Gmail data use

Current availability

Gmail connections use a Google testing application. Only approved Google test users can connect.

Test authorizations and refresh tokens expire after seven days. Public Gmail access requires further Google verification.

What Swarm accesses

Google grants Swarm permission to view Gmail messages and settings. Swarm uses this permission to search your mailbox.

The current tool returns message IDs, thread IDs, and the Subject, From, and Date headers. It does not fetch message bodies or attachments.

Swarm sends your search query to Google. The server also reads your Gmail address to identify the connected account.

What Swarm stores

Swarm stores the connection name, Gmail address, settings, and tool permissions in its Supabase database.

The server encrypts saved access and refresh tokens. A refresh token lets the server obtain access after the current access token expires.

The Gmail tool processes search results for each request. Its application code does not save message headers or search results in the database.

Search approval requests temporarily store the encrypted query and result limit. The server clears this encrypted data after use or denial.

Expired requests cannot execute. During approval activity, Swarm clears expired query data that is available for cleanup. Locked records can require later activity.

Approval identifiers, key hashes, request hashes, and decision times remain in the database. These records have no automatic expiry.

This statement does not describe infrastructure logs, backups, or the storage practices of your agent provider.

Who can receive results

Agents with your Swarm key can request searches through your enabled Gmail tool. Each search requires approval on the Swarm website.

The approval page shows the mailbox, query, result limit, and agent key fingerprint. A fingerprint is a short identifier for the key.

Approval permits one attempt for that request and key within ten minutes. Changing the query, limit, or connection requires another approval.

You must confirm permitted agent data use before approval. Swarm sends approved results through its server to the requesting agent.

Swarm does not verify the agent provider's identity. Anyone holding the requesting key can receive that request's approved results.

If you share the Gmail tool with an organization, members' agents can search the connected mailbox. Sharing applies to the tool, not selected messages.

Sharing does not expose your saved Google credentials to organization members. Your agent provider can store results under its own terms.

Use an agent only if its handling of Gmail data meets your requirements and Google's applicable data-use rules.

How to stop access

1. To stop tool access, clear the Gmail tool selection and select Save tools.
2. To stop organization access, withdraw the Gmail tool share.
3. To remove the active saved connection, select Remove on its account card.
4. To revoke Google's authorization, remove the Swarm application from your Google Account connections.
5. To stop an agent key, select Revoke key in Swarm.

Removing a Swarm connection deletes its active connection row, saved credentials, pending authorization, and organization shares.

Removal does not revoke Google's grant or erase results already received by agents. Backups and earlier imported credential copies need separate operator handling.