Last updated: 20 June 2026
This Privacy Policy explains how the Google Workspace integration for WP Project Manager (“the Plugin”, “we”, “us”) accesses, uses, stores, and protects data obtained from your Google Account. It applies specifically to the Google Drive connection feature added by this module.
Replace the bracketed placeholders (
[Company Name],[website],[email],[address]) before publishing. This policy must be hosted at a public URL and supplied to Google during OAuth verification.
1. Who we are
The Plugin is published by Anik (apm.fahmidsroadmap.com). For privacy questions contact [fhamid.cse.cou@gmial.com], [Mirpur , Dhaka].
The Plugin runs on your own WordPress website. Data obtained from Google is stored in your WordPress site’s database, on infrastructure you control. Anik does not receive, host, or have access to your Google data.
2. What data we access
When you choose to connect your Google Account, the Plugin requests the following Google OAuth scopes:
| Scope | Why |
|---|---|
openid, email, profile | Identify which Google Account is connected and show your email in the UI. |
https://www.googleapis.com/auth/drive.readonly | Browse and search your Google Drive files so you can attach them to project tasks. |
The Plugin accesses Google Drive read-only. It cannot create, modify, or delete files in your Drive.
3. What data we store
In your WordPress database, the Plugin stores:
- OAuth tokens — access token and refresh token for your connected Google Account, used to call Google APIs on your behalf. Refresh tokens are encrypted at rest (AES-256-CBC, using a key derived from your site’s WordPress secret keys).
- Account email — the Google email of the connected account, shown in the UI.
- Drive file references — for files you explicitly attach to a task: the Google file ID, file name, MIME type, icon/thumbnail URL, web view URL, and last-modified time.
The Plugin does not download, copy, or store the contents of your Google Drive files. Attachments are references only; clicking one opens the file in Google Drive. File listings retrieved while browsing are shown in your browser and are not persisted unless you attach a file.
4. How we use the data
Google data is used solely to provide the features you invoke:
- Authenticate your Google Account.
- Let you browse/search your Drive and attach files to tasks.
- Display attached-file metadata within Project Manager.
We do not use Google data for advertising, profiling, or any purpose unrelated to these features.
5. Google API Services User Data Policy — Limited Use
The Plugin’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google user data only to provide and improve the user-facing features described above.
- We do not transfer or sell Google user data to third parties, ad networks, data brokers, or for any other purpose.
- We do not use Google user data for serving advertisements.
- We do not allow humans to read Google user data unless: (a) you give explicit consent for specific data, (b) it is necessary for security or to comply with applicable law, or (c) the data is aggregated and anonymized for internal operations.
6. Data sharing
Google data stays within your WordPress site and is transmitted only between your site and Google’s APIs over HTTPS. We do not share it with any third party. Standard WordPress access controls and capability checks govern who on your site can view attached-file metadata.
7. Data retention and deletion
- Tokens and file references are retained until you disconnect or remove them.
- Disconnecting your Google Account (via the Google Workspace page) revokes the token with Google and deletes the stored tokens for your user from the database.
- Detaching a file removes its reference from the task.
- Uninstalling the module removes its stored data per the plugin’s uninstall routine.
You may also revoke the Plugin’s access at any time from your Google Account at https://myaccount.google.com/permissions.
8. Security
- Refresh tokens are encrypted at rest.
- All communication with Google APIs uses HTTPS/TLS.
- OAuth callbacks are protected against CSRF via signed state tokens and WordPress nonces.
- API endpoints enforce WordPress authentication and capability checks.
Because the Plugin runs on your own server, the overall security of stored data also depends on your site’s hosting, configuration, and WordPress secret keys.
9. Children
The Plugin is a business productivity tool not directed to children under 13 (or the minimum age in your jurisdiction).
10. Changes
We may update this policy. Material changes will be reflected by the “Last updated” date above.