Purpose and scope
ARBI Staging Smoke verifies registration and sign-in email delivery, validates one-time codes, exercises ARBI staging APIs, and removes synthetic application accounts created during its tests. This is a separate notice for the testing tool. The ARBI consumer privacy policy continues to cover the ARBI app.
Google information accessed
The tool requests the Gmail read-only OAuth scope (https://www.googleapis.com/auth/gmail.readonly). This permission technically allows reading the entire authorised mailbox. It is not limited by Google to a particular alias or sender.
The implementation queries messages addressed to a unique test alias, from the configured ARBI sender, with the expected subject and recent delivery time. It retrieves matching message headers and text to extract verification codes. It also reads the mailbox profile to confirm it is connected to the configured test account.
Use and processing
Message contents and verification codes are processed in memory to complete the staging tests. Synthetic account details and the corresponding code are sent to ARBI staging for registration and sign-in verification. The tool does not sell mailbox data, use it for advertising, or use it to train AI models.
Storage, access and service providers
OAuth credentials are stored as encrypted GitHub Actions secrets and in a Windows DPAPI-encrypted operator backup outside the source repository. GitHub runners or the operator's machine use these credentials to call Google Gmail APIs and the ARBI staging service.
The tool does not intentionally include message bodies, verification codes, passwords, or OAuth tokens in test logs or evidence reports. Reports contain check outcomes, deployment identifiers, timestamps, and aggregate cleanup counts. Access to the credentials and test execution is managed by the ARBI operator.
Retention and deletion
GitHub Actions evidence artifacts are configured for 14-day retention. Test emails remain in Gmail: the tool has no permission to delete or modify them. The mailbox owner can manage or delete those messages directly in Gmail. Synthetic application accounts are removed as part of test cleanup; this does not remove their emails from Gmail.
Revoking access
The mailbox owner can revoke the tool's access through Google Account connections. The operator can remove the GitHub secrets and encrypted local backup to stop automated access. Revoking access or removing credentials causes future email tests to fail until access is configured again.
Contact
For privacy questions or requests relating to the tool, contact carterwellsdeveloper@gmail.com.