Privacy Policy

Who we are and what this policy covers

Qaris provides Qaris AI, the desktop application, its Android companion, and the website at qaris.io. This policy covers personal data handled through those services, including connected Google accounts. Contact us at [email protected] for privacy questions, access requests, corrections or deletion requests. Connected services can have separate policies for their own services.

Information we access and collect

Qaris AI stores agent profiles, conversations, memories, files, commands, browser sessions and integration settings on the computer or server that runs your agents. That host may belong to you or to an organization whose team you join. Authorized team members can access data according to their permissions. The Android app connects to an approved host to display and control your agents.

If you use the account service, it handles account identifiers, email address, display name, avatar, host registration, memberships, invitations and session records. Where paid services are enabled, order and entitlement records are also processed. Websites, account infrastructure and update downloads can produce technical records such as IP address, request time, browser information and error status. Product analytics, where enabled, records feature use and technical performance; message bodies, files and Google Workspace content are not intended analytics inputs.

When you ask an agent to use a connected service or AI model, the relevant request, instructions and returned content can be sent to that service or model provider. Generated audio and images can involve the Qaris AI gateway and Google's AI services. These requests are separate from authorization to access your Google Workspace account.

The contact form

The contact form at qaris.io/contact collects your name (optional), your email address, a topic and your message. We use them only to read your message and to answer you. We do not use them for marketing or advertising, and we do not add your email address to a mailing list.

When you send the form, the website host (Cloudflare) passes it to a small program that e-mails the message to the Qaris team. That program reads your IP address only to limit how many messages one address can send in a short time; it does not store the IP address with your message. It also reads the country that Cloudflare infers from your IP address and adds it to the e-mail. The message goes to the Qaris team's mailbox through our email delivery provider. A backup copy of the name, email address, topic, message, time and country is kept in Cloudflare storage, so a message is not lost if e-mail delivery fails.

We keep the e-mail in the team mailbox and the backup copy for up to 12 months, then delete both. To ask for an earlier deletion, or for a copy of what you sent, write to [email protected] from the address you used in the form. Do not put passwords, tokens or other secrets in the message.

Your Qaris mailbox

Each Qaris account has its own e-mail address at qaris.io (an address that an account made earlier is at qaris.co.zw and keeps working). Mail you send to it from your own sign-in address, or from addresses you allow, is given to the Mailbox agent on your Qaris server, which reads the attached files and replies to you by e-mail.

What is stored. The mail as received (with its attachments), its text, and a short record of it: when it arrived, its size, its status, and the sender and subject in encrypted form. Replies and any files the agent sends with them are stored the same way. Addresses you allow or block are kept in encrypted form too.

Where. On Cloudflare (Workers, D1 and R2 storage), encrypted with keys that only the Qaris account service holds. Your Qaris server downloads and decrypts a mail only to work on it, and keeps it in the Mailbox agent's task like any other chat. Replies are sent through Cloudflare Email Sending.

Who can access it. You, and the servers you own, through your signed-in Qaris apps. Mail from senders you have not allowed waits until you allow them and is never given to an agent before that. Qaris staff do not read mail; logs record only message ids, sizes and error codes.

Deletion. Mail stays until you delete it in Settings > Mailbox, which also deletes its stored files; mail from senders you never allowed is deleted after 30 days. When an account is deleted, all of its mail is deleted and its address is kept reserved so nobody else can receive mail at it. The storage the mailbox uses counts toward the same quota as online uploads.

Do not send passwords, keys or other secrets by e-mail. The text and files of an e-mail are treated as material to work on: the agent does not follow instructions written inside them, and anything beyond reading and replying waits for your approval in the Qaris app.

Google user data: access and purpose

Connecting Google is optional. You sign in on Google's authorization page and review the permissions requested for the Google services you enable. Basic account information can include your name, email address, profile picture and account identifier. Depending on your connected services and granted permissions, Qaris AI can access:

• Gmail: message headers and bodies, attachments, drafts, labels and supported mailbox settings, to search and summarize mail, prepare drafts, send requested messages and organize your mailbox.
• Google Drive: file names, identifiers, metadata, permissions and file contents, to find, read, create, update, download or share files for your tasks.
• Google Docs, Sheets and Slides: document text, spreadsheet cells and presentation content, to read, summarize, create and edit your documents.
• Google Calendar: calendars, event details, times, locations and attendees, to find availability and manage requested events.
• Google Contacts: names, email addresses, telephone numbers and other contact fields, to find and manage contacts.
• Google Tasks: task lists, task text, due dates and completion status, to manage your tasks.
• Google Forms: form structure, questions, settings and responses, to work with forms and summarize responses.

Some permissions permit broad read and write access to the connected service. The Google consent screen shows the actual permissions requested; enabling a service does not mean every possible record is read. Agents use the access to carry out the tasks and routines you authorize. Sending, sharing, modifying or deleting Google content changes the corresponding Google account and may affect other people.

Google user data: use, sharing and AI processing

We use Google user data only to provide or improve the user-facing functions described here. Content returned by a Google tool can enter the agent's conversation and be sent to the AI provider you selected to complete your request, such as summarizing an email or editing a document. Relevant content can also go to a recipient or another connected service when you expressly request a send, share, export or other transfer. Do not connect an account or authorize a task if you do not want this processing.

No AI training: Qaris does not use Google user data, including data derived from it, to develop, train or improve generalized or non-personalized AI or machine-learning models. Google user data must not be transferred to a model provider for those purposes. Task-specific model inference is used to answer your request, not to train a general model. Because Qaris AI supports providers and endpoints that you configure, use only provider accounts and settings that prohibit training on Google user data. A provider's data retention and processing terms still apply to its service.

We do not sell Google user data, share it with data brokers, or use it for advertising, retargeting, credit scoring or lending decisions. Transfers are limited to providing the visible features you consent to, security and abuse investigation, compliance with applicable law, or a business transfer after your explicit prior consent where required by Google's policy. Service providers that process such data for us must follow these restrictions.

Our personnel do not read Google user data except with your affirmative agreement for specific data, when necessary for security or abuse investigation, to comply with applicable law, or for legally permitted internal operations using aggregated and anonymized data. Do not include private content or credentials in a support request unless it is needed and you choose to share it.

Limited Use statement: Qaris AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and protection

Google content is retrieved by the Google Workspace integration running on your agent host. OAuth access and refresh tokens are stored in that host's application data folder. The central Qaris token service processes authorization codes and refresh tokens to exchange them with Google; it does not intentionally persist or log their contents. It does not receive your Gmail messages or Drive files as part of that token exchange.

We use HTTPS for service connections, authorization controls and restricted access to service credentials. Mobile and remote host connections use encrypted transport. Local Google credential files rely on the host's file permissions; do not assume that all local files or the local database are encrypted at rest. Protect the host with suitable access controls and disk encryption. Other stored credentials use operating-system protection where the integration supports it. No security measure can guarantee complete protection.

Providers involved in processing can include our hosting and account infrastructure, Google, your chosen AI provider and integrations you enable. Processing may take place outside your country. Limit the data you authorize for a task and check the provider's terms before connecting it.

Retention

Google tokens remain on the host while the connection is active, unless revoked, invalidated or removed. Retrieved content can remain in chats, files, memories, exports or provider session records until you remove it using the relevant controls. Disconnecting Google stops future access through that connection but does not erase previously saved content or copies already shared with others.

Account and service records are kept while needed to operate the service, maintain security, resolve disputes or meet legal obligations. We do not promise a fixed retention period for all data: local retention depends on your host and backups, while external providers apply their own disclosed schedules. Backups can retain residual copies until their applicable retention period ends; retained copies must remain protected and are not used to resume a deleted connection.

Disconnecting, access and deletion

You can disconnect Google apps in Qaris AI's Marketplace. When the last Google app using a connection is disconnected, the app attempts to revoke its token at Google and removes the local credential file. If Google cannot be reached, local removal can still occur; revoke access directly in Google Account third-party connections to ensure Google's grant is removed. You can reconnect later by granting access again.

Delete saved chats, memories and files separately if you also want to remove previously retrieved Google content. Downloads, exports, backups, model-provider records and documents in Google remain separate copies. Uninstalling Qaris AI alone may leave application data on the host. Back up anything you need, quit the application, and remove its stored data when you intend to erase it. On a shared host, contact its owner or administrator.

For account or service data that Qaris controls, email [email protected] with your access, correction or deletion request. We may need to verify your identity. Do not send passwords or tokens. We will handle requests under applicable law and explain any lawful retention requirement. We cannot directly erase data on a host you or another organization controls, or copies retained by an independent provider; contact the relevant controller as well.

Children and policy changes

Qaris AI is not directed to children under 13. Do not provide children's personal data without the authority and safeguards required by applicable law. Contact us if you believe a child has provided data improperly.

We will update the date on this page when the policy changes. Material changes to Google data access or use require appropriate notice and renewed consent before the new use starts. See the Terms of Use.