Updated October 19, 2026
Sora helps you see what matters in your email and turns it into a simple plan. This policy explains what Sora reads, what it keeps, and what it never does. It's written in plain English on purpose.
When you connect Gmail, you sign in with Google. Sora asks for read only access to Gmail (the gmail.readonly permission) plus your name and email address. Sora never sees or asks for your password.
When you connect Outlook (a school or personal Microsoft account), you sign in with Microsoft. Sora asks only for read only mail access (the Mail.Read permission) and your basic profile. The sign in key stays in your iPhone's Keychain.
Sora cannot send, reply to, delete, archive, label, or change any email. It can only read.
To sort your inbox, Sora looks at the sender, subject, date, and a short preview of your recent emails.
When you ask Sora a question about your email, it searches your Gmail and reads the few emails that match, including attached PDFs and text files, only to answer that question.
When you open an attached file, Sora shows it on your phone and deletes its copy as soon as you close it.
Sora uses this only to show you what needs your attention, your to-dos, your briefs, and answers to your questions. Nothing else.
Supabase runs Sora's server and keeps your sign in account (your email address and a user ID).
OpenAI processes the email details described above to sort emails and answer questions. Sora sends them with storage turned off, and OpenAI does not use data sent through its API to train its models.
Google provides sign in and Gmail access. Microsoft provides sign in and Outlook access.
On your phone: your to-dos, past chats with Sora, settings, and short email summaries (sender, subject, and a one line summary). Full email bodies are not saved. This file is encrypted by iOS while your phone is locked and is not included in iCloud backups.
On Sora's server: only your account (email address and user ID). Sora's server does not store or log the contents of your email.
Sora never sells your data.
Sora never uses your email to train AI models.
Sora never shows you ads or shares your data with advertisers.
Sora never changes anything in your Gmail or Outlook.
Sora's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In Sora, go to Settings, then Delete my data. This deletes your Sora account on the server, erases everything Sora saved on your phone, and removes Sora's access to your Google account.
You can also remove Sora's access anytime at myaccount.google.com/permissions. For Outlook, disconnect it in Sora's Settings, or remove Sora at account.microsoft.com/privacy/app-access (personal accounts) or myapps.microsoft.com (school accounts).
Reminders and briefs are planned on your phone. You can turn them off in Sora's Settings or in your iPhone's Settings.
Sora is not meant for anyone under 13, and Sora does not knowingly collect data from children under 13.
If this policy changes, Sora will update the date at the top and let you know in the app when the change is important.
Questions? Email kingdaniel18000@gmail.com.