Legal

Privacy Policy

Last updated: September 6, 2026

1. Introduction

This Privacy Policy describes how Code Mimo ("we", "us", "our") collects, uses, and protects information when you use the Code Mimo API ("Service"). We are committed to protecting your privacy and handling your data responsibly.

2. Information We Collect

2.1 Authentication Data

When you authenticate through the Service, we process:

• OAuth 2.0 authorization codes and tokens (access tokens, refresh tokens)
• Google account identifiers necessary for API operations
• Requested and granted permission scopes
• Token expiration timestamps

2.2 Request Metadata

For operational purposes, we collect:

• API request timestamps and endpoints called
• HTTP status codes and response times
• Client IP addresses (anonymized after 30 days)
• User-Agent strings
• Request IDs for tracing and debugging

2.3 Application Configuration

If you register an application with us, we store:

• Application name and description
• Client ID and client secret (encrypted)
• Authorized redirect URIs
• Contact email address

3. How We Use Your Information

We use collected information exclusively for:

1. Service operation: Processing OAuth flows, token management, and API request routing.
2. Security: Detecting unauthorized access, abuse, and potential security incidents.
3. Reliability: Monitoring service health, performance optimization, and debugging.
4. Compliance: Maintaining audit logs as required by applicable regulations.

4. Google User Data

4.1 Data Access

The Service accesses Google user data solely as an intermediary on your behalf. We request only the OAuth scopes necessary for the specific API operations you authorize.

4.2 Data Storage

OAuth tokens are processed in-memory and are not persistently stored beyond the active session lifecycle. Tokens transmitted through the Service are forwarded to the requesting application and not retained in our databases.

4.3 Limited Use

In compliance with the Google API Services User Data Policy:

• We do not use Google user data for advertising or marketing purposes.
• We do not sell Google user data to third parties.
• We do not use Google user data for purposes other than providing the Service.
• Human access to Google user data is limited to cases where it is necessary for security investigation or legal compliance.

5. Data Retention

Data Type	Retention Period
OAuth tokens	Session duration only (not persisted)
Request logs	90 days
IP addresses	Anonymized after 30 days, deleted after 90 days
Application config	Until account deletion
Audit logs	1 year

6. Data Sharing

We do not sell, trade, or share your data with third parties except:

1. Google APIs: Data is transmitted to Google as required to fulfill the API operations you request.
2. Legal requirements: When required by law, regulation, or valid legal process.
3. Security: To protect the rights, property, or safety of Code Mimo, our users, or the public.

7. Security Measures

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• OAuth 2.0 with PKCE for authorization flows
• Regular security audits and dependency updates
• Principle of least privilege for internal access
• Automated intrusion detection and anomaly monitoring

8. Your Rights

You have the right to:

1. Access: Request a copy of the data we hold about your account.
2. Deletion: Request deletion of your account and associated data.
3. Revocation: Revoke OAuth consent at any time through Google's security settings.
4. Portability: Request your data in a machine-readable format.
5. Restriction: Request that we limit how we process your data.

To exercise any of these rights, contact us through our website.

9. International Data Transfers

The Service operates on infrastructure located in the European Economic Area (EEA). If you access the Service from outside the EEA, your data may be transferred to and processed in the EEA. We ensure appropriate safeguards are in place for any international transfers, including standard contractual clauses where applicable.

10. Cookies and Tracking

The Service does not use cookies, tracking pixels, or analytics scripts on its API endpoints. The informational websites do not set cookies or use third-party tracking.

11. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or via email at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

13. Contact

For privacy-related inquiries or to exercise your rights:

Code Mimo
Data Protection Contact
Website: codemimo.com