Privacy policy

Last updated: October 31, 2026

In short: Kaliham shows your email; it doesn't collect it. Your messages stay with your email provider. We keep only what's needed to sign you in and connect your mailboxes, we protect it with encryption, and we never sell it, show you ads, or track you.

This policy explains how Kaliham (kaliham.app, "Kaliham", "we") handles information when you use the app. Questions? Email privacy@kaliham.app.

What we store

Information	Why	How it's protected
Your name and email address	Your Kaliham account and sign-in	Stored on our server
Your Kaliham password	Sign-in	Only a one-way scrypt hash is stored; nobody can read the password
Your email accounts' settings (server names, user name) and passwords, or the sign-in token from Google or Microsoft sign-in	To connect to your mailboxes for you	Encrypted with AES-256 and never shown again
Signatures you write	To add them to your emails	Stored on our server
Names and addresses of people in your email	To suggest them when you type To, Cc or Bcc	Only you see them; you can remove any suggestion
Senders whose pictures you chose to always show	To remember that choice	Only you see them; manage them under Security
Two-step sign-in secret and recovery codes (if you turn it on)	Two-step sign-in	Secret encrypted; recovery codes stored as hashes
AI apps you connected: the app's name and website, when you connected and last used it, and its access tokens	So the app can reach your email until you disconnect it	Tokens stored only as hashes; disconnect any time under Security
Google Drive, if you connect it: the Google account it belongs to and a sign-in token	To attach files you pick from Drive and save attachments to your Drive	Token encrypted with AES-256; disconnect any time under Security
Notifications, if you turn them on: each device's push address and your choices for it (which mailboxes, whether to show sender and subject)	To tell you about new email on that device	Removed when you turn notifications off or sign out on that device
Feedback you send with "Send feedback": your rating, message and browser type	To improve Kaliham and reply to you	Seen only by Kaliham's administrators (also emailed to them); deleted with your account
Security log: sign-ins, password and account changes, with the IP address and time	To protect accounts and investigate misuse	Kept for 1 year, then deleted
Verification and password-reset codes	To confirm your email address	Stored as hashes; expire after 15 minutes

What we don't store

Your emails and attachments. Kaliham fetches them from your email provider when you open them and doesn't keep copies. Emails you send are sent through your own provider and saved in your own Sent folder there.
Analytics or advertising data. There are no ads, no analytics tools and no tracking pixels in Kaliham.
Payment details. Kaliham is free.

How we use it

Only to run Kaliham for you: signing you in, connecting to your mailboxes, showing and sending your email, keeping your account secure, and sending you the service emails you need (verification codes, password resets, security alerts). We don't sell, rent or share your information for marketing, and we don't read your email.

Accounts connected with Google or Microsoft sign-in

When you connect Gmail or Google Workspace with "Sign in with Google", or Outlook, Hotmail or Microsoft 365 with "Sign in with Microsoft", you give Kaliham permission to read, send, organize and delete email in that mailbox. Kaliham receives your email address and a sign-in token (stored encrypted, like a mailbox password), never your Google or Microsoft password.

Kaliham uses this access only to show you your email and act on it when you ask: opening, sending, replying, moving, starring, marking read and deleting emails, and suggesting the addresses of people you email.
Kaliham doesn't use your email for advertising, doesn't sell it, shares it only with AI apps you connect yourself (see below), doesn't use it to train AI models, and nobody at Kaliham reads it, except with your permission, for security reasons (such as investigating abuse), or to comply with the law.
Your email isn't copied to Kaliham's servers; it's read from your provider when you open it (see "What we don't store").
You can take this access back at any time: remove the account in Kaliham, or in your Google Account (myaccount.google.com/permissions) or Microsoft account (account.live.com/consent/Manage).

Kaliham's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Notifications

If you turn on Notifications on a device, Kaliham checks your inboxes for new email every few minutes and sends a notification to that device. It travels through your browser's own push service (Google for Chrome and Android, Apple for iPhone and Safari, Mozilla for Firefox, Microsoft for Edge), encrypted so that service can't read it. It shows the sender, mailbox and subject, or only “New email” if you choose to hide them. Turn it off under Notifications in Kaliham's menu, in your device's settings, or by signing out on that device.

Google Drive

If you use Drive in a new email or Save to Drive on an attachment, Kaliham asks Google for permission to use only the Drive files you use with Kaliham (Google's "drive.file" permission). It can't see or open the rest of your Drive.

Attaching: you choose files in Google's own file picker; Kaliham downloads only those files to attach them to your email (Google Docs, Sheets and Slides as PDF). They aren't kept on Kaliham's servers.
Saving: the attachment you choose is copied into a "Kaliham" folder in your Drive.
What we keep: the Google account your Drive belongs to and a sign-in token, stored encrypted. Turning it on and off is logged in your security log.
You can disconnect Google Drive at any time under Security in Kaliham, or in your Google Account (myaccount.google.com/permissions). Files already saved stay in your Drive.

AI apps you connect (Claude, ChatGPT and others)

You can connect an AI app to Kaliham with the Kaliham connector (https://kaliham.app/mcp). Nothing is shared with any AI app unless you add the connector in that app, sign in to Kaliham and press Allow.

What the app can do: see which email accounts you connected, list, search and read your emails, and save draft emails in your Drafts folder for you to check. It can’t send, delete or move emails, and it never sees your passwords. Emails it reads stay unread.
What we keep: the app’s name and website, when you connected it and last used it, and its access tokens (stored only as hashes). Drafts it saves are logged in your security log.
What the app does with your email (for example whether it keeps your conversations or uses them to train its models) is decided by that app and its own privacy policy and settings, not by Kaliham. Only connect apps you trust.
Google user data: email from a Gmail or Google Workspace account connected with Sign in with Google is passed to an AI app only when you connect that app yourself and it asks for it, to answer your own requests. Kaliham never uses your email to train AI models and never shares it with AI apps you haven’t connected.
Disconnect an app any time under AI assistants in Kaliham’s menu (also reachable from Security): its access ends straight away.

Cookies and your device

Kaliham uses one cookie, which keeps you signed in. It ends after 14 days without use, or when you sign out. Your browser also remembers a few settings on your own device, like light or dark mode. No third-party cookies.

Who helps us run Kaliham

Oracle Cloud hosts the Kaliham server and its database (Singapore).
Brevo delivers Kaliham's own service emails (verification codes, password resets, alerts) to your address.
ImprovMX forwards emails sent to our @kaliham.app addresses to us.
Your email providers (for example Google or Yahoo): Kaliham connects to them on your behalf, using the details you give it. Their own privacy policies apply to the email they hold.

How we protect it

HTTPS everywhere, and encrypted connections with verified certificates to your email providers.
Passwords hashed, mailbox passwords and two-step secrets encrypted.
Limits on sign-in attempts, optional two-step sign-in, and "sign out everywhere".
Emails are shown in a locked-down frame where scripts can't run; pictures from the internet stay hidden until you allow them, so senders can't track when you read their email.
Daily backups of the database, kept for 14 days on the server and 30 days in a private Oracle Cloud storage bucket.

No system is perfectly secure. If we ever learn of a breach affecting your information, we'll tell you as required by law.

How long we keep it

Your account information: as long as you have an account.
An email account you remove from Kaliham: its settings and password are deleted straight away.
A deleted Kaliham account: removed straight away, and from backups within 30 days.
Security log: 1 year. Unfinished sign-ups: 15 minutes.

Your choices and rights

Remove any email account from Kaliham at any time (the gear next to it in the sidebar).
Change your password, turn on two-step sign-in, or sign out everywhere under Security.
Delete your Kaliham account yourself at any time: Security → Delete my account.
To get a copy of your information or correct it (or if you can’t sign in to delete your account), email privacy@kaliham.app from the address you signed up with. We'll reply within 30 days.

Depending on where you live (for example under the Philippines Data Privacy Act of 2012 or the EU GDPR), you may have further rights, such as objecting to processing or complaining to your data protection authority.

Children

Kaliham isn't meant for children under 13, and we don't knowingly create accounts for them.

Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, we'll tell you by email or in the app.