, and profile photo
  5. Returns those identity fields and the tokens to the desktop app over a gspace:// deep link
  6. Later, when an access token expires, the desktop app may send the refresh token to our website so we can request a new access token from Google and return it to the app

We do not intend to store your Google mail, calendar events, or Drive files on our servers. Tokens and identity data are processed in memory on the website to complete sign-in or refresh, then stored locally by the desktop app. Server logs may incidentally contain error details if a request fails.

The desktop app uses the tokens on your device to call Google APIs for product features such as unread counts, recent mail summaries, sender avatars from Contacts, Other contacts, and your Google Workspace directory (when available), upcoming calendar events, recent Drive files, badges, and desktop notifications. For some brand senders, the app may look up public BIMI DNS records on your device to resolve a logo URL; that lookup is not sent to RICH MEDIA.

Scopes we request

The current OAuth request includes:

  • openid
  • https://www.googleapis.com/auth/userinfo.email
  • https://www.googleapis.com/auth/userinfo.profile
  • https://www.googleapis.com/auth/gmail.readonly
  • https://www.googleapis.com/auth/calendar.readonly
  • https://www.googleapis.com/auth/drive.metadata.readonly
  • https://www.googleapis.com/auth/contacts.readonly
  • https://www.googleapis.com/auth/contacts.other.readonly
  • https://www.googleapis.com/auth/directory.readonly

Gspace also embeds Google web apps (for example Gmail, Calendar, Drive, Meet, Chat, Tasks, and Gemini) in isolated desktop sessions. Those sessions use Google's own cookies and interfaces on your device. Meet may ask your operating system for camera and microphone access. Audio and video for Meet are handled by Google, not uploaded to RICH MEDIA.

Google API Limited Use

Gspace's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data. We do not use Google user data for serving advertisements. We do not use Google API data to develop, improve, or train generalized artificial intelligence or machine learning models. We do not allow humans to read Google user data unless you give us permission to do so for support, it is necessary for security purposes, or we are required by law. We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, for security, or as required by law. You may disconnect an account or uninstall the app to stop API access and delete locally stored tokens.

Chrome Extension (Gspace Link Forwarder)

The Chrome extension is a companion to the desktop app. On supported docs.google.com, drive.google.com, and meet.google.com pages it may read the current tab URL and offer to open that URL in Gspace via a gspace:// link.

The extension does not read the contents of your documents, mail, or meetings. It does not send those contents to RICH MEDIA. It requires the desktop app to be installed for the handoff to complete. You can stay in Chrome instead of opening Gspace.

How We Use Data

We use personal data to:

  • Provide, operate, secure, and maintain the Gspace website, desktop app, and Chrome extension
  • Complete Google sign-in and token refresh for the desktop app
  • Enable account isolation, unread counts, mail sender avatars, calendar reminders, Drive summaries, and desktop notifications
  • Manage free trials, license activation, license validation, device activations, and customer support
  • Process newsletter subscriptions and service communications
  • Monitor website performance, diagnose technical issues, and prevent abuse
  • Comply with legal, tax, accounting, and regulatory obligations

Legal Bases

Where EU or Hungarian data protection law applies, we generally rely on:

  • Performance of a contract when we provide the app, licenses, sign-in, or requested services
  • Legitimate interests in securing, operating, and supporting Gspace and preventing abuse
  • Consent where you subscribe to marketing, or where consent is required for optional analytics or similar technologies
  • Compliance with legal obligations, including accounting and tax requirements

Cookies and Website Analytics

The website uses strictly necessary technologies to operate pages, remember theme preference, and complete OAuth redirects.

The website also uses Vercel Analytics for aggregated traffic measurement. This is first-party analytics provided by our host. It is used to understand page usage, not to serve ads. We do not currently run a third-party advertising cookie or a marketing pixel.

If we add non-essential cookies that require consent under applicable law, we will present a consent choice and update this policy.

When We Share Data

We do not sell personal data. We may share limited data with:

  • Polar, for purchases, VAT, invoicing, refunds, trial metadata, and license-related customer records
  • Google, when you sign in or use Google services through Gspace
  • Plunk (UsePlunk), for newsletter subscriptions submitted through the website
  • Vercel, for website hosting, OAuth HTTP handling, and basic website analytics
  • Professional advisers or authorities if required by law, to protect our rights, or in connection with a business reorganization, merger, or sale

Security

We use HTTPS for the website and OAuth endpoints. Google tokens are not written to a RICH MEDIA database. The desktop app stores tokens and session data locally, with each Google account in an isolated session partition. You are responsible for the physical and account security of your devices.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the competent authority when required by law.

Local Device Storage

Gspace stores significant app data locally on your device. This can include Google session cookies, OAuth tokens, account partitions, license state, settings, notification counts, and calendar metadata needed for badges and reminders.

If you remove an account, clear local app storage, or uninstall the app, locally stored app data may be deleted from your device, subject to your operating system and backups.

Retention

We retain personal data only as long as reasonably necessary for the relevant purpose:

  • OAuth codes and tokens on the website: only for the duration of the sign-in or refresh request
  • Newsletter data: until you unsubscribe or ask us to delete it
  • Support correspondence: as long as needed to resolve your request and keep a support record
  • License, customer, and transaction records: as long as needed for licensing, accounting, fraud prevention, and legal compliance (Polar may retain payment records under its own policy)
  • Locally stored app data: until you delete it, remove the account, clear storage, or uninstall the app

International Transfers

Polar, Google, Plunk, and Vercel may process data outside Hungary or the European Economic Area. Where required, those transfers rely on appropriate safeguards implemented by those providers, such as Standard Contractual Clauses.

Your Rights

Subject to applicable law, you may have the right to:

  • Request access to your personal data
  • Request correction of inaccurate or incomplete data
  • Request deletion of personal data
  • Object to or restrict certain processing
  • Receive a copy of personal data you provided to us in a portable format
  • Withdraw consent where processing is based on consent
  • Lodge a complaint with NAIH or another competent data protection authority

For data processed by Polar or Google, you may also need to exercise rights directly with those providers.

To make a request, email richard@gspaceapp.com.

Children's Privacy

Gspace is not directed to children. We do not knowingly collect personal data from children in violation of applicable law.

Where EU or Hungarian law applies, we do not intend the service for children under 16, or any higher age required to use the relevant Google services. In other jurisdictions the minimum age may be 13 or the age required by Google and local law, whichever is higher.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version on this page and revise the last updated date.

Contact

For privacy questions, requests, or complaints, contact us at richard@gspaceapp.com or write to RICH MEDIA Informatikai Szolgáltató Bt., 1126 Budapest, Böszörményi út 7. 2. em. 1. ajtó, Hungary.