Privacy Policy

The short version

• Your index stays on your device. Smara builds its knowledge graph on the device itself. There is no server copy of your mail, no central index, and nothing syncs between your Mac and your phone — each device indexes its own accounts, and no index, embedding or copy of your data is ever uploaded.
• Answering happens in Smara Cloud. The text Smara needs for a request, together with your question, goes over TLS to Smara Cloud (api.usesmara.ai, run on Cloudflare) and on to the model. It is held in memory for the length of the call and is not stored, not logged and not used to train any model. See Smara Cloud — how answering works.
• Smara reads your accounts, and writes only when you click. Smara writes to your accounts only when you click, to send a reply you've written, answer an invitation or add an event to your calendar, and never on its own. Its only write permissions are for those three actions: gmail.send and calendar.events.owned for Google accounts, and Mail.Send and Calendars.ReadWrite for Microsoft accounts. Smara never deletes anything, cannot modify your files, and every other Microsoft permission, and every Slack and local macOS permission, is read-only.
• Web search, on phones, only when a question needs it. The Ask tab searches the web for public facts, never for questions about your own mail, calendar or files. Only short search queries are sent, never email or document text, and you can turn it off. See Web search.
• No analytics or crash reports. The apps send neither. Smara's servers keep anonymous daily download counts and the license, device, usage, push and log records listed in What Smara's servers keep. This website sets no cookies and runs no analytics.
• You can delete everything. Disconnecting an account deletes its data and revokes Smara's access; "Reset & clear all data" wipes every local store. Deactivating a device in the app deletes that device's record — and any morning-briefing registration with it — from Smara's servers, and you can ask us to delete your license and usage records.

Data the app accesses

Smara only accesses data from sources you explicitly connect or grant permission to, and only to build the knowledge graph on that device and answer your questions. Each app signs in to your accounts itself and fetches from the providers directly — never through Smara's servers, and never from another of your devices. The scopes below are what the Mac app requests; the iPhone and Android apps request the same Google and Microsoft scopes, and have no Slack or local-file access. Depending on what you connect, that can include:

Google services (OAuth)

• gmail.readonly — reads inbox messages to summarize them and index them locally.
• calendar.events.readonly — reads events for the Today view and meeting preparation (events only — Smara never reads your calendar list or settings).
• drive.readonly — reads recently modified files (metadata and content) for summaries.
• gmail.send — used only when you click Send on a reply drafted in Smara: Smara sends that one message through Gmail, threaded into the conversation. Smara cannot read or change your Gmail drafts, and never sends mail on its own.
• calendar.events.owned — used only when you click. When you click Accept, Decline or Maybe on an invitation, Smara updates only your own response, and any note you add, on that event or series in your calendar, and the organizer is notified. When you click Add to Calendar on a date Smara found in an email, Smara creates that one event on your own calendar. Smara never creates or changes events on its own, and never deletes them.

Microsoft services (OAuth)

• Mail.Read, Calendars.Read, Files.Read, Chat.Read — the read-only equivalents for Outlook mail, Outlook calendar, OneDrive files, and your Microsoft Teams chats.
• Mail.Send — used only when you click Send on a reply drafted in Smara: Smara sends that one reply through Outlook, in the conversation. It cannot read or change your Outlook drafts, and Smara never sends mail on its own.
• Calendars.ReadWrite — used only when you click. Microsoft has no narrower permission for answering invitations or adding events, so this one also allows changing and deleting events, but Smara uses it only to save your Accept, Decline or Maybe on an invitation (the organizer is notified) and to create the one event you add with Add to Calendar. Smara never creates or changes events on its own, and never deletes them.

Slack (OAuth, read-only)

Smara connects with a user token, so it sees only the conversations you are already a member of — never the whole workspace.

• im:history, im:read — reads your direct messages.
• mpim:history, mpim:read — reads your group direct messages.
• groups:history, groups:read — reads the private channels you belong to.
• channels:history, channels:read — requested only to reach Slack Connect (externally shared) channels, which each workspace can mark public on its own side. Smara filters these results down to externally shared channels, so ordinary public channels are never read.
• users:read — resolves member IDs to names so messages are readable.

Local macOS sources (system permissions)

• Calendar, Reminders, and Contacts — via the standard macOS permission dialogs.
• Apple Mail, Safari history, Notes, iWork, and Microsoft Office documents — read directly from disk in read-only mode, using permissions you grant in System Settings (Full Disk Access / Automation). Safari history is filtered before storage: local and private-network addresses are stripped.

No permission is pre-granted; each source prompts the first time you use it, and you can leave any source disconnected.

How your data is used

Smara uses the data above exclusively to provide the app's user-facing features — building your private knowledge graph, summarizing messages and documents, ranking your inbox, preparing you for meetings, and answering your questions. The graph is built on your own device; answering sends the text needed for that request to Smara Cloud. Your data is not used for advertising, not sold, not shared with third parties except to process the requests you make (see Smara Cloud — how answering works), not used to train AI models, and no human other than you ever reads it.

Google API Services — Limited Use disclosure

Smara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is used only to provide the user-facing features described in this policy — summaries, the Today view, and question answering; and sending a reply, answering an invitation or adding an event to your calendar, which happen only when you click.
• gmail.send and calendar.events.owned are used only to carry out the action you click — sending that one reply through Gmail, updating your own response to that one invitation, or creating that one event on your own calendar. Smara never uses them to send mail, create or change events, or delete anything on its own.
• Where Google user data goes. Smara indexes it on your own device. To answer a question, the Gmail, Google Drive and Google Calendar content Smara needs for that one request — message bodies and threads, document excerpts, and events (title, time, attendees and the invite description or agenda) — is sent over TLS to Smara Cloud (api.usesmara.ai), run on Cloudflare acting as Smara's processor, and on to Cloudflare Workers AI. It is used only to produce the answer or summary you asked for, and is never stored, sold, used for advertising or used for training: the Worker never logs request content, AI Gateway logging is off on every call, and Workers AI holds each request in memory only for the duration of the call. Nothing is sent until you press "Agree and Activate" (on a phone, "Allow Smara Cloud") on Smara's consent screen. On Mac builds that still include the on-device model, turning it on (Settings → Plan → "Use on-device model instead") keeps answering local and sends nothing.
• Apart from that, Google user data leaves your device only for the actions you click: a reply you send goes through Gmail to its recipients, your response to an invitation is saved to Google Calendar, which notifies the organizer, and an event you add is saved to your Google Calendar.
• Web search never receives Google user data. Only the short search queries described in Web search are sent, never Gmail, Drive or Calendar content.
• Google user data is never used to train AI models — by Smara or by Cloudflare Workers AI.
• Google user data is never used for advertising and is never read by humans.

The use of raw or derived user data received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Independent verification and security assessment

Because Smara requests restricted Google scopes, it is subject to Google's app verification process and to the independent security assessment that process requires. Both are complete:

• Google OAuth app verification — approved August 2026. Google reviewed and approved Smara's use of gmail.readonly and drive.readonly (restricted scopes) and calendar.events.readonly (sensitive scope), including a demonstration that each scope is the narrowest one that supports the feature it powers.
• CASA Tier 2 security assessment — complete. Smara was assessed by an independent, Google-authorized assessor (TAC Security) under the Cloud Application Security Assessment programme — a Tier 2 assessment, known in current App Defense Alliance terminology as ADA-CASA Assurance Level 1, based on the OWASP Application Security Verification Standard. The assessment covered authentication, cryptography and data-at-rest protection, data deletion, logging, network security, platform hardening, and input handling. Remediation and revalidation are finished and the Letter of Validation has been submitted to Google.
• Both are re-validated annually. The OAuth verification and the CASA assessment each require reassessment every 12 months, so the review above is repeated each year for as long as Smara connects to Google accounts.

What these reviews covered, and when. Both were completed in August 2026, when Smara answered questions with a model running on your own Mac. Smara now answers through Smara Cloud, which is a change to how your data flows. We have disclosed that change to Google, and the reviews above describe the architecture as it stood at the time they were carried out — not an assessment of the current cloud data flow.

One note on what this does and does not mean: verification and assessment confirm that Smara's requested access and security controls meet Google's published requirements. They are not an endorsement, certification, or recommendation of Smara by Google or the App Defense Alliance.

What happens on your device, and what happens in the cloud

On your device. Smara fetches your accounts directly from Google, Microsoft and Slack — never through Smara's servers — and builds its knowledge graph in a local database file on that device. Entity and relationship extraction, search and retrieval all run there. On Mac, embeddings are computed locally with Apple's MLX framework; the iPhone and Android apps compute no embeddings at all and search their local index directly. No index, embedding or copy of your data is ever uploaded, and nothing syncs between your devices: each one indexes its own accounts and holds its own graph.

In the cloud. Summarization, inbox importance scoring and question answering run in Smara Cloud, described in the next section. Each request carries only the text needed to answer it.

On-device answering, where it still exists. Some Mac builds still include a local model, which you can turn on under Settings → Plan → "Use on-device model instead". While it is on, answering runs on your Mac and nothing is sent to Smara Cloud. Smara no longer offers on-device answering as a supported mode, and the iPhone and Android apps have never had one.

Smara Cloud — how answering works

Smara Cloud is Smara's own server, one Cloudflare Worker on api.usesmara.ai. It activates your license, answers your questions, runs the web searches described below, and sends the morning briefing wake-up. It requires an active subscription: without one, Smara still syncs your accounts and shows your lists, but cannot answer.

Before anything is sent, Smara shows a consent screen naming what is sent, where it goes and what happens to it, with a link to this policy. Nothing leaves your device until you press "Agree and Activate" (on a phone, "Allow Smara Cloud"), and withdrawing that agreement stops it; if you turn answering on again, Smara asks again.

What is sent

Each request sends the text Smara needs for it, together with your question, over TLS to Smara Cloud (api.usesmara.ai, run on Cloudflare), which forwards it to Cloudflare Workers AI for inference. Depending on your question and the sources you have connected, that text can include:

• email bodies and threads;
• calendar events — the title, time, attendees and the invite description or agenda;
• documents and file excerpts;
• chat messages;
• notes, reminders and contacts, where you have connected those sources.

Your knowledge graph itself is never sent — only the text behind the request. A request carries at most 200,000 characters.

What is not stored

Nothing you send is stored. Smara Cloud never logs request content, and Smara's code switches off Cloudflare AI Gateway logging and caching on every request. Cloudflare Workers AI holds each request in memory only for the duration of the call and does not train on it. If the model returns an error, Smara logs only the error's class and code, never its message, because an upstream error can quote the input.

Web search

On iPhone and Android, the Ask tab can search the web when a question needs a public fact — news, prices, opening times. It does not search the web for questions about your own mail, calendar or files, and you can turn it off in the app. The Mac app has no web search.

When it does search, Smara writes up to five short search queries from your question and the previous exchange, and sends each one to Smara Cloud, which passes it to Cloudflare Web Search (whose provider, Ceramic, is listed by Cloudflare as retaining no data). Each query is at most 400 characters. Because a follow-up question can refer back to an earlier answer, a query can contain a short public fact that came from your own mail or files — for example a date or an organization's name — but email, document and message text is never sent, and the app is instructed never to put private details such as people's names, email addresses, phone numbers, street addresses or account numbers into a query. Smara keeps a count of searches; the queries themselves are never written to Smara's database, its logs or the gateway.

The morning briefing

On iPhone and Android, if you turn the morning briefing on, Smara's server needs to wake your phone at the right local time. Your phone registers its push token, whether it is iOS or Android, your time zone name and the local minute to send at (see the table below). At that time, Smara's server sends one empty wake-up through Expo's push service, which relays it to Apple or Google. The message's entire payload is {"kind":"morning"} — no content, no summary, nothing about you. Your phone then builds the briefing itself from its own local graph. Turning the briefing off, withdrawing consent or deactivating the device deletes the registration.

What Smara's servers keep, and for how long

To run your subscription, Smara's servers keep the records below. None of these tables has a column for prompts, responses, names, email addresses or IP addresses. On your own device, Smara stores your license key and a random device identifier in the system keystore — the macOS Keychain on a Mac, the platform secure store on a phone.

Billing — Lemon Squeezy

Lemon Squeezy is the merchant of record for a Smara subscription, which means Lemon Squeezy is the seller. It handles checkout, payment, tax and the billing portal, all on its own site in your browser and under its own privacy policy, and it collects your name, email address and payment details. Smara never sees your card details, and a subscription requires no Smara account.

• The Smara app never contacts Lemon Squeezy. Smara's server does: it activates and validates licenses, and receives Lemon Squeezy's notifications about your subscription.
• Smara's servers do not store your name or email address. Smara can see them in Lemon Squeezy's dashboard and uses them only to support your subscription — for example, refunds and account help.

Storage and security

• OAuth tokens are stored in the system keystore — the macOS Keychain on a Mac, marked device-only so they are never synced off it, and the platform secure store on a phone. Disconnecting a Google account also revokes the token with Google before deleting it locally.
• Cached message and document bodies are encrypted at rest with AES-GCM-256 on every platform; the encryption key lives in the system keystore. On phones the cache is capped and expires after 7 days.
• The knowledge graph (a local database file) stores derived metadata and summaries — not raw message bodies — and is protected by the device's own file protection: per-user file permissions and FileVault on a Mac, the app sandbox on a phone.
• Replies you send from Smara leave a small record on your device so Smara can show that you replied: the conversation and message IDs, a link to the conversation, the time and a count. It never keeps the reply's text, subject or recipients. Records expire after 90 days, and disconnecting the account or using Reset & Clear All Data deletes them.
• Unsent replies you leave in Smara's reply editor are kept on your device so you can come back to them, encrypted like cached bodies (AES-GCM-256, key in the system keystore). They are never saved to your Gmail or Outlook drafts and never sent anywhere. A draft is deleted when you send or discard it, expires after 90 days, and Reset & Clear All Data deletes them all.
• Graph exports (Mac only) you create are encrypted with a passphrase you choose (AES-GCM-256 with PBKDF2 key derivation).
• All network connections use HTTPS, with Apple's App Transport Security enforced on Apple platforms.
• Logs never contain content. Message bodies, tokens, and note content are never logged; identifiers are hashed before logging.

What ever leaves your device

The app's outbound connections are, exhaustively:

• Google APIs (sign-in, Gmail, Calendar, Drive) — to fetch your data at your request, and, only when you click, to send a reply you've written, answer an invitation or add an event to your calendar.
• Microsoft APIs (sign-in, Microsoft Graph) — to fetch your data at your request, and, only when you click, to send a reply you've written, answer an invitation or add an event to your calendar.
• Slack API (sign-in, message history) — to fetch your data at your request.
• HuggingFace — on Mac builds that still include the on-device model, a one-time download of that model. No user data is included in these requests.
• Smara's update server (downloads.usesmara.ai, run on Cloudflare) — about once a day, a check for a new version of Smara. The request's user agent includes the app version and the updater's version; no system profile is sent. You can turn automatic update checks off in the app.
• Smara Cloud (api.usesmara.ai, run on Cloudflare) — your license key, device identifier and device name, to activate the license and enforce the device and fair-use limits; the text Smara needs for each request and your question, forwarded to Cloudflare Workers AI; on phones, the short web-search queries described in Web search; and, if you turn the morning briefing on, your push token, platform, time zone and send time.

That's the complete list. Smara sends no analytics or crash reports. The update check carries none of your data, and Smara Cloud stores none of the content you send.

Downloads are counted, not tracked. Downloads of Smara from downloads.usesmara.ai are counted per day and per version, split into new downloads and updates. No IP address, user agent or identifier is stored with the count.

Smara relies on these third-party service providers:

• Cloudflare — runs Smara's servers: the update server, Smara Cloud, and, through Cloudflare Workers AI, the answering itself, as described in Smara Cloud — how answering works. Cloudflare also provides the web search on phones, through a search provider (Ceramic) that Cloudflare lists as retaining no data. Cloudflare processes your IP address to deliver requests and protect against attacks, under Cloudflare's own privacy policy. Smara does not log IP addresses.
• Lemon Squeezy — the merchant of record, and so the seller, of a Smara subscription: checkout, payment, tax and the billing portal happen on Lemon Squeezy's site, in your browser, under Lemon Squeezy's privacy policy. See Billing — Lemon Squeezy.
• Expo — relays the morning briefing's empty wake-up to Apple's or Google's push service, on phones where you have turned the briefing on, under Expo's privacy policy. The wake-up carries no content. See The morning briefing.

Data retention and deletion

Your content lives on your device. Smara's servers keep no copy of it — only the records described in What Smara's servers keep, each for the period shown there. On your device, cached message and file content expires automatically after 7 days (least-recently-used entries are evicted sooner). Summaries and index data persist on the device until you disconnect the account — which revokes Smara's access and deletes that account's data — or use Reset & Clear All Data, which removes everything. In detail:

• Disconnect an account and Smara revokes its access token (where the provider supports revocation), deletes the stored token, purges that provider's cached bodies, and deletes its entities and relationships from the knowledge graph.
• "Reset & clear all data" in Settings wipes every local store — the graph, all body caches, summaries, feedback, and conversations.
• Uninstalling the app removes it from your device; on a Mac, app data under ~/Library/Application Support/Smara/ can be deleted with it, and uninstalling a phone app removes its data with it.
• Deactivate a device in the app and Smara's servers delete that device's record — its device ID, name, activation ID and activation and last-seen times — along with any morning-briefing registration attached to it.
• To delete your license and usage records, email support@usesmara.ai. Smara's servers hold no email address, so say which order the subscription was bought under and we will find it through Lemon Squeezy.

This website

This marketing site is a static site. It sets no cookies, runs no analytics, and collects no personal information. If you email us, we receive the information you choose to send and use it only to respond to you. The subscribe and account links take you to Lemon Squeezy's hosted checkout and customer portal, which are covered by Lemon Squeezy's privacy policy.

Your privacy rights (GDPR, CCPA/CPRA)

Smara's architecture keeps the answer to most privacy-rights questions simple: your index and your content live on your own device, under your (or your employer's) control, and Smara Cloud passes the text behind a request through without storing it. There is no Smara server holding your content to request, correct, or delete — only the subscription records listed above.

• Access, portability, correction, and erasure (GDPR Articles 15–20, CCPA/CPRA rights to know and delete) are exercised directly in the app, immediately and without asking us: your data is readable on your device, exportable on a Mac via the encrypted graph export, and erasable via disconnect or "Reset & clear all data."
• We do not sell or share personal information as defined by the CCPA/CPRA — so there is no need for a "Do Not Sell or Share" opt-out.
• The only personal data we hold is correspondence you send us (for example, a support email) and, once you subscribe, the license, device, morning-briefing, usage, billing-event and log records described in What Smara's servers keep, plus the order details, such as your name and email address, that Smara can see in Lemon Squeezy's dashboard. You may request a copy or deletion of it at any time via the contact address below.
• International transfers. Smara Cloud runs on Cloudflare's global network, so the text behind a request may be processed outside your country. It is processed only to produce your answer and is not stored.
• Enterprise deployments: where Smara is deployed by your employer, the employer is the data controller for workplace data and Smara runs as software on devices they manage; direct data-subject requests about workplace data go to them.

Children's privacy

Smara is a workplace productivity tool and is not directed at children under 13. We do not knowingly collect personal information from children. Smara requires you to connect your own work accounts, keeps the index of them on your own device, and stores no copy of anyone's content on its servers.

Changes to this policy

If Smara's data practices change, we will update this page and revise the effective date above. Material changes — anything that would alter what leaves your device, or what is kept once it has — will be called out in the app's release notes, and the app asks for your agreement again before sending anything under changed terms.

Contact

Questions about this policy or your data? Email support@usesmara.ai.