QuralAi icon QuralAi

PRIVACY POLICY

Last updated: 17 August 2026.

What we do not do

We do not copy your Gmail, Calendar, or Drive into our own archive. We do not browse your mailbox in the background. Connecting Google is optional. An agent calls Google APIs only when you ask it to help.

Storage and protection of sensitive data

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information, including Google user data obtained through Google APIs.

We keep data only as long as needed to operate the service. When you delete your account or disconnect an integration, related data and tokens are removed.

  • Encryption in transit: the App talks to our API over HTTPS (TLS). Calls to Google APIs also use HTTPS/TLS.
  • Encryption at rest: the Google connection key (OAuth refresh token) and your own AI keys (BYOK) are stored encrypted on our servers, not as plaintext on the device.
  • Google’s short-lived access token is not saved in our database; Google issues it per request and we use it only for that call.
  • We do not copy or archive Gmail, Calendar, Drive, Sheets, or Docs content into our own storage. An agent may retrieve only the data needed for the task you asked, for the duration of that request.
  • Access controls: production systems that hold encrypted Google tokens are not publicly accessible. Support may access systems only to fix an outage. We do not open your Gmail as a mailbox and we do not read other people's email out of curiosity.
  • Google and provider secrets are not built into the app in a way that would let a phone dump someone else's mail.
  • Backups follow the same account-deletion rules.

Google Workspace Limited Use

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

We do not use Gmail, Calendar, Drive, Sheets, or Docs data to train or improve our own AI models, and we do not sell that data. If an agent handles such a request, the needed fragment is sent to an AI provider only to answer you and only for the duration of that request. Requests through OpenRouter are routed only to Zero Data Retention models: the provider does not store them and does not use them for training.