Privacy policy
How Kortex handles data from Google accounts.
Last updated 15 September 2026.
Scope of this policy
Kortex is a single-user personal system operated by Kilazi ("we"). It is not offered to the public and has no customers. This policy describes what happens to data that the account owner authorises Kortex to access through Google OAuth.
What data we access
Only data belonging to the Google account that grants consent. Depending on the scopes approved, that can include:
- Gmail — message metadata and content, labels, and the ability to send mail as the account owner.
- Calendar and Tasks — events, task lists and task items.
- Drive, Docs and Sheets — file listings, file content, and the ability to create and edit files.
- YouTube and YouTube Analytics — channel content, uploads, and performance metrics.
- Search Console and Google Analytics — impressions, clicks, sessions and event counts for properties the account owner controls.
- Basic profile — the account's email address, used to confirm which account is connected.
Why we access it
To provide the account owner with their own assistant and memory: surfacing mail and calendar items that need attention, answering questions about past activity, drafting and sending messages the owner asks for, publishing the owner's own content, and reporting on the owner's own websites. There is no other purpose.
How it is stored
Data retrieved from Google is stored on infrastructure controlled by Kilazi: a PostgreSQL database on a private server, and local files on the owner's own machines. OAuth tokens are stored server-side with restricted file permissions and are never exposed to a browser or to any client-side code. Access is limited to the account owner.
What we do not do
- We do not sell, rent or trade Google user data.
- We do not share it with third parties, other than the infrastructure providers needed to run the system (hosting and, where the owner asks a question in natural language, the language-model provider that answers it).
- We do not use it for advertising, ad targeting, or building profiles of anyone.
- We do not use it to train generalised machine-learning models.
- We do not allow humans to read it, except the account owner, and except where required by law, needed to resolve a security incident, or where the data has been aggregated and de-identified.
Limited Use
Kortex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention and deletion
Data is kept for as long as it is useful to the account owner. The account owner can revoke Kortex's access at any time at myaccount.google.com/permissions. On request to the address below, stored data derived from a Google account will be deleted.