What this notice covers
CALAS App Email is operated by the CALAS app team using cityuhk.calas@gmail.com. It is the account-email component of the CALAS native app pilot.
This notice covers the public information pages, the lab mailbox's send-only authorization and account-email delivery. It also describes the account information intended for the passwordless pilot, which is being prepared. Native app sign-in is not publicly available yet.
The planned app includes membership, directory, news and events, calendar, knowledge and request features. Additional disclosures will be provided before those features collect information beyond the purposes described here.
Google access: sending from the lab mailbox
Only the lab mailbox operator grants Google authorization. Receiving a CALAS email does not give the app access to your Google account.
The email service requests only https://www.googleapis.com/auth/gmail.send, which permits sending email on behalf of the authorized sender. It sends account-related messages from cityuhk.calas@gmail.com, including verification, sign-in and recovery messages when the corresponding pilot flow is enabled.
The service does not request Gmail inbox reading, message management or deletion, contacts, Google Drive access, or access to recipients' mailboxes.
Google API data is used only to provide and support the account-email service described here. Our handling of that data follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google API data, use it for advertising, or use it to train artificial intelligence or machine-learning models.
Information and why it is used
Account email delivery
To send an account message, the service processes the recipient's email address, the sender address, the subject and message body, and the account action or code needed for that message. These details are sent to Google for delivery. The service receives delivery API identifiers or a failure status for operational checks.
The authorized sender's OAuth client configuration and refresh token are used to obtain send-only access tokens. These credentials are for the lab sender, not for email recipients.
Planned passwordless pilot
When pilot account flows open, the service will process an email address, a display name if provided, an internal account identifier, short-lived authentication values and session records. Session and security records may include device or browser information and IP addresses to support access control, session management and abuse prevention.
Membership applications and app permissions are separate from email verification. Optional university sign-in through Auth0 is not enabled for this pilot preparation; its data use will be disclosed before it is made available. Passkey enrollment and recovery instructions will accompany their release.
Visiting this information site
These static pages have no forms, advertising, analytics scripts or site-set cookies. The hosting service may process ordinary web request metadata, such as an IP address, browser information, requested URL and request time, to deliver and protect the site.
Storage and retention
Sender OAuth credentials are kept outside the public site and source repository in restricted operator storage. Deployed service credentials will be kept in server-side secret storage. Recipients are not given the sender's credentials.
The service uses delivery counters and recipient-derived identifiers to limit repeated sends. Authentication values and sessions are retained only for their account and security purposes and are subject to expiry. Pilot account records are retained while the account is active or needed to operate the pilot, until a verified deletion request is completed.
Sending an email creates copies in the sender's Gmail mailbox and the recipient's mailbox. These copies can remain after an authentication code or link expires and are retained until deleted under the relevant mailbox's controls. The app's send-only Google permission cannot delete mailbox messages.
Sender credentials are retained while authorization is active and needed for delivery. Hosting and email providers may retain operational records under their service settings and policies. We do not promise a fixed deletion time for copies controlled by those providers or by recipients.
Your choices, access and deletion
Contact cityuhk.calas@gmail.com to ask about information held for the pilot, request a correction or deletion, or stop participation. We may need to verify that a request comes from the account or mailbox owner before changing its information. Please do not send passwords or sign-in codes to support.
The lab mailbox operator can revoke CALAS App Email's authorization in Google Account permissions and ask the app team to remove the stored sender authorization. Revocation stops future token refreshes; it does not recall messages already sent.
If you receive an account message you did not request, you can leave its code or link unused and contact the app team about repeated messages.
Changes and contact
We will update this notice when the pilot changes how it handles information. New Google data access or a new use of Google data will be disclosed before it is enabled, with renewed consent where required.
For privacy questions and requests, email the CALAS app team at cityuhk.calas@gmail.com.