← backkael

Privacy Policy

Effective date: 2026-04-17  ·  Last updated: 2026-06-10

This document is Kael's official Privacy Policy. It also includes two companion sections that make the same facts easier to scan:

  1. Privacy Policy
  2. Data & Compliance Summary
  3. AI & Claude Usage Policy

For any questions or to exercise your rights, email admin@trykael.com.


1. Privacy Policy

This Privacy Policy explains what information Kael ("we", "us", "the app") collects when you use the Kael applications on iPhone and Mac, why we collect it, how we use it, and the choices you have. By installing or using Kael you agree to this policy.

Short version. Kael is a focus tool. We collect the minimum information needed to run your account, show you your own focus stats, and keep our AI reason-judge service online. We do not sell your data. We do not read your browsing history. The list of apps or sites you choose to block never leaves your device.

If you connect a Google account (optional, Kael Pro): Kael reads your Google Calendar events to time blocking around classes and meetings, and — for Kael Pro subscribers — reads the subjects + snippets onlyof emails from the last 24 hours every 30 minutes to surface events and deadlines you haven't added yet. Email bodies, attachments, contacts, and threads are never read. Email content is sent transiently to Anthropic's Claude API for parsing and is never stored on our servers.

1.1 Who we are

Kael is operated by Kael (the "Controller"). You can reach us about this policy at admin@trykael.com.

1.2 What we collect

1.2.1 Information you give us directly

  • Account email address — from Sign In with Apple or Google. Apple may provide a private relay address; we accept that.
  • Display name — optional; only shown on the opt-in leaderboard.
  • Your written "reason" — each time you request to unblock an app or site, the free-text reason you type. Sent to our AI judge service (see §1.3.1) to decide whether to approve. Not stored verbatim on our servers after the evaluation is complete.
  • (Optional) Google account access — if you choose to connect a Google account (Settings → Calendar), we receive OAuth tokens permitting Kael to read calendar events (calendar.readonly) and, for Kael Pro, email metadata + subject + snippet (gmail.readonly). Tokens are stored only on your device. You can revoke at any time from myaccount.google.com → Security → Third-party apps → Kael, or from in-app Settings.

1.2.2 Information generated by your use of the app

  • Intercept events — per unblock attempt: the app or site name you requested, the outcome (approved / denied / expired), the minutes granted, and the timestamp. Stored in our database (Supabase) tied to your user ID so that you can see your own insights.
  • Aggregate focus stats — streak count, total blocks, approval rate. Used to show you your own insights and, if you opt in, a global leaderboard (display name + streak + totals only).

1.2.2a Google Calendar + Gmail data (only if you connect a Google account)

  • Calendar events— pulled from every connected Google Calendar to detect when you're in a meeting/class and tighten blocking. Event titles + start/end times are read; nothing is written back to your calendar. Stored only on your device.
  • (Kael Pro only) Email subjects + snippets — every 30 minutes while the app is in use, Kael fetches metadata (subject, sender, snippet, received timestamp) for messages received in the last 24 hours from each connected Google account. Email bodies, attachments, contact lists, message threads, and the contents of any individual full message are never read. This data is sent transiently to Anthropic's Claude API via our Supabase Edge Function (claude-judge in extract-emails mode) to detect events and deadlines occurring in the next 24 hours, which surface as one-tap "Suggested Tasks". The email content is not stored on our servers; Anthropic retains logs for up to 30 days per their commercial API terms.

1.2.3 Information stored only on your device (never sent to us)

  • The list of apps and websites you have chosen to block.
  • Your daily schedule and focus windows.
  • Your on-device "reflection memory" (how you have justified past unblocks).
  • Your device's Screen Time / Family Controls authorization.

1.2.4 What we explicitly do NOT collect

  • We do not collect your browsing history.
  • We do not collect the content of any website you visit.
  • We do not collect location data.
  • We do not collect your contacts, photos, microphone, or camera input.
  • We do not use third-party analytics SDKs (no Firebase, no Segment, no Mixpanel, no ad networks).
  • We do not read the bodies, attachments, full message content, contact list, sent folder, or thread history of any email — only the subject, sender, snippet, and received timestamp of recent inbox messages, and only if you have connected a Google account and are on Kael Pro.
  • We do not write to, modify, or delete any calendar or email content in your Google account.

1.3 Why we collect it — and the legal basis

Under GDPR terminology, we rely on the following lawful bases:

PurposeDataBasis
Creating and maintaining your accountemail, user IDContract — you asked to use the app
Showing you your own focus statsintercept eventsContract
Running the AI reason-judge when you unblockreason text (ephemeral)Contract
Keeping the judge service secure (rate limits)user ID, IP addressLegitimate interest
Reading Google Calendar events to time blockingcalendar event titles + timesConsent (you connect the account)
(Pro) Reading recent Gmail subjects + snippets to suggest taskssubject, sender, snippet, received timestampConsent (you connect the account + opt into Pro)
Leaderboard participationdisplay name + statsConsent (opt-in toggle)
Crash diagnostics, legal complianceminimalLegal obligation / legitimate interest

1.3.1 AI processing (Anthropic)

When you submit a reason to unblock something, the text is forwarded to Anthropic's Claude API via our Supabase Edge Function claude-judge. The reason, the destination name, and today's task list (if any) are the only fields sent. We do not attach your email or user ID to that upstream request. Anthropic processes the text to generate a decision and does not use it to train their models under Anthropic's commercial API terms.

When Kael auto-classifies your calendar events (Pro), the event title and start/end timestamps from each entry are sent to Anthropic via the same edge function (categorize mode) to split them into "event" vs "deadline" buckets. No other fields from your calendar are sent.

1.3.2 Gmail processing (Anthropic) — Kael Pro only

If you are on Kael Pro and have connected a Google account, every 30 minutes while the app is in use Kael sends the subject, sender, snippet, and received timestamp of inbox messages from the last 24 hours to the same Supabase Edge Function (claude-judgein extract-emails mode). Anthropic's Claude reads only those fields and returns a list of events/deadlines occurring within the next 24 hours. Email bodies, attachments, contacts, and threads are not sent. Anthropic does not use this content to train their models under their commercial API terms; Anthropic retains API logs for up to 30 days. The extracted suggestions are stored only on your device; nothing about your email content is written to our servers.

1.4 Retention

DataRetained
Account (email, user ID)Until you delete your account
Intercept eventsUntil you delete your account
Leaderboard statsUntil you delete your account or disable leaderboard opt-in
Written reasons (upstream AI)Not stored by us; Anthropic retains logs for up to 30 days per their policy
Google OAuth tokens (calendar + gmail)On your device only; until you disconnect the account or sign out
Calendar event titles + timesOn your device only; refreshed on every sync
Gmail subjects + snippetsNot stored by us; sent transiently to Anthropic per scan; Anthropic retains logs ≤ 30 days
Extracted email-derived task suggestionsOn your device only; until you accept or dismiss the suggestion (7-day TTL on dismissals)
Rate-limit metadata (IP, timestamp)Ephemeral — held in memory only for the duration of the rate-limit window, never written to disk

1.5 Sharing and sub-processors

We share data only with these service providers, solely to run the app:

Sub-processorPurposeLocation
Supabase, Inc.Database + Auth + Edge FunctionsUS
Anthropic, PBCAI reason judgment, calendar categorization, email task extractionUS
Apple, Inc.Sign In with Apple, App Store, APNsUS / EU
Google LLCSign In with Google (OAuth); Google Calendar API; Gmail API (Kael Pro, optional, metadata + snippet only)US

We do not sell your personal information. We do not share it with advertisers. Disclosure to law enforcement is limited to valid legal process.

Kael's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail and Calendar data are used only to provide and improve the in-app calendar-sync and task-suggestion features, are never sold, never used for advertising, and never transferred to others except as needed to provide those features (our AI sub-processor), for security, or to comply with law.

1.6 Your rights

Depending on where you live, you have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate data (e.g. update your display name).
  • Delete your account and all associated data.
  • Export your data in a portable format.
  • Withdraw consent (e.g. leaderboard opt-out) at any time.
  • Object to processing based on legitimate interest.
  • Lodge a complaint with a supervisory authority (EU/UK) or your state Attorney General (US).

To exercise any right, email admin@trykael.com. We reply within 30 days. Account deletion is also self-serve in Settings → Account → Delete account.

1.6.1 California (CCPA / CPRA)

Categories we collect: Identifiers (email, user ID), Internet or other network activity (intercept events), Inferences (focus stats). We do not sell or share personal information for cross-context behavioural advertising. California residents have the rights listed in §1.6.

1.6.2 EEA / UK (GDPR)

Controller: Kael. Data transferred to US sub-processors under Standard Contractual Clauses. Contact us at admin@trykael.com for any GDPR-related requests.

1.6.3 Children (COPPA)

Kael is not directed at children under 13. We do not knowingly collect data from users under 13. If you believe a child has signed up, email us at admin@trykael.com and we will delete the account.

1.7 Security

  • All traffic to our servers uses HTTPS (TLS 1.2+).
  • Supabase Row-Level Security ensures you can only read/write your own rows.
  • The AI judge endpoint requires your signed-in user token and is rate-limited to 5 requests per 15 minutes.
  • Authentication tokens are stored locally on your device; we recommend keeping your macOS / iOS up to date and using a passcode.

Despite reasonable safeguards, no system is 100% secure. We will notify affected users within 72 hours of confirming any breach that puts personal data at risk, as required by applicable law.

1.8 Changes to this policy

If we make material changes, we will notify you in-app and update the "Last updated" date above at least 14 days before changes take effect. Continued use after that date constitutes acceptance.

1.9 Contact

Privacy questions: admin@trykael.com


2. Data & Compliance Summary

Audience: users who want to know exactly what Kael collects, where it goes, and how it lines up with common privacy regulations.

This section is a plain-English companion to the Privacy Policy (§1 above). The Privacy Policy is the authoritative legal document; this section exists to make the same facts easy to scan.

2.1 Data inventory — every field we touch

FieldWhere it livesCollected fromPurposeRetention
User ID (UUID)Supabase auth.users, deviceAuth providerPrimary key for your accountUntil account deletion
EmailSupabase auth.usersSign In with Apple / GoogleAccount recovery, supportUntil account deletion
Display nameSupabase profiles.display_nameYouLeaderboard (opt-in)Until account deletion
Leaderboard opt-in flagSupabase profiles.leaderboard_opt_inYouControls whether your stats show in the public leaderboardUntil account deletion
Intercept event (site name, outcome, minutes, timestamp)Supabase intercept_eventsGenerated by the app when you unblockPersonal insightsUntil account deletion
Streak, total blocks, approval rateSupabase leaderboard_statsAggregated from intercept eventsDashboard + leaderboardUntil account deletion
OAuth access + refresh tokenYour device only (Keychain / UserDefaults)Auth providerKeep you signed inUntil sign-out
Blocked apps / sitesYour device only (Family Controls + App Group)YouLocal shieldingLocal, never synced
Schedule / focus windowsYour device onlyYouLocal schedulingLocal, never synced
Reflection memory (past reasons)Your device onlyYouOn-device heuristicsLocal, never synced
Reason text (when unblocking)Sent to claude-judge → Anthropic, not stored server-sideYouAI decisionAnthropic retains ≤ 30 days
Google OAuth tokensDevice only (Keychain / UserDefaults)Google OAuthCalendar + (Pro) Gmail accessUntil disconnect
Calendar event titles + timesDevice onlyGoogle Calendar APITime blocking, mode evaluation, suggested tasksRefreshed each sync
Calendar event titles + times (during sync)Sent to claude-judge → Anthropic, not stored server-sideYou / Google CalendarAuto-classify as event vs deadline (Pro)Anthropic retains ≤ 30 days
Gmail subjects + snippets + sender + received-atSent to claude-judge → Anthropic, not stored server-sideGmail API (your inbox, last 24h)Extract next-24h tasks (Pro)Anthropic retains ≤ 30 days
Email-derived task suggestionsDevice only (in-memory + UserDefaults dismiss cache)extract-emails result"Suggested Tasks" UIUntil accepted / dismissed (7-day TTL on dismissals)
IP address (edge function)In-memory rate-limit cache onlyHTTP requestAbuse preventionEphemeral — never written to disk

2.2 Data-flow diagram

┌──────────────┐  1. Sign in (Apple / Google)        ┌──────────────────┐
│ Mac / iPhone │ ───────────────────────────────────▶│ Supabase GoTrue  │
│              │◀────── access + refresh token ──────│ (/auth/v1)       │
│              │                                     └──────────────────┘
│              │
│              │  2. Record intercept event          ┌──────────────────┐
│              │ ───────────────────────────────────▶│ Supabase REST    │
│              │   (Row-Level Security = only you)   │ (/rest/v1)       │
│              │                                     └──────────────────┘
│              │
│              │  3. Unblock request → reason        ┌──────────────────┐
│              │ ───────────────────────────────────▶│ claude-judge     │
│              │  (auth: your user JWT, 5/15min)     │ (Edge Function)  │
│              │                                     └────────┬─────────┘
│              │                                              │
│              │                                              ▼
│              │                                     ┌──────────────────┐
│              │                                     │  Anthropic API   │
│              │◀────────── JSON decision ───────────│  (Claude)        │
│              │                                     └──────────────────┘
│              │
│              │  4. (Optional) Google Calendar      ┌──────────────────┐
│              │ ───────────────────────────────────▶│ Google Calendar  │
│              │  (OAuth token, calendar.readonly)   │ API (you authd)  │
│              │◀────────── event list ──────────────│                  │
│              │                                     └──────────────────┘
│              │
│              │  5. (Pro) Auto-classify events      ┌──────────────────┐
│              │ ───────────────────────────────────▶│ claude-judge     │
│              │   (mode=categorize, title+time)     │  → Anthropic     │
│              │◀──── event/deadline labels ─────────│                  │
│              │                                     └──────────────────┘
│              │
│              │  6. (Pro, every 30min) Gmail meta   ┌──────────────────┐
│              │ ───────────────────────────────────▶│ Gmail API        │
│              │  (OAuth token, gmail.readonly)      │ (you authd)      │
│              │◀── subject+snippet+from+ts (24h) ───│                  │
│              │                                     └──────────────────┘
│              │  7. Extract email tasks             ┌──────────────────┐
│              │ ───────────────────────────────────▶│ claude-judge     │
│              │   (mode=extract-emails)             │  → Anthropic     │
│              │◀── next-24h events/deadlines ──────│                  │
└──────────────┘                                     └──────────────────┘

NOT SENT to any server:
  • Your list of blocked apps / sites
  • Your schedule / focus windows
  • Your reflection memory
  • Your OAuth refresh token
  • Any email body, attachment, contact list, or thread history
  • Any calendar entry you decline to sync
  • Anything Kael writes BACK to Google (we never do — read-only scopes)

2.3 Why we collect each thing

  • Why email? Required by Supabase Auth. Used only for account recovery and support. Apple Private Relay addresses are accepted.
  • Why intercept events? So your Insights screen can show you your own trends. They are keyed by your user ID, protected by RLS so only you can read them, and deleted when you delete your account.
  • Why IP address briefly? To rate-limit the AI judge (5 requests per 15 minutes). It is held in an in-memory cache on the edge worker only — never written to disk — and discarded when the isolate terminates.
  • Why display name? Only to label your row on the leaderboard, and only if you have turned leaderboard opt-in on.

2.4 Regulatory mapping

GDPR (EU / UK)

  • Controller: Kael — contact admin@trykael.com.
  • Lawful basis table: see §1.3 above.
  • International transfers: data flows to Supabase and Anthropic in the US under Standard Contractual Clauses.
  • DPIA: the AI judge flow is the only "high-risk" processing and has been assessed — the input is free-text the user voluntarily types, no special-category data is solicited, and upstream retention is capped at 30 days.
  • Rights: access, rectification, erasure, portability, restriction, objection, and to lodge a complaint with your supervisory authority. See §1.6 above.

CCPA / CPRA (California)

  • Categories collected: Identifiers (email, user ID); Internet or other network activity (intercept events); Inferences drawn from the above (focus stats).
  • Sold or shared: No. We do not sell personal information and do not share it for cross-context behavioural advertising.
  • Rights: know, delete, correct, opt-out of sale/share (N/A since we do neither), limit use of sensitive info (we collect none), and non-discrimination.

COPPA (US, under-13)

Kael is not directed at children under 13. We do not knowingly collect data from users under 13. Minimum age for an account is 13.

Google API Services User Data Policy

Kael's use of information received from Google APIs (Calendar + Gmail) adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide the in-app calendar-sync and task-suggestion features, is never sold, never used for advertising or to train generalized AI models, and is only transferred onward to our AI sub-processor as needed to deliver those features (or for security / legal compliance).

Apple App Privacy (App Store Connect)

We declare the following in our App Privacy questionnaire:

  • Data linked to you: Email, User ID, Product Interaction (intercept events), Other Usage Data (streak / approval rate).
  • Data not linked to you: Crash diagnostics (if enabled).
  • Data used for tracking: None.
  • Third-party SDKs: None that collect personal data.

2.5 Your controls

  • See your data: Settings → Account shows your email, display name, and totals. Ask us and we will send a JSON export.
  • Leaderboard opt-in: Settings → Leaderboard. Off by default.
  • Delete everything: Settings → Account → Delete account. Triggers a cascade that removes profiles, intercept_events, and leaderboard_stats rows for your user. Local state is also wiped.
  • Revoke Apple sign-in:iOS Settings → Apple ID → Sign-In & Security → Sign in with Apple → Kael → Stop using Apple ID.
  • Revoke Google sign-in (also revokes Calendar + Gmail access): myaccount.google.com → Security → Third-party apps → Kael. You can also disconnect a single account from in-app Settings → Calendar Settings → the connected Google account row.
  • Stop email scanning without disconnecting Google: turn off Kael Pro, or remove the Google account entirely. Disabling email scanning while keeping calendar sync alone is on the roadmap.

2.6 Contact

Privacy / data questions: admin@trykael.com

Security vulnerability reports: admin@trykael.com (please use responsible disclosure — we respond within 72 hours).


3. AI & Claude Usage Policy

3.1 How Kael Uses AI

Kael uses Claude, an AI model made by Anthropic, in three places:

  1. Reason judging — evaluating your typed reason when you request to unblock a guarded app.
  2. Calendar categorization (Pro) — sorting your synced calendar entries into "events" vs "deadlines".
  3. Email task extraction (Pro) — extracting events/deadlines that fall in the next 24 hours from recent Gmail metadata.

All three round-trip through our Supabase Edge Function claude-judge, which authenticates with your user JWT and rate-limits requests.

3.2 What Gets Sent to Claude

When you attempt to open a guarded app (all tiers):

  • The reason you type in the prompt box
  • Your stated tasks or goals for the day
  • The name of the app you are trying to open
  • (Kael Pro only) The current Kael mode label so Claude can calibrate strictness

When Kael syncs your calendar (Pro only):

  • The title, start time, end time, and all-day flag of each calendar entry being classified

When Kael scans recent email (Pro only, every 30 minutes while the app is open):

  • For each inbox message received in the last 24 hours: the subject, sender address, snippet (Gmail's auto-generated ≤200-char preview), received timestamp, and Gmail message ID.
  • NOT sent: email body, attachments, contact list, full message content, sent folder, drafts, archived/older messages, thread history, label list, or anything from other Google services.

No other personal data is shared. Your name, account email, location, browsing history, contacts, photos, microphone, and camera are never sent to Claude.

3.3 How It's Used

For reason judging, Claude returns a single decision — approved or blocked, plus a suggested minute window. For calendar categorization, Claude returns an "event" or "deadline" label per input row. For email extraction, Claude returns a list of next-24h tasks with extracted times, kinds, and labels keyed back to the input message IDs.

Anthropic does not store or use any of these inputs to train their models under their standard commercial API terms. Anthropic retains API request logs for up to 30 days per their data policy.

3.4 Prompt-Injection Protections

Kael's server-side prompt explicitly instructs Claude to treat every user-supplied field (destination name, tasks, upcoming items, your typed reason) as untrusted inputto evaluate, never as instructions to follow. Attempts to redefine Claude's role, reveal the system prompt, or override the JSON output schema are treated as low-quality reasons and rejected via the normal denial flow. All user input is also sanitized client-side and server-side before being included in the prompt (control characters stripped, prompt-section delimiters neutralized, length capped).

3.5 Third-Party AI Provider

Anthropic is an independent company. By using Kael, you acknowledge that the content you type in the reason box will be processed by Anthropic's API. You can review Anthropic's privacy practices at anthropic.com/privacy.

3.6 Your Control

You can delete your account and all associated data at any time from Settings → Account → Delete account. You can disconnect your Google account at any time to stop all calendar + Gmail processing.


Document last updated: 2026-06-10 — official Privacy Policy, including the Data & Compliance Summary and AI & Claude Usage Policy companion sections. The 2026-06-10 revision extends the policy to the Mac app and documents Kael Pro's optional Google Calendar integration and Gmail-based "Suggested Tasks" feature (metadata + snippet read, 30-min cadence, transient processing by Anthropic, no body access, no server-side storage).

© 2026 Kael  ·  admin@trykael.com  ·  Terms of Service