Your email is personal. Here's exactly how Cora handles your data, what it can and can't access, and how you stay in control.
What Cora can do
When you connect your Gmail account, Cora can:
Read emails to understand and categorize them
Apply labels to organize messages
Archive emails (move out of inbox without deleting)
Create drafts for you to review and send
Modify labels to maintain organization
What Cora can never do
Cora has built-in limitations for your protection:
Can't delete emails: Cora can never permanently delete anything. Nothing you do in Cora can lead to permanent loss of any email.
Can't send emails automatically: You always review and send. Cora only creates drafts.
Can't share your data: Your emails remain completely private.
Can't access Trash or Spam: These folders are off-limits.
Can't change Gmail settings: Your configuration stays untouched.
Can't work with existing Gmail labels: Cora uses its own labeling system.
How your data is protected
Encryption
All email content is encrypted at rest.
Account isolation
Your data is completely separated from other users.
OAuth authentication
Cora never sees or stores your Gmail password. Authentication happens through Google's secure OAuth system.
Revocable access
You can disconnect Cora at any time, immediately stopping all access.
How archiving works
When Cora archives an email:
The email is not deleted—it stays in Gmail's "All Mail"
You can search for and access it anytime
Gmail labels and organization remain intact
Cora simply removes the "INBOX" label
Archiving just means "this doesn't need to be in my inbox right now."
Cora's labeling system
Cora maintains organization through Gmail labels:
All Briefs: Applied to all Cora brief notification emailsNext Brief: Temporary holding area for emails awaiting Brief inclusionNeeds Response: Flags emails that need a responseCora/[Category]: Category-specific labels
These labels mean you can always see Cora's organization directly in Gmail.
Note: Cora can't currently work with your existing Gmail labels. If you already have labels, you'll need to use Cora's separate labeling system.
Disconnecting Cora
To disconnect your Gmail account:
Go to Settings > Accounts
Select the account
Click "Disconnect Gmail account"
What happens:
Immediate cessation of email access
Gmail labels remain (not deleted)
Archived emails stay archived
Cora data deleted within 30 days
You can reconnect anytime
Common questions about our Terms of Service and Privacy Policy
These answers reflect our Terms of Service and Privacy Policy. For anything not covered here, contact [email protected].
Is my Gmail data used to train AI models? No. Your Gmail data ("Google Data" in our Terms) is never used to train models, by us or by the third-party AI providers we use to run Cora.
Is Gmail data the same as "Content" or "Submissions" in the Terms? No. Google Data is defined and handled separately from Submissions and Content. The rules about Submissions and Content (including the clause about not posting confidential or proprietary material) apply to things you post or upload through the Service, not to the email Cora processes for you.
How long is my data kept? Our AI providers apply a zero data retention policy to your Google Data. Cora itself keeps what it needs to run your account, encrypted at rest, for as long as the account is connected, and deletes it when you disconnect the account or delete your Cora account.
Who owns the drafts and summaries Cora produces for me? We do not claim ownership of your emails or the drafts and summaries Cora writes for you. The intellectual property section of the Terms protects Cora's software and models, not your content.
Can I use Cora with a company Gmail account? Yes. Google Workspace accounts are supported. If your company requires a data processing agreement or a security review, contact us and we will route the request.