One Privacy Policy for the web app and both Android apps: what we collect, that we never train on your content, end-to-end encrypted web chats, retention periods, your rights, and product supplements that keep the Gmail Limited Use disclosures for RAI Inbox and RAI Assistant word for word.
This Privacy Policy explains how Aerendir Mobile Inc. ("Aerendir", "we", "us") collects, uses, shares and protects personal data when you use RAI: the chat.aerendir.ai web app, the RAI Assistant and RAI Inbox Android apps, and the services behind them (the "Services"). It applies to consumers. Product-specific details for each app, and disclosures required in particular regions, are in Section 11. Questions go to privacy@aerendir.ai.
Our design principle is that your data stays with you: every app has a fully on-device mode, chats stored with us from the web app are encrypted in your browser before they reach us, and we do not train models on your content.
Data you give us.
Data collected automatically. Device type and operating system, app version, IP address and approximate location derived from it, sign-in events (time, IP, device), usage counters (requests, tokens, voice minutes, sessions, images), error logs, and, on the web, cookies or local storage needed to keep you signed in and remember settings. We do not use advertising or cross-site tracking cookies.
Data from third parties. Google, if you sign in with Google (name, email, profile image, Google account ID). Stripe, for payment events. Model providers, for usage and error information about requests routed to them.
We use personal data to:
We do not use your Inputs or Outputs to train models, and we do not sell personal data or share it for targeted advertising.
Depending on where you live you may have the right to know what personal data we hold, to access and export it, to correct it, to delete it, to restrict or object to processing, to withdraw consent, to opt out of marketing, and to complain to a supervisory authority. Many of these you can do yourself: export your data and delete your account from Settings, turn off chat history, choose on-device or private modes, revoke sessions and devices, and disconnect Google at any time. For anything else write to privacy@aerendir.ai from your account address; we respond within the time the law allows and you may appeal a decision by replying. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Aerendir is a United States company; our backend runs in the European Union and some models run in the United States. When data moves between regions we rely on appropriate safeguards such as standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework commitments of our providers.
We keep personal data only as long as reasonably necessary for the purposes above. In particular:
We protect data with encryption in transit (TLS) and at rest, client-side end-to-end encryption for web content, hardware-backed key storage on Android, access controls, logging and regular review. No system is perfectly secure; tell us at privacy@aerendir.ai if you believe your data has been exposed.
The Services are for adults. We do not knowingly collect personal data from anyone under 18 (or the higher age required where they live). If you believe a minor has an account, write to privacy@aerendir.ai and we will delete it.
We may update this policy. Each version has a version number and effective date and is archived at https://aerendir.ai/legal/archive/. For material changes we notify you by email and inside the Services before they take effect and show you a summary of what changed. Continuing to use the Services after the effective date means the new version applies to the data we hold.
Aerendir Mobile Inc., 2570 W El Camino Real, Suite 222, Mountain View, CA 94040. Privacy questions and requests: privacy@aerendir.ai. Legal notices: legal@aerendir.ai.
Where the GDPR or UK GDPR applies, we process personal data on these bases: performance of our contract with you (providing the Services, billing, support); our legitimate interests (security, abuse prevention, improving the Services with aggregated data, keeping legal records), balanced against your rights; your consent, where you connect a service or enable a feature that asks for it, which you can withdraw at any time; and compliance with legal obligations.
RAI Inbox is an email client for Android with on-device AI. This supplement adds to the policy above for that app.
Google API Services User Data — Limited Use Disclosure. RAI Inbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
Gmail OAuth scopes requested and why. RAI Inbox requests the following Gmail OAuth scopes. Each is requested only for the user-facing functionality described below, and we have chosen the narrowest scopes that allow the App to function.
https://www.googleapis.com/auth/gmail.readonly — What the App does with this data: reads messages, threads, labels, and metadata from your Gmail mailbox to display them in the App's inbox UI, organize them into threads, render attachments, and feed them into on-device AI features (triage, summarization, semantic search, draft generation). Why a narrower scope is not sufficient: gmail.metadata does not provide message bodies, which are required to display email content the user expects to see in an email client and to power AI features that operate on message content.https://www.googleapis.com/auth/gmail.send — What the App does with this data: sends emails the user composes, including AI-assisted replies that the user reviews and approves before sending. The final outgoing message is always shown to the user and must be explicitly approved before transmission. Why a narrower scope is not sufficient: no narrower Gmail scope allows the App to send mail on the user's behalf. gmail.compose would still permit sending and would additionally grant draft creation, which is not required.We do not request gmail.modify, https://mail.google.com/, or any other Gmail scope beyond gmail.readonly and gmail.send.
On-device processing. All Gmail messages, attachments, and metadata synced to the App are stored locally on your device in a private, app-sandboxed SQLite database not accessible to other applications. Vector embeddings used for on-device semantic search are computed locally on the device and stored encrypted at rest using AES-256-GCM with keys held in the Android Keystore. Aerendir does not store your Gmail messages, attachments, or metadata on its servers. Your inbox data does not transit Aerendir's infrastructure except as a transient payload to the AI provider you chose when you invoke a cloud AI feature (see Section 3).
Permissions. Internet (sync and AI services); Microphone (voice commands and wake word); Contacts (recipient suggestions); Accounts (Google sign-in and multi-account); Foreground service (background sync).
RAI Assistant is a voice-first AI assistant for Android with an on-device model. This supplement adds to the policy above for that app.
Google API Services User Data — Limited Use Disclosure. RAI Assistant's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
Gmail OAuth scope requested and why. RAI Assistant requests a single Gmail OAuth scope, https://www.googleapis.com/auth/gmail.modify, so the assistant can read your messages and send mail you have drafted with its help. What the App actually does with this data: reads messages, threads, and metadata so the assistant can answer questions about your email by voice or text; and sends emails the assistant has drafted on your behalf, only after you explicitly review and confirm the draft. What the App does not do despite holding this scope: the App does not archive, delete, label, or otherwise bulk-modify your mail. Why this scope rather than narrower ones: the companion application RAI Inbox uses gmail.modify for full email management; sharing the scope across both apps in the same Google Cloud project means there is one Google verification covering both, and you see one consent prompt rather than two. The App's actual runtime usage stays inside the read + send subset. We do not request https://mail.google.com/, gmail.settings.*, or any other Gmail scope beyond gmail.modify.
On-device processing. The App ships with an on-device large language model that powers conversational responses in private mode without contacting any cloud model, and an on-device sentence-embedding model used for the App's retrieval-augmented memory. Gmail messages, SMS searches, contact lookups, and embeddings are stored locally in a private, app-sandboxed SQLite database encrypted with SQLCipher (AES-256), not accessible to other applications. Aerendir does not store your Gmail messages, SMS, contacts, or voice transcripts on its servers. Your data does not transit Aerendir's infrastructure except as a transient payload to the AI provider you chose when you invoke a cloud AI feature (see Section 3).
Voice. Cloud voice sends audio to the provider you chose for transcription and reply; usage is metered in minutes and sessions. On-device voice does not leave the phone.
Permissions. Internet; Network state (offline and metered awareness); Microphone (voice input); Audio settings and Bluetooth (headset routing); Activity recognition (adapts response length to motion); Contacts (lookup tools); SMS read and receive (SMS search tool); External storage on Android 12 and below (user-initiated backup files).
Liveness verification. If you use a feature that verifies a live person, a short camera capture is processed to produce a liveness result; the result and a reference are kept for the life of the account, the raw capture is not retained.
If you are in the European Economic Area, the United Kingdom or Switzerland: Aerendir Mobile Inc. is the controller; the legal bases in Section 10 apply; you have the rights in Section 4 and the right to lodge a complaint with your local supervisory authority; international transfers are described in Section 5. Contact privacy@aerendir.ai to exercise any right.
If you are a California resident, the California Consumer Privacy Act gives you the right to know the categories and specific pieces of personal information we collect, use, disclose and sell or share; to delete it; to correct it; to opt out of sale or sharing; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising. The categories we collect are listed in Section 1 (identifiers, commercial information, internet activity, geolocation derived from IP, audio and visual information where you use voice or liveness features, and inferences only in the form of on-device memory you control). Submit requests to privacy@aerendir.ai or through Settings; an authorised agent may act for you with written permission.