Cremind Connect logoCremind Connect
Open source · Part of the Cremind project

Real-time events for your self-hosted AI — without handing over your keys.

Cremind Connect delivers real-time Gmail, Calendar, Drive, and Jira events to your local Cremind app — without ever storing your OAuth tokens or your data.

Get CremindView source
  • Token-less
  • Stateless at rest
  • MIT licensed
  • Open & auditable

The connective tissue between your assistant and the cloud

Cremind is an open-source, self-hosted personal AI assistant that runs on your own machine. Cremind Connect is its companion relay: it owns the small amount of cloud infrastructure that Google and Atlassian require for real-time push, so your local assistant can react to new email, calendar and Drive changes, and Jira updates the moment they happen.

It is the backend that powers Cremind’s Google and Atlassian Agent Skills — and it is built so that infrastructure never holds your data. Cremind Connect is operated by the Cremind project as the official backend for these integrations — the same Cremind you approve on the Google sign-in screen.

Real-time push needs infrastructure one person can’t run alone

Getting live notifications from Google or Atlassian requires organization-level pieces an individual can’t self-provision. Cremind Connect owns exactly those shared pieces — and nothing else.

A Pub/Sub topic
Gmail push is delivered to a Google Cloud Pub/Sub topic that has to be owned and verified by an organization.
A verified webhook domain
Google Calendar and Drive push require a verified HTTPS domain to receive change notifications — not something an individual registers ad hoc.
A reviewed OAuth consent screen
Connecting to Google and Atlassian requires a registered, reviewed OAuth app and consent screen.
How it works

Two planes. Your tokens never cross into ours.

Cremind Connect separates authorization (getting permission) from events (knowing something changed). Your tokens live only in the first plane — on your machine.

01
Verify
A provider — Gmail via Pub/Sub, Calendar, Drive, or Jira via webhook — pushes a notification to Cremind Connect, which cryptographically verifies it really came from the provider.
02
Hash
It turns the account's email into a one-way hash: a short routing key. The key only decides which connections to notify — the email itself is never stored or logged.
03
Nudge
It broadcasts a single content-free message over WebSocket to every app that proved control of that account. No email, calendar, file, or issue data is ever inside it.

Your app then re-syncs the actual data itself, using its own token.

The entire payload it broadcasts
{
  "type": "resync",
  "source": "gmail",
  "ts": 1717939200
}
Authorization stays on your machine
Your local app signs in to Google directly with a loopback PKCE flow, and the tokens it receives never leave your machine — for Google, Cremind Connect is never in the token path. Atlassian uses a confidential flow, so the relay briefly performs the token exchange on your behalf, hands the tokens back to your app, and discards them — storing nothing.
Missed nudges self-heal
Offline when a nudge fires? Nothing is lost. Your app re-syncs on reconnect, because the relay keeps no queue and no state to miss. Routing keys are recomputed from each event, and live connections are ephemeral.

We can’t lose what we never hold

Privacy isn’t a policy bolted on afterward — it’s the architecture. The relay is designed so there is nothing sensitive to store, leak, or subpoena.

No tokens stored
Your OAuth access and refresh tokens stay on your machine. The relay never persists them.
No content seen
Cremind Connect never reads your emails, calendar entries, or issues. It relays a “something changed” nudge — your app fetches the data itself.
Stateless at rest
Routing keys are derived on the fly, connections are ephemeral, and the only cache holds Google's public keys and single-use replay tokens — both auto-expiring.
Read the full privacy policy

The Google data Cremind asks for — and why

When you connect a Google account, Cremind requests only the scopes needed for the features you enable. Here is every piece of Google data it asks for, and the reason.

Basic profile — name & profile picture
userinfo.profileShown so you can confirm which Google account you connected, and to label that account inside the Cremind app.
Email address & sign-in
openid · userinfo.emailIdentifies the account you linked and derives the one-way routing key that delivers real-time events to your session. Your email is never stored by Cremind Connect.
Gmail — read & send
gmail.readonly · gmail.sendRead and search your messages, and send the emails and replies you compose or approve. Accessed only on your own device, at your request.
Calendar events
calendar.eventsCreate, view, update, and delete your own calendar events for the scheduling features you enable.
Drive files
driveSearch, read/download, upload, and organize the Drive files you point Cremind to — including files you reference by link.
Docs & Sheets
documents · spreadsheetsCreate and read/edit the Google Docs and Sheets you name, so Cremind can work with your existing content.

Cremind runs on your own machine. When you connect Google, sign-in happens directly between your device and Google (loopback + PKCE); your access and refresh tokens are stored only on your machine, and Cremind Connect is never in the token path. Cremind’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See our Privacy Policy.

Plugs into the skills you already use

Cremind Connect powers Cremind’s built-in Agent Skills for Google and Atlassian — handling credential discovery, webhook routing, and real-time push so the skills work live while your data stays local.

Gmail
Google · Live mailbox events via Pub/Sub.
Real-time
Google Calendar
Google · Live event changes via webhook.
Real-time
Google Drive
Google · Live file changes via changes.watch webhook.
Real-time
Google Sheets
Google · Read/write via OAuth; file events via Drive.
Execution-only
Google Docs
Google · Read/write via OAuth; file events via Drive.
Execution-only
Jira
Atlassian · Live issue changes via dynamic webhooks.
Real-time
Confluence
Atlassian · Content access today; real-time events planned.
Events coming soon

Confluence real-time push isn’t available yet for OAuth apps, so the Confluence skill works by polling today. Real-time support is planned for a future release.

Don’t trust us — read the code

Cremind Connect is MIT-licensed and fully public. The entire relay — and the Terraform that provisions its cloud infrastructure — lives in one small repository, so anyone can verify exactly what it does (relay notifications) and what it doesn’t (hold your data).

Browse the repositoryRead the architecture

Frequently asked questions

Run your own assistant. Keep your own data.

Cremind is the open, self-hosted personal AI. Cremind Connect is the relay that keeps it in sync — privately.

Get CremindStar on GitHub