Privacy
Kedalio is software you run yourself: a server you install and hosts you add. This page says what it does with your data. It covers the open-source software as published here; a hosted offer, when there is one, will have its own page.
Who holds your data
Section titled “Who holds your data”You do. Everything Kedalio keeps (memory, tasks, chats, the vault, the tools you connect) lives on the server you installed, in its database. The Kedalio project runs no service that your installation reports to: no analytics, no telemetry, no account with us.
Your Google account
Section titled “Your Google account”Connecting Google (System › Tools › Add › Google) lets your agent use Gmail, Google Calendar and Google Drive for you. Kedalio asks for these permissions:
- Gmail (
gmail.modify): read, search and label your mail, write drafts and send mail when you or your agent ask. - Google Calendar (
calendar): read your calendars and create, change or delete events. - Google Drive (
drive): find, read and create files.
How that data is handled:
- Where it goes. The sign-in returns to your own server. The refresh token Google gives is kept in your server’s vault, encrypted (AES-256-GCM), and is handed only to the host process that calls Google for you. Mail, events and files are read when a tool is called, passed to the agent that asked, and not stored by Kedalio beyond that conversation or run, unless you or your agent save something to memory.
- The AI model. What a tool reads goes to the AI engine you chose for your agent (for example Claude or Codex), under that provider’s terms, because that is how the agent works with it. Kedalio never uses your Google data to train a model, and never sells it, shares it or uses it for advertising.
- What asks first. Sending mail and deleting are confirmed by you every time; changes ask unless you said yes for good. You set these rules per tool in the app.
- Limited Use. Kedalio’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Removing access
Section titled “Removing access”- In the app, remove the Google server: its refresh token is deleted from the vault.
- At myaccount.google.com/permissions you can revoke Kedalio’s access at any time; the token stops working at once.
Contact
Section titled “Contact”Questions about this page: privacy@kedalio.com.