Privacy Policy
Last updated 2026-11-02. This describes what the NORA application actually does today, not generic template language.
NORA is a private, self-hosted AI assistant built and operated by its owner for personal and household use. It is not a public multi-tenant service, it is not offered to the general public, and it has no public sign-up. This policy explains what information NORA processes, why, and how it is handled — including, specifically, its access to Google account data.
Information NORA processes
- Account credentials: a username and password for each authorized person's own login, used to authenticate access to the application.
- Email content and metadata (via Gmail), when the Google integration is connected.
- Calendar events (via Google Calendar), when the Google integration is connected.
- User-provided content: projects, tasks, objectives, notes, and messages typed directly into NORA.
Google account information and scope
When the user connects their Google account, NORA requests the following, and only the following, permissions:
- Gmail — read access (
gmail.readonly): to read and classify incoming email so NORA can organize it and identify what needs attention. - Gmail — compose access (
gmail.compose): to prepare draft replies. NORA never sends email automatically. Sending or any other outbound email action requires the user's own, explicit, in-the-moment approval. - Calendar — read access (
calendar.readonly): to see upcoming events for scheduling awareness. - Calendar — event access (
calendar.events): to prepare calendar changes. As with email, NORA does not create, modify, or cancel calendar events automatically — every such action requires the user's explicit approval first. - Basic profile (
userinfo.email): to identify which Google account is connected.
NORA does not request access to Google Drive, Contacts, Photos, or any other Google product beyond Gmail and Calendar as described above.
Purpose of access
Google data is accessed solely to provide the user's own NORA assistant with the information it needs to help that same user manage their own email and schedule. It is not used for advertising, analytics, or any purpose unrelated to operating the assistant for its user.
Storage
Email, calendar, project, task and objective data NORA has processed is stored in a database the owner operates themselves (self-hosted, not a third-party cloud service run by NORA's developer). Google OAuth tokens are stored in a single local file on the server, with restricted file permissions, and are never transmitted to or accessible from the browser.
Processing, including third-party AI models
NORA is built local-first: many requests are processed entirely by AI models running on the user's own hardware, which never leave the machine. For more demanding requests, NORA may send content to a third-party AI provider for processing — currently one or more of Anthropic (Claude), OpenAI, and Perplexity, depending on the task. NORA applies an internal privacy classifier before any such call: content classified as private (including anything derived from personal, medical, or otherwise sensitive sources) is kept on local models only unless the user has explicitly approved sending it externally for that specific case.
Sharing
NORA does not sell user data, and does not share it with third parties except as described above (sending specific content to an AI provider strictly to process that request). Each provider processes that content under its own terms; NORA does not control those providers' own data-handling practices.
Retention and deletion
Data remains in the owner's own self-hosted database until the owner deletes it. Google access can be revoked at any time by disconnecting the integration, which deletes the locally stored OAuth tokens immediately; the connected Google account's own permissions can also be revoked directly from that account's Google settings at any time, independently of NORA.
Security
NORA is served over HTTPS. Access to the application requires authentication (a signed token); Google OAuth tokens are stored server-side only, with restricted file permissions, and are never exposed to client-side code.
Who can use this instance
NORA is operated privately by its owner for personal and household use. It is not offered as a public service and has no public sign-up — every login is created directly by the owner. Only one Google account is ever connected to a given NORA instance at a time; that connection is instance-wide, not tied to any one individual login. The owner can disconnect the Google integration, delete stored data, or stop operating the application at any time.
Contact
Questions about this policy or NORA's handling of Google account data can be sent to hello@korhotech.com.