Privacy Policy

Last updated: October 14, 2026

Infinihash LLC ("Infinihash," "we," "us") operates Oryah Mail, a connector that lets Claude access the mailboxes and calendars you authorize: Gmail and Google Workspace, Microsoft 365 / Outlook, and IMAP mailboxes from providers such as Yahoo, AOL, iCloud, Zoho and Fastmail. This policy explains what we collect, why, where it is stored, how long we keep it, and who we share it with.

1. What we collect

• Account data: the email address and sign-in identifiers from the Google or Microsoft account you sign in with, and the public keys and names of passkeys you register.
• Mailbox credentials: for Google and Microsoft mailboxes, encrypted OAuth access and refresh tokens; for IMAP mailboxes, your username, your app password (encrypted) and the provider's server settings.
• Mailbox and calendar content: depending on the permissions you set for each mailbox, email messages and attachments, drafts, labels and folders, calendar events and free/busy information. Content is fetched from your provider only to fulfill a specific request from you or Claude (for example a search, a send or a free/busy check). It is not bulk-synced or indexed, and Oryah Mail does not store it after the request is answered.
• Files you upload: files dropped on an upload link that Claude creates for you are stored on our servers so they can be attached to a message.
• Requests from Claude: the parameters of each tool call Claude sends to Oryah Mail, such as a search query, message IDs, recipients, or the text of a message to send. We do not receive your Claude chat history, conversation memory or other files, beyond what Claude includes in a request to Oryah Mail.
• Audit log: for drafts, sends, organizing, deletions, calendar changes and refused actions, the time, mailbox, action, outcome and actor (a Claude session or a named API key), plus request details such as recipients, subjects, message IDs, folder or label names, and event titles and times. The audit log does not record message bodies or attachment contents, and successful reads are not logged individually.
• API keys: a one-way hash of each key you create, its name, access settings and expiry, and when and from which IP address it was last used.
• Server logs: our servers log requests, including IP addresses, request paths and times, and the addresses of the requests we make to your mail provider, which can include search terms and message IDs.
• Billing data: your Stripe customer and subscription identifiers and status. Payments are handled by Stripe; we do not receive or store full card numbers.
• Cookies: the admin console uses a session cookie to keep you signed in and a short-lived cookie for on-screen messages. The marketing site sets no cookies and uses no analytics.

2. Google API Services User Data Policy — Limited Use disclosure

Oryah Mail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve the mail and calendar features you request within Oryah Mail.
• We transfer Google user data to Claude (Anthropic) only when you or Claude request it through Oryah Mail, to provide that feature. We do not transfer it to anyone else except as needed to provide the service (see Section 5), for security purposes, or to comply with applicable law.
• We do not use Google user data for serving advertisements.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.
• We do not sell Google user data, and we do not allow humans to read it except with your explicit consent, for security purposes (for example, investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

We apply the same principles to Microsoft and IMAP mailbox data.

3. How we use data

We use collected data to operate the connector (authenticate you, relay requests to your mailboxes, and enforce the per-mailbox permissions and send-domain allowlists you set), keep your audit log, provide support, process billing, and secure the service. We do not use mailbox or calendar content for advertising or to train AI or machine learning models, and we do not sell your data.

4. How Oryah Mail works with Claude

Oryah Mail returns the results of each request (for example, matching messages or event details) to Claude, which is operated by Anthropic. Anthropic's handling of that content in your Claude conversations is governed by Anthropic's own terms and privacy policy. This transfer happens only to provide the feature you requested. We do not otherwise share mailbox or calendar content with Anthropic.

5. Where data is stored and who we share it with

Oryah Mail's servers, database and backups are hosted by Amazon Web Services in the United States (us-east-2, Ohio). We use these service providers to operate Oryah Mail:

• Amazon Web Services (AWS) — hosting, database storage and encrypted backups.
• Cloudflare — network routing and security. All traffic to and from Oryah Mail passes through Cloudflare's network.
• Stripe — payment processing and billing.
• Google Fonts — our web pages load fonts from Google, which receives your IP address when a page loads.

At your direction, Oryah Mail also connects to the providers of the mailboxes you add: Google (Gmail and Google Calendar APIs), Microsoft (Microsoft Graph), and the IMAP, SMTP and CalDAV servers of other providers. Results are returned to Claude (Anthropic) as described in Section 4.

We do not sell data to these providers or to any other third party.

6. Data retention and deletion

• Mailbox credentials are kept until you remove the mailbox in the admin console, which deletes them from our live database. Removing a mailbox does not revoke the access you granted at the provider; to revoke it, use your Google Account or Microsoft account security settings, or delete the app password at your IMAP provider.
• Mailbox and calendar content is not stored after a request is answered.
• Uploaded files are deleted automatically by an hourly job: 24 hours after the upload link is created, or one hour after the files are attached to a message or draft, whichever comes first.
• The audit log is kept for 365 days; an hourly job deletes entries older than that. API key records are kept while your account is active.
• Sign-in sessions and tokens: an hourly job deletes expired access tokens and admin sessions, used or expired one-time sign-in links, unfinished connection requests from Claude older than 15 minutes, other sign-in and connect state older than one day, passkey challenges older than five minutes, and app registrations that never completed a connection within 7 days. Send idempotency records are deleted after 7 days.
• Server logs are kept for at most 30 days (and at most 500 MB), after which they are deleted.
• Backups: our database, including the data above, is backed up nightly to encrypted storage at AWS. Nightly backups are deleted automatically after 35 days (superseded versions after 7 days), and encrypted disk snapshots are kept for 14 days. Backups are used only for disaster recovery. Data deleted from the live service can remain in backups for up to 35 days.
• Billing records are kept by Stripe and by us as required for tax and accounting.
• Account deletion: you can ask us to delete your account at any time by emailing [email protected]. We will delete your account data, mailbox credentials, audit log and uploaded files from our live systems within 30 days, except where we must keep data by law.

7. Security

Mailbox tokens and IMAP app passwords are individually encrypted with a dedicated key. The storage volume, disk snapshots and backups are also encrypted at rest, and connections to Oryah Mail are encrypted in transit. API keys and the access tokens Oryah Mail issues to Claude are stored only as one-way hashes. Our servers accept no inbound connections from the internet except through Cloudflare, and administrative access is restricted to Infinihash. See our Security overview for more detail.

8. Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data. You can remove any mailbox at any time under Mailboxes in the admin console. To exercise your other rights, email [email protected].

9. Children's privacy

Oryah Mail is intended for users 18 and older and is not directed to children. We do not knowingly collect data from anyone under 18.

10. Changes to this policy

We may update this policy as the product evolves. Material changes will be posted here with an updated date.

11. Contact

Infinihash LLC · [email protected]. For privacy requests, security concerns or account deletion, email us at this address.