How Klorn handles work data

Klorn is an AI attention firewall for your email. It reviews Gmail and Calendar context, classifies incoming messages into attention tiers (PUSH / QUEUE / SILENT / AUTO), summarizes what matters into daily briefings, and prepares actions — replies, labels, archiving — that touch your mailbox only with your approval.

When you use Klorn, we may collect or store the following data.

• Account information such as email address and name.
• Google OAuth tokens needed to connect Gmail and Calendar and run background sync.
• If you link a secondary Google account, the same categories of data for that account. A calendar-only link grants read-only calendar access; a full inbox link grants Gmail access. Each linked account grants Klorn only the scopes shown on its own Google consent screen.
• Gmail metadata and content such as sender, recipients, subject, snippet, body, labels, read state, thread ID, AI-generated summaries, and reply-needed signals.
• Calendar event information such as title, time, attendees, location, and description.
• Product data you create in Klorn, including tasks, reminders, notes, commitments, approved actions, feedback, notifications, and chat messages.
• Usage, token, error, and delivery logs needed to operate and improve the beta.

Klorn uses data only to provide and improve the product. Examples include:

• Syncing Gmail and Calendar after you connect Google.
• Creating morning briefings and finding messages or meetings that need review.
• Preparing approval proposals, reminders, tasks, and notifications.
• Measuring whether Klorn suggestions are useful during beta.
• Debugging reliability issues, preventing abuse, and protecting the service.

Klorn requests Gmail and Calendar permissions to read work context, identify important messages, understand calendar context, and prepare actions for your approval.

Klorn does not sell Google user data, use it for advertising, or transfer it to unrelated third parties. Google user data is used only to provide or improve the Klorn features you see.

Email sending is treated as a sensitive action. During beta, Klorn does not send replies without your awareness. Email actions require your approval before sending.

Limited Use disclosure. Klorn's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Specifically: Klorn does not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger or acquisition; Klorn does not use Google user data for serving ads; Klorn does not allow humans to read Google user data unless we obtain affirmative agreement from the user, it is necessary for security purposes, to comply with applicable law, or the data is aggregated and used for internal operations in accordance with the Limited Use requirements; and Klorn does not use Google user data to develop, improve, or train generalized or non-personalized AI and/or ML models. Any AI processing of Google user data is performed only to provide the user-facing features you request, on a per-message basis, and is not used to train the AI providers' models.

Scopes Klorn requests and why.

• gmail.readonly — read message metadata and bodies to classify priority, detect reply-needed signals, extract commitments and deadlines, and prepare daily briefings.
• gmail.modify — toggle read/star labels, archive, and move messages to trash (reversible) on commands you initiate or approve.
• gmail.send — send a reply only after you explicitly approve it. Every send is verified against a receipt of the exact content you approved.
• calendar.events — read upcoming events to surface meetings, link commitment due dates, and prepare meeting context. Edits require user approval.
• calendar.readonly — check availability across all your calendars to detect scheduling conflicts. When you link a secondary Google account for calendar visibility, this read-only scope is the only calendar access requested for it.
• openid, userinfo.email, userinfo.profile — sign you in and show which Google account is connected.

Depending on where you live, you may have rights to access, correct, export, or delete the personal data Klorn holds about you, and to object to or restrict certain processing. To exercise any of these rights, contact k0820086@gmail.com. We respond within a reasonable time after verifying your identity. You may also revoke Klorn's Google access at any time from your Google account permissions.

Klorn may send relevant work context such as email snippets, bodies, calendar details, tasks, and notes to AI model providers for summarization, classification, drafting, and prioritization. We send only the context needed for the feature you are using. This processing happens per request to produce the result you asked for; your Google user data is never used to develop, improve, or train generalized or non-personalized AI or ML models, and we configure our AI providers under API terms that do not train their models on the data we send.

Klorn's server-side AI providers are Google (Gemini API) and OpenRouter, both used under API terms that exclude training on submitted data. If you bring your own API key or point a self-hosted Klorn at your own OpenAI-compatible endpoint, that provider is used only for your own requests.

We retain account and workspace data while your account is active. You can export your data or delete it at any time.

• Self-service deletion. You can delete your account and all associated data from Settings at any time. Deletion takes effect immediately: all Google-derived data — messages, summaries, calendar events, and OAuth tokens — is permanently removed from Klorn's database in the same operation.
• Export and workspace reset. Settings also offers a full data export and a workspace reset that deletes all synced and derived data while keeping your account.
• Operational logs. Logs are deleted automatically on a fixed schedule: agent, email-processing, and notification-delivery logs after 90 days; push rate-limit records after 30 days; billing webhook records after 90 days; aggregate AI usage accounting after 180 days.

To request deletion by email instead, contact k0820086@gmail.com. Deleting Klorn data does not delete messages or events from your Google account unless you explicitly approve that action inside Klorn.

Klorn uses access controls, authentication, and operational safeguards to protect user data. Google OAuth tokens are encrypted at rest using AES-256-GCM. All data access is scoped to your account, transport is TLS-encrypted, and your Google user data is stored only in Klorn's own database — it is not shared with analytics or advertising services. Klorn's infrastructure sub-processors are Render (API hosting), Vercel (web application hosting), and Supabase (managed Postgres database, hosted in Seoul, ap-northeast-2); they store and transmit data solely to operate Klorn.

Because Klorn is a beta product, avoid connecting accounts that contain information you are not comfortable using with a beta service.

For questions, deletion requests, or security concerns, contact k0820086@gmail.com.