Privacy policy — Basil Contacts MCP
Effective date: October 16, 2026
Basil Contacts MCP is a private, single-user integration operated by Yeghiche Manoukian. This policy explains how the integration handles Google Contacts information when the operator enables and authorizes it.
Access and purpose
The integration requests read-only Google Contacts permission to support targeted contact searches and retrieval of selected records. It also uses Google identity information to restrict authorization to the configured operator’s email address and stable Google account identifier.
Google’s read-only permission can cover the account’s contacts broadly. The application limits its exposed tools to bounded searches and reading records selected from recent search results. It offers no contact creation, editing, deletion or bulk-export tool.
Search results can contain contact identifiers, names and company names. Selected records can contain names, phone numbers, email addresses, company names, departments and job titles. Search requests may also perform a small preliminary Google People API query to initialize search; its results are discarded.
Information flow and sharing
The operator’s request passes through Grok to the integration’s Cloudflare Worker. The Worker queries Google People API and returns the requested contact information to Grok.
Grok may include that information in model context, responses and conversation history. Google, Cloudflare and Grok process information under their respective service terms and privacy policies. The operator should consider those policies before authorizing access.
This integration does not sell contact information or include advertising or model-training functionality. This statement does not determine how third-party providers handle information under their own terms.
A retrieved contact is information only. It does not grant permission to call, message, disclose information or make commitments.
Storage and security
The Worker does not maintain a duplicate contacts database or intentionally persist contact responses or search queries in application storage. It processes those values to fulfill requests and marks application responses as non-cacheable.
The service stores authentication and session information, client-registration records, the authorized Google identity, token hashes and replay-protection records, rate-limit counters, and temporary hashed references to selected contacts. Selected-contact references expire after ten minutes. Other records expire according to their security purpose and the service’s cleanup process.
Google credentials required to renew access are stored as Cloudflare Worker secrets. Operator-controlled setup can also produce private local credential files; those require separate protection and removal by the operator.
Application observability is disabled in the staged deployment. The application is designed not to log contact contents or credentials. This does not guarantee that infrastructure providers retain no operational or security metadata.
Retention limitations
MCP sessions have a 45-day inactivity limit and a 180-day absolute lifetime. Some security records remain until their associated expiration and cleanup.
Information returned to Grok may remain in conversations or other provider systems according to the applicable account settings and provider policies. The integration cannot guarantee automatic deletion from Grok or other third-party systems. Revoking access does not erase information already shared.
Revocation and deletion
The operator can revoke Google access through the Google Account’s third-party connections controls. The operator can also disconnect the Grok connector and have the MCP session revoked or the Worker disabled.
Removing stored credentials or local setup files requires separate operator action. Previously shared information must be managed through the relevant provider’s history and deletion controls, subject to that provider’s retention limitations.
Contact and changes
Questions or requests concerning this integration may be sent to basil@manoukian.com.
This policy should be updated if the integration’s data handling materially changes.