Privacy Policy

01Who we are

Ore (“the app”) is made by Khon Labs (“we”, “us”). This policy explains what information the app handles, where it goes, and the choices you have. It also covers this website and any messages you send us.

We built Ore so that we don’t need your data to run it. Most of this policy is therefore about what happens on your own Mac, not about what we collect.

02What we don’t collect

We do not collect, receive, store or have access to:

• the content of your email, including messages, attachments, drafts and search queries;
• your calendars and events, including who you meet, when and where;
• the people you correspond with, their addresses or their pictures;
• your passwords, app-specific passwords or sign-in tokens;
• usage analytics, crash analytics, advertising identifiers or your location.

The app does not contain third-party analytics, advertising or tracking software.

03Data stored on your Mac

To work quickly and offline, the app keeps the following on your Mac only:

• Account details — the email address and display name of each account you add.
• Mail — messages, folders and labels, and attachments you open, stored in a local database in the app’s data folder.
• Calendars — for Google accounts with Calendar turned on: your calendar list, events and their guests, and calendar settings, stored in a separate local database.
• Search index — a full-text index of your mail and events so you can search offline.
• Pictures — profile pictures and sender logos, kept in the app’s cache so they don’t have to be downloaded again.
• Pending work — drafts, messages waiting to be sent, and mail and calendar changes waiting to sync.
• Preferences — settings such as whether to load remote content, your undo send delay and your event alerts.

Notifications for new mail and event alerts are scheduled by the app on your Mac and shown by macOS. They don’t pass through any push server.

This data is protected by macOS like other files in your user account. If you use Time Machine or another backup tool, it may be included in your backups.

04Passwords and sign-in

iCloud Mail requires an app-specific password, which you create with Apple. The app stores it in the macOS Keychain and uses it only to connect to Apple’s mail servers.

Google accounts sign in on Google’s own page (OAuth 2.0 with PKCE). The app never sees your Google password. Google gives the app a refresh token, which is stored in the macOS Keychain; short-lived access tokens are kept in memory only. Gmail and Google Calendar share this one sign-in.

Outlook.com and Microsoft 365 accounts sign in on Microsoft’s own page, the same way. The app never sees your Microsoft password, keeps the refresh token in the macOS Keychain and access tokens in memory only.

05Who the app talks to

The app connects directly from your Mac to:

• Apple — imap.mail.me.com and smtp.mail.me.com, to sync and send iCloud mail;
• Google — accounts.google.com and oauth2.googleapis.com to sign in, gmail.googleapis.com to sync and send Gmail, www.googleapis.com for Google Calendar, and people.googleapis.com and Google’s image servers for profile pictures;
• Microsoft — login.microsoftonline.com to sign in and graph.microsoft.com to sync and send Outlook mail.

Sender logos

When a sender has no profile picture, the app can show their organization’s logo instead. It asks Google’s favicon service (www.google.com) for the logo of the sender’s domain, such as github.com — never for their email address — and keeps the answer in its cache. You can turn this off in Settings › General with Show sender logos.

These connections are encrypted with TLS. Your use of each provider is also governed by that provider’s own privacy policy.

Remote content in messages

Many emails include images hosted on the sender’s servers. Loading them can tell the sender when you opened a message, your IP address and your approximate location. The app blocks remote content by default. If you choose to load it — for one message or in Settings — the app requests those images from the sender’s servers, and what they collect is governed by the sender, not by us.

Links you open from an email are handled by your web browser.

06Google user data

Ore’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you add a Google account, the app asks Google for these permissions. Each is used only for the feature named beside it:

• https://www.googleapis.com/auth/gmail.modify — to show your mail and carry out the actions you take in the app. It does not allow permanent deletion of messages.
• https://www.googleapis.com/auth/userinfo.profile, https://www.googleapis.com/auth/contacts.readonly and https://www.googleapis.com/auth/contacts.other.readonly — to show your own profile picture and the pictures of people you correspond with. Google lets you leave these unticked; the app then shows initials instead.

Only when you turn on Calendar for that account, it also asks for:

• https://www.googleapis.com/auth/calendar.events — to show your events and to create, change, move, delete and answer them when you ask it to;
• https://www.googleapis.com/auth/calendar.calendarlist — to show your calendars and change which are shown, their names, colors and default alerts, or add and remove them;
• https://www.googleapis.com/auth/calendar.settings.readonly — to read settings such as when your week starts and how long new events last;
• https://www.googleapis.com/auth/calendar.freebusy — to show when the guests you invite are busy, for Find a Time. It reveals busy times only, never what the events are.

What the app accesses

• Your Google account’s address, name and profile picture, to identify the account in the app.
• Your messages and drafts — headers (sender, recipients, subject, date), bodies and attachments — so you can read, search and reply to them.
• Your labels and each message’s labels, read and starred state, so mailboxes and flags show correctly.
• Your send-as addresses, so you can choose which address a message is sent from.
• The email addresses and pictures of your contacts and of people you have emailed, to match pictures to senders.
• With Calendar on: your calendars, their events (title, time, place, description, guests, video call and reminders), your calendar settings, and the busy times of guests you look up in Find a Time.

How it is used

Only to provide the mail and calendar features you use in the app:

• showing, searching and syncing your mail and events;
• sending messages and saving drafts you write;
• archiving, labeling, flagging, marking read or unread, and moving messages to Spam or Trash;
• creating, editing, moving, deleting and answering events, and alerting you before they start;
• finding a time when the guests you choose are free.

Where it is stored

• Messages, labels and attachments you open, and your calendars and events, are stored in local databases on your Mac so the app works quickly and offline. Pictures are kept in the app’s cache.
• Google’s sign-in refresh token is stored in the macOS Keychain. Short-lived access tokens are kept in memory only.
• Nothing is stored on servers run by Khon Labs. We do not operate any servers for the app.

Who it is shared with

No one. Google user data travels only between your Mac and Google’s servers, encrypted with TLS. It is never sent to Khon Labs or to any third party. When you invite guests or answer an invitation, Google may email the people involved, as Google Calendar itself does; before a change would reach guests, the app asks whether to tell them. In addition:

• It is not used for advertising, including personalized or retargeted ads.
• It is not sold, and it is not used to determine creditworthiness or for lending purposes.
• It is not used to develop, improve or train generalized AI or machine-learning models.
• No person at Khon Labs can read your Google user data.

Keeping and deleting it

Google user data stays on your Mac until you remove the account in Settings › Accounts, which deletes its local data and Keychain credentials, or until you delete the app. Turning Calendar off for the account deletes its calendar data from your Mac. You can also revoke the app’s access at any time from your Google Account’s third-party connections.

07Microsoft user data

When you add an Outlook.com or Microsoft 365 account, the app asks Microsoft for these delegated permissions:

• Mail.ReadWrite — to show your mail and folders, and to move, flag, mark and delete messages and save drafts when you ask it to;
• Mail.Send — to send the messages you write;
• User.Read — to read your address and name, to identify the account in the app;
• openid and offline_access — to sign you in and stay signed in without asking again.

This data is used only to provide the mail features you use, is stored on your Mac like the rest of your mail, and travels only between your Mac and Microsoft’s servers. It is never sent to Khon Labs or any third party, never used for advertising, never sold, and never used to train AI models.

Removing the account in Settings › Accounts deletes its local data and Keychain credentials, and opens Microsoft’s app permissions page, where you can turn the app’s access off: account.live.com for personal accounts, or myapps.microsoft.com for work and school accounts.

08When you contact us

If you email us — for support, feedback or early access — we receive your email address and whatever you choose to include. We use it only to reply to you and, if you asked, to tell you about Ore. We keep it only as long as needed for that purpose and you can ask us to delete it at any time.

Please don’t send us passwords or the content of private messages. We will never ask for your password.

09This website

This website does not use cookies, analytics or advertising trackers. Like any website, our hosting provider may process standard request information — such as IP address, browser type and the page requested — to deliver and secure the site.

10Keeping and deleting your data

Because your data is on your Mac, you are in control of it:

• Removing an account in Settings › Accounts deletes that account’s locally stored mail and calendars and removes its credentials from the Keychain. Your data at Apple, Google or Microsoft is not affected.
• Turning Calendar off for an account deletes that account’s calendar data from your Mac.
• Deleting the app and its data removes all of its local data.
• To revoke access on the provider’s side, delete the app-specific password at account.apple.com, remove Ore from your Google Account’s third-party connections, or turn its access off in your Microsoft account’s app permissions.

Actions you take in the app — such as deleting, archiving or sending a message, or moving or answering an event — are carried out on your provider’s servers too, as you would expect from a mail and calendar app.

11Your rights

Depending on where you live, laws such as Thailand’s Personal Data Protection Act (PDPA) and the EU and UK GDPR give you rights to access, correct, delete or restrict the use of personal data about you, and to complain to a data protection authority. The only personal data we may hold is correspondence you send us. To exercise any of these rights, write to thanathip@khonlabs.com.

12Children

Ore is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.

13Changes to this policy

If we change how the app handles your data, we will update this page and the date at the top. If a change is significant — for example, if the app would start sending any data to us — we will tell you in the app before it takes effect. See also our Terms of Service.

14Contact

Questions about privacy? Email thanathip@khonlabs.com.