Privacy Policy
Korro reads your Gmail only to show it to you as conversations. It shows no ads, sells nothing, builds no profiles, and uses no AI on your mail.
What Korro is
Korro is an email client that shows Gmail as conversations, on the web at app.korro.email and in the Korro app for iPhone and iPad (together, “Korro”). It is invite-only: only people invited by its operator can create an account, and each person's Korro holds only the Gmail accounts they connect themselves. Nobody using Korro can see anyone else's mail.
This policy explains what Korro collects, why, where it is kept, who else handles it, and how to remove it.
Who runs Korro
International AI Academy LLC (შპს ინთერნეიშენალ ეი აი აკადემი), identification code 405786957, legal address Betlemi Street N10, Tbilisi, Georgia.
Email lasha@aiacademia.ge · Phone +995 599 168 727
What Korro accesses
When a Google account is connected, Korro asks Google for:
- Your email address, to know which account signed in.
- Gmail access (the
gmail.modifypermission), to read messages, send replies you write, and change labels such as read or unread.
Korro cannot change your Google account's password or settings, and it does not access Google Drive, Contacts, Calendar or any other Google service.
What Korro keeps
- Your account: the email address you signed in with and the Gmail accounts you connected.
- Your mail: copies of messages and their details (sender, recipients, subject, date, labels) and the photos and files attached to them.
- What you do in Korro: chats marked Important, snoozes, tasks, the account each chat replies from, and photos and files you attach to messages you send.
- Your devices: the sessions you are signed in with and, if you allow notifications, each device's notification address.
- Server logs: for up to a few weeks, the address your requests came from and what they asked for — including the addresses of the chats you opened — to keep Korro working and to find faults. Never the text of a message.
Korro does not collect your location, contacts, calendar, browsing, or payment details, uses no advertising identifiers or tracking, and has no analytics that follow what you do.
How the data is used
Only to show your mail in Korro, to send messages you write, to tell you about new messages if you turn on notifications, and to keep the things you organise there, such as chats marked Important and tasks. Korro shows no ads, sells nothing, and builds no profiles.
No AI. Korro does not use artificial intelligence or machine learning on your mail, and nothing from your mail or your Google account is ever used to train AI models.
No person reads your mail except you — unless you ask for help with a specific message, it is needed for security, or the law requires it.
Where it is stored
Copies of messages and their details are kept on a server run by Korro's owner at Hetzner in Germany, so that Korro can show them quickly. The keys that let Korro reach Gmail are stored encrypted. All connections use HTTPS.
On your iPhone or iPad
- A copy of your recent chats is kept on the device so Korro opens instantly, protected by the device's encryption. Signing out removes it.
- Widgets use a small copy — names, first lines of new messages, counts and open tasks — kept in Korro's own storage on the device. On the lock screen, widgets show names and counts, never message text.
- Your sign-in is kept in the device's Keychain.
- Photos and files you pick are read only when you choose them, and uploaded only to send them.
- Notifications are sent through Apple Push Notification service, which receives the device's notification address and each notification — the sender's name and address, the Gmail address it was sent to, and the first words of the message — in order to deliver it. You can turn notifications off in the device's Settings.
Who else handles it
- Google holds your Gmail itself. Korro reads and changes it on your behalf.
- Hetzner (Germany) hosts the server.
- Cloudflare carries traffic to it.
- Apple delivers notifications to iPhone and iPad.
- Sentry receives error reports from the server and crash and hang reports from the iPhone app (what failed and where in the code — never what you wrote), and a copy of the server's logs for 30 days, with mail contents, email addresses, your address on the internet and access keys removed before they are sent.
Nothing is shared with anyone else, unless the law requires it — and then only what it requires.
Google API Services
Korro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Removing access and data
Delete your Korro account at any time in the app: open your accounts sheet and choose “Delete my Korro account”. Everything Korro stored for you is deleted at once — your connected Gmail accounts and the copies of their mail, chats, tasks, uploads, sessions and settings — and Google is told to forget Korro's access. Your mail in Gmail itself is not touched. Encrypted backups that still contain your data are deleted automatically within 14 days.
You can also remove Korro's access at myaccount.google.com/permissions, or disconnect a single Gmail account inside Korro — which deletes the copies of that account's mail.
How long it is kept
For as long as you have a Korro account, and not after: disconnecting a Gmail account or deleting your Korro account deletes what Korro kept for it at once, and backups within 14 days. Error reports hold no mail or addresses and are kept for a limited time to fix problems.
Your rights
You can ask to see the personal data Korro holds about you, to correct it, to receive a copy in a portable format, to delete it, or to object to or restrict how it is used. Most of this you can do yourself in Korro; for the rest, write to lasha@aiacademia.ge and you will get an answer within 30 days. Korro does not sell or share personal data, so there is nothing to opt out of. You can also complain to the Personal Data Protection Service of Georgia or to the data protection authority where you live.
Korro processes your data to provide the service you ask for (reading, showing and sending your mail), with your permission (the Gmail access you grant, and notifications), and in its legitimate interest in keeping Korro secure and working (error and crash reports).
Security
All connections use HTTPS. The keys that let Korro reach Gmail are encrypted at rest with a key kept outside the database; sign-ins are stored only as one-way hashes. Google requires an app that reads Gmail to pass an independent security assessment before the public can connect, and every year after; Korro will not open beyond its invited circle before it has. If you believe you have found a security problem in Korro, write to lasha@aiacademia.ge with “Korro security” in the subject; you will hear back within two working days. If Korro ever learns that someone reached your data without permission, you will be told what happened, what was affected and what was done about it, without undue delay.
Countries
Korro's server is in the European Union (Germany). Cloudflare, Apple and Sentry may process data in other countries, under the safeguards their own agreements provide.
Children
Korro is not meant for children under 13, or under 16 where local law requires it, and does not knowingly hold their data. If you believe a child has an account, write to us and it will be deleted.
Changes to this policy
When this policy changes, the date at the top changes. If a change matters to how your data is used, Korro will tell you in the app before it applies.
Contact
International AI Academy LLC, Betlemi Street N10, Tbilisi, Georgia.
Email lasha@aiacademia.ge · Phone +995 599 168 727