kris@apps:~$ cat exocortex/PRIVACY

Privacy policy

exocortex · last updated 22 October 2026

exocortex is a private application with exactly one user: its developer, Kris Philippaerts. It only connects to accounts he owns. Nobody else can sign in to it.

Who is responsible

Kris Philippaerts, a private individual, develops and operates exocortex for personal use. Contact: info@krisp.be.

Data accessed

With the owner's consent, exocortex uses the following Google API scopes, read-only and only for the owner's own Google accounts:

gmail.readonly: email messages, their attachments and labels
calendar.readonly: calendar events and their attendees

exocortex never sends, changes or deletes email or calendar events.

How the data is used

To build a private, searchable archive of the owner's own email, calendar and documents.
To extract text from attachments, compute search embeddings with a model that runs locally, and derive tags, short summaries, people and open tasks.
To answer the owner's own questions through his AI assistant, with access limited per area of life.

The data is not used for advertising, is not sold, and is not used to build user profiles for anyone other than the owner.

Storage and security

All data is stored on a server owned and operated by the owner, in a database that is not reachable from the internet.
OAuth tokens are stored on that server in files only the application can read.
Attachments are not kept as files; only their extracted text is stored, with a reference to the original message.
The only public endpoint is protected by HTTPS and a sign-in, and gives read access only to the owner's own AI assistant.

Sharing with third parties

To tag and summarize items, exocortex sends the cleaned text of individual items and related metadata (such as sender and date) to the Anthropic API, using the owner's own API account. Under Anthropic's commercial terms, this data is not used to train their models. No other third party receives data from exocortex.

exocortex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve or train generalized AI or machine learning models.

Retention and deletion

Data is kept until the owner deletes it. Access can be revoked at any time in the Google account under Security → Third-party apps & services; exocortex then no longer receives new data. Deleting the account in exocortex or the database removes the stored data.

Changes

If the way exocortex handles data changes, this page is updated and the date above changes with it.