Privacy Policy

Effective 26 August 2026 · Last updated 19 September 2026 · Curavi is operated by Solventi LLC ("Curavi", "we").

The short version: Curavi reads what you connect, keeps notes about it, and lets you take it all away whenever you want. It can send email only if you turn that on, and only messages you approve one by one — never on its own. We do not sell your data, we do not use it to train AI models, and we do not show ads.

1. What Curavi is

Curavi is your personal assistant, available through web and mobile applications. It connects to accounts you choose (currently Gmail and Google Drive), reads the mail and documents in them with read-only permissions, and produces notes, reminders, alerts and answers to your questions about them. If you separately turn on sending, Curavi can also write replies for you — but it sends only a message you have read and approved, one message at a time.

Curavi is for adults. You must be 18 or older to use it, and we do not knowingly collect information from anyone under 18. If you believe a minor has created an account, write to support@curavi.ai and we will delete it.

2. Information we collect

• Account information. Your name and email address, provided through our sign-in provider (Clerk) when you create an account, and the device tokens needed to send you push notifications.
• Connected account data. When you connect Google, Curavi requests read-only access to Gmail (gmail.readonly) and/or Google Drive (drive.readonly). Using that access, Curavi reads messages, attachments and documents in the account, subject to the folders and labels you choose to exclude. If you attach a file to a question, Curavi asks separately for permission to keep files in your Google Drive (drive.file, which reaches only files Curavi itself created): the original file is stored in a folder named “Curavi” in your own Drive and processed as described below. You can delete that folder at any time.
• Sending, if you turn it on. Sending is optional and off by default. Turning it on for a mailbox runs a separate Google consent for one additional permission, sending mail as you (gmail.send), and that permission is used for exactly one thing: delivering a reply you have read and approved on the confirmation screen. Curavi never sends on its own initiative, never sends in bulk, and never sends without that approval. You can switch sending off per mailbox in Settings at any time, or remove the permission entirely by disconnecting the account.
• Derived notes. From what it reads, Curavi stores distilled notes: the people and companies involved, agreements and their terms, amounts, dates, deadlines and open items, together with search indexes and a link back to the original message or file. After a Gmail message is processed, its original body and attachment payload are removed from Curavi's active item record; titles, sender and attachment metadata and derived notes remain. Original content can be retrieved again from your connected account when needed.
• Document and conversation history. For supported Google Drive documents, including files you upload, Curavi may retain extracted text and document versions for comparisons and answers. We also store your Ask questions and answers, saved citations, and reply drafts and sent-message history, including recipients, subject, body and drafting instructions.
• Usage and diagnostics. Logs of requests to our service, error reports, and the processing cost of each item so that your credit balance can be shown to you.

3. How we use it

• To provide the service: reading, note-taking, alerts, briefs, reminders and answers to your questions.
• To operate, secure and improve the service, and to support you when you ask.
• To bill you for the plan or credits you purchase.

We do not use your data for advertising, we do not sell it, and we do not use it to train or improve generalized artificial intelligence or machine learning models.

4. Google user data and Limited Use

Curavi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the user-facing features of Curavi described above.
• It is not transferred to others except as necessary to provide those features (see Service providers below), to comply with the law, or as part of a merger or acquisition with prior notice to you.
• Humans at Curavi do not read your Google data except with your explicit permission for support, for security purposes such as investigating abuse, to comply with the law, or for internal operations where the data has been aggregated and anonymized.
• It is never used for advertising, and never used to train generalized AI or ML models.

5. Service providers

Curavi runs on infrastructure and services operated by third parties who process data on our behalf under contract and only for the purposes above:

• Anthropic and DeepInfra — AI model providers that process the content Curavi reads in order to produce notes and answers. Neither uses your data to train their models.
• Railway — application and database hosting (United States).
• Clerk — sign-in and account management.
• Expo — delivery of push notifications and app updates.
• Stripe — payment checkout and subscription management. Stripe receives your account email, Curavi account identifier and purchase or plan metadata. Curavi does not send Gmail messages or Google Drive document content to Stripe.
• RevenueCat — in-app purchase and subscription management. RevenueCat processes your Curavi account identifier and store purchase or subscription information; payment details are handled by the applicable app store (Apple App Store or Google Play). Curavi does not send Gmail messages or Google Drive document content to RevenueCat.
• Google — the accounts you connect, through Google's OAuth consent.

6. Security

Data is encrypted in transit (TLS) and at rest. The credentials that let Curavi read your Google account are encrypted with a key held separately from the database. Access to production systems is restricted to authorized personnel and is logged. Document and attachment parsing runs in an isolated environment without access to credentials. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

7. Retention and deletion

• Disconnect a source in Settings: Curavi clears its stored credential when the disconnect request completes, including when Google is unavailable. If you instead revoke Curavi at myaccount.google.com/permissions, Google ends the authorization; Curavi clears its stored credential when a later access or sync attempt detects the revoked grant. Notes and other records already taken remain until you delete them.
• Delete everything from Settings stops access to your Curavi account and queues removal of your account, connected sources, notes, alerts and history from the active service. Provider account deletion and access revocation are retried if a provider is unavailable. Encrypted credentials needed for those retries are removed when revocation is confirmed. A limited cleanup record is kept for 90 days after completion and then removed by the cleanup process.
• Backup copies are kept separately for recovery and can contain information removed from the active service. Scheduled database backups expire within 89 days of creation. Manual database backups and encrypted database recovery copies have a 90-day retention limit from creation, with regular cleanup beginning on day 89. Technical outages can delay cleanup; overdue copies are removed when cleanup can safely resume. This period applies to each backup's creation date, not to the completion of provider cleanup.
• Security and operational records. Administrative audit records may retain account email addresses, operator identifiers and details of administrative changes after account deletion. They are kept to investigate changes and security incidents and currently have no fixed automatic expiry. Processing-cost measurements, including timestamps, operation types and token counts, may remain with the direct account link removed and currently have no fixed automatic expiry. Removing that link does not guarantee anonymity. Separately encrypted security recovery records can retain service configuration and account identity mappings outside the database; these are retained for recovery and security, currently without fixed automatic expiry. Hosting logs and AI processing data follow the relevant provider's retention rules, which differ by service and processing method; a log's disappearance from a dashboard does not by itself prove permanent deletion. See Railway's log policy, Anthropic's API retention policy and DeepInfra's data privacy policy.
• Payment event records. Limited provider event identifiers, event types and receipt times are retained to prevent processing a payment twice and currently have no fixed automatic expiry. Account links and detailed billing-event summaries are removed during account deletion; the payment provider may retain its own records under its policies.

8. Your rights

Depending on where you live you may have rights to access, correct, export or delete your personal data, or to object to its processing. You can exercise most of these directly in the app; for anything else, contact us at the address below. Curavi is not directed to anyone under 18 and we do not knowingly collect their data.

9. Changes

We will post any changes to this policy on this page and, for material changes, notify you in the app.

10. Contact

Solventi LLC, United States · support@curavi.ai