KoraCal Privacy Policy

Effective date: September 22, 2026

KoraCal (“we”, “us”) is a calendar assistant available at koracal.ai and in the KoraCal iOS app. It connects to your Google account with read-only access, finds calendar-relevant content in your email, and adds the events and tasks it finds to your agenda, where you can edit or remove them. This policy describes what data we collect, how we use it, how it is stored, how it is shared, how long we keep it, and how you can delete it. It applies to the KoraCal web app and its companion native apps.

Google user data we access

If you connect a Google account, KoraCal requests only these OAuth scopes and accesses only the Google user data they cover:

• Sign-in (OpenID / email / profile): your name and email address from Google so we can create and identify your KoraCal account. We do not receive or store your Google password.
• Gmail (https://www.googleapis.com/auth/gmail.readonly): we periodically scan your recent messages (a rolling window of the last few days, excluding spam) and read message headers, bodies, calendar-invite attachments (.ics), and text from PDF and Word attachments (.pdf, .doc, .docx) when present. The text of calendar-relevant threads is stored so you can see the source email behind each calendar item. We cannot send, delete, label, or modify email.
• Google Calendar (https://www.googleapis.com/auth/calendar.readonly): we read events from the calendars you choose to sync (roughly 30 days past to 180 days ahead) and mirror them into your KoraCal agenda. We cannot create, change, or delete events in your Google Calendar.

We also store the OAuth refresh token Google issues so syncing can run in the background, and the Google account email address so you can tell connected accounts apart.

How we use Google user data

Google user data is used only to provide and improve user-facing KoraCal features that you can see in the app:

• Email text is analyzed by an AI model to extract events and tasks (title, time, location), which are added to your KoraCal agenda. You can edit or remove anything it adds.
• Google Calendar events are displayed alongside your other KoraCal items in one agenda.
• The source email (sender, subject, body) is shown to you next to each extracted item so you can verify where it came from.

We do not use Google user data for targeted, personalized, retargeted, or interest-based advertising; to sell to data brokers or information resellers; to determine credit-worthiness or for lending; to create marketing databases; or to develop, improve, or train generalized or non-personalized AI or machine-learning models. Humans do not read your Google user data except with your explicit permission (for example a support request), where necessary for security or abuse investigation, to comply with applicable law, or after the data has been aggregated and anonymized.

AI processing of Google user data

To extract events and tasks, the text of calendar-relevant email threads and content you submit is sent to OpenAI’s API solely to provide that user-facing extraction feature. OpenAI acts as our processor for this feature. Per OpenAI’s API terms, it does not use API inputs to train its models. Extraction results are returned to KoraCal and appear on your agenda linked to the source message.

Google Workspace APIs are not used to develop, improve, or train generalized or non-personalized AI and/or ML models.

Google API Services User Data Policy (Limited Use)

KoraCal’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other information we collect

Account information

When you sign in with Google or Apple, we receive your name and email address from the identity provider. Sign-in is handled by AWS Cognito.

Apple Calendar and Reminders (iOS app only)

If you grant calendar access, the iOS app reads events from your Apple calendars on the device (roughly 30 days past to 180 days ahead) and uploads them to your KoraCal agenda. If you grant reminders access, it reads incomplete reminders from the lists you choose and uploads them as KoraCal tasks. We cannot create, change, or delete items in Apple Calendar or Reminders.

Content you submit

You can paste or share text (for example a group-chat message) into KoraCal for extraction. Voice mode on supported clients uses the microphone to capture speech so you can add or change calendar items by talking; we process that audio to provide Voice and do not use it for advertising.

Billing and technical data

If you subscribe on the web, payments are processed by Stripe. If you subscribe in the iOS app with Apple, payments are processed by Apple In-App Purchase. We store your subscription status but not your card or Apple ID payment details. Our servers keep standard operational logs (timestamps, request metadata, error diagnostics, and app usage metrics such as feature-use counts) to run, debug, and improve the service. We also record first-party website page views (path, host, referring site, and an anonymous visitor id stored in your browser) so we can see koracal.ai traffic on the admin dashboard. Usage metrics do not include event titles, email bodies, or voice transcripts.

How your data is shared, transferred, or disclosed

We do not sell personal data. We do not transfer or disclose Google user data to third parties except as needed to provide or improve KoraCal’s user-facing features, or as required by law:

• Amazon Web Services — hosting, storage, and email delivery for notifications;
• OpenAI — AI extraction of events and tasks from text, as described above;
• Stripe — web subscription billing (Stripe does not receive your Google user data);
• Apple — In-App Purchase when you subscribe in the iOS app (Apple does not receive your Google user data);
• Google / Apple — sign-in and the data connections you authorize;
• Google Ads — website conversion measurement (page views and sign-ups) via the Google tag on koracal.ai. This measures ad performance; it does not use Gmail or Calendar contents.

We may also disclose data if required by law, or as part of a merger or acquisition — in which case Google user data would remain subject to this policy’s Limited Use commitments. We do not transfer Google user data to third parties for advertising, data brokerage, credit, lending, or to train generalized AI/ML models.

Website advertising measurement

We use the Google tag (Google Ads) on the KoraCal website to measure page views and completed sign-ups so we can understand whether our ads are working. That tag may set cookies or similar identifiers in your browser. It is separate from the Google account connection you authorize for email and calendar: we do not use Gmail or Calendar contents for advertising or remarketing.

How we protect Google user data

• All data is hosted on Amazon Web Services and encrypted in transit with TLS and at rest.
• Google OAuth refresh tokens are additionally encrypted at the application level with AES-256-GCM before being written to the database; the encryption key is managed in AWS Secrets Manager, not in code or client apps.
• Access to production systems is restricted. Changes applied on your behalf are recorded in an audit log.

Retention and deletion

• Email-derived content, extraction results, and calendar items are retained while your account is active so your history stays available. When the retention period for a given type of data ends (account deletion, or disconnect of a Google account for tokens and that account’s sync data), we delete it.
• Disconnecting a Google account (Settings) deletes our stored OAuth tokens for that account and stops all syncing. You can also revoke KoraCal’s access at myaccount.google.com/permissions.
• Deleting your account (Settings → Data → Delete account) permanently removes your calendar items, tasks, ingested email content, extraction drafts, stored tokens, app usage records, and sign-in identity, and immediately cancels any Stripe subscriptions. Apple In-App Purchase subscriptions continue until cancelled in iPhone Settings → Apple ID → Subscriptions.
• Exporting your data: Settings → Data lets you download your data at any time.
• Operational logs are kept for a limited period for debugging and security.

Your controls

• Choose which Google calendars sync, per connected account.
• Block specific senders so their email is not turned into calendar items.
• Edit or delete anything the AI adds — deleted items are not re-created by later syncs.
• Disconnect accounts, export data, or delete your account at any time.

Changes to this policy

If we make material changes, we will update this page and the effective date above, and notify you in the app or by email when the changes meaningfully affect how your Google data is handled.

Contact

Questions or privacy requests: admin@koracal.ai.