Privacy policy

Last updated October 29, 2026

Kaluta is an open-source macOS email client. It runs entirely on your Mac. This policy explains what data the app accesses, where that data goes, and what it is used for.

Summary

• Your email is stored only on your Mac. It never passes through servers operated by Kaluta or Actual AI — the project operates none.
• The Kaluta app has no user accounts and collects no telemetry or analytics.
• This website uses Google Analytics. Visitors in the EU, EEA and UK are asked first; everyone can turn it off with Cookie settings.
• Your mail is shared with an AI agent only when you connect one, and only through the tools you allow.

Data the app accesses

When you sign in with Google, Kaluta asks for full access to your Gmail (mail.google.com), which downloading mail over IMAP needs, and for the gmail.modify scope, so the app still works over the Gmail API if you untick full access on Google's consent screen. It also asks for openid and profile, to show which account is signed in, with your name and picture.

With that access the app downloads your messages, labels and attachments directly from Google to your Mac, and sends the actions you take — sending, archiving, labelling, deleting — directly back to Google.

Google Calendar is optional and never asked for at sign-in. If you choose Connect Google Calendar in Settings › Accounts, Kaluta asks for calendar.freebusy, to see when you are busy (never what your events are), and calendar.events.owned, to add and remove the tentative holds you ask for on calendars you own. Holds invite no one. Agents are given free times only, never event titles, attendees or descriptions. Stop Using the Calendar forgets it.

Where your data is stored

• Mail is kept in a local database on your Mac, in the app's own container.
• Google sign-in tokens are stored in the macOS Keychain.
• Signing out of an account in Kaluta deletes its sign-in tokens and its local mail database. You can also revoke Kaluta's access at any time at myaccount.google.com/permissions.

AI agents

Kaluta can connect to AI agent tools already installed on your Mac, such as Claude Code or Codex, using your own login with those providers. Kaluta never sees your AI provider credentials.

When you ask an agent to work on your mail, the agent can use a limited set of mail tools. The content it reads through those tools is sent to your AI provider under your agreement with them — Kaluta does not control how that provider handles it. Every access is recorded in a local log you can review. Sending, forwarding and deleting always require your approval in the app.

If you choose to set up a Claude cloud routine, it is created in your own Claude account and uses Anthropic's own Gmail connector, subject to Anthropic's terms.

Google API Services User Data Policy

Kaluta's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the email features you use in the app. It is not sold, not used for advertising, and not used to train AI models by Kaluta or Actual AI.

This website

This section covers kaluta.org, not the app. The site uses Google Analytics to count visits and see which pages are read.

• If you visit from the EU, the EEA or the UK, the site asks first. Google Analytics loads only if you choose “Allow analytics” in the cookie banner; until then the script is not loaded and no analytics cookies are set.
• Elsewhere, Google Analytics loads when you open the site, and you can turn it off at any time.
• To tell which applies, the site uses the country our host, Vercel, works out from your IP address. Only a yes or no (“ask first?”) reaches your browser, which keeps it until you close the tab; the site does not store your country or IP address. If the country can't be determined, the site asks.
• If you allow it, Google Analytics sets cookies (_ga and _ga_*) and sends Google details of your visit, such as the pages you view, your browser and device type, and your approximate location. Google handles that data under the Google Privacy Policy.
• Your choice is saved in your browser's local storage, so the banner doesn't ask again. It is not a cookie and is never sent to a server.
• You can change your choice at any time with Cookie settings in the footer. Turning analytics off removes its cookies.
• Nothing you do on this website is connected to your mail or to the Kaluta app.

Who is responsible

Kaluta is an independent open-source project sponsored by Actual AI, which is the developer named on the signed app and on Google's OAuth consent screen. Because the app has no backend, neither the project nor Actual AI holds any of your email or account data.

Changes and contact

Changes to this policy are published on this page and in the project's public source history. Questions can be raised on GitHub.