Privacy policy
Who we are
Sorelia is a personal assistant that keeps track of your calendar, reminders and the details you ask it to remember. This policy explains what we collect, why, who else sees it, and what you can do about it.
Sorelia is operated by Sorelia LLC, a Florida limited liability company, 2512 Oyster Catcher Court, 201, Tampa, FL 33619, United States. This policy and your use of Sorelia are governed by the laws of the State of Florida.
For questions about this policy or about your data, write to support@sorelia.ai.
What we collect
Account information
Your email address, and your name if you give one. Your time zone, which is read from your device the first time you sign in so that reminders fire at the right hour.
Content you create
- Saved items, including any you mark as sensitive.
- Reminders, their schedules, and whether they were completed.
- Calendar events you create in Sorelia.
- Your conversations with Sorelia, including voice notes you record.
- Feedback and feature requests you send.
Data from accounts you connect
If you connect a Google or Microsoft calendar, we store the events and calendar list needed to show your schedule, together with the access tokens that let us read them. We request the narrowest calendar scopes that make the feature work. We do not read your email, your files, or your contacts.
Technical data
If you turn on notifications, we store the push subscription your browser issues, which identifies the device rather than you. We keep server logs and records of requests made to the AI provider so that we can diagnose failures and control costs.
Google user data
If you connect a Google account, Sorelia asks for these permissions and uses each one only for what is listed beside it. Nothing here is used for advertising, and nothing is sold.
.../auth/calendar.events— read and write access to the events on the calendars you connect, so your schedule appears in Sorelia and events you add, edit or delete here reach Google..../auth/calendar.calendarlist.readonly— the list of calendars on your account, so you can choose which ones Sorelia shows. It does not read the contents of a calendar you have not connected.openid,email,profile— to sign you in and to record which Google account is connected, so the right one syncs.
Sorelia’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to develop, train or improve generalised artificial intelligence or machine learning models, is never sold, and is never transferred to anyone except as needed to provide the features described here, or where the law requires it. This applies to the data in its raw form and equally to anything aggregated, anonymised or otherwise derived from it.
Because Sorelia is an assistant, answering a question about your schedule means sending the events involved to an AI model. Where that goes, and on what terms, is set out under AI processingbelow. In short: only to the paid tier of Google’s own Gemini API, which does not use prompts or responses for training, and to no other AI provider at all.
You can withdraw this access at any time, either from Settings in Sorelia or from your Google account permissions.
Cookies and similar technologies
Sorelia sets only the cookies it needs to work. There is no advertising network, no analytics product, and no third-party tracker in the app, so there is nothing here to opt out of.
- Sign-in cookies, which keep you logged in between visits and are set by our authentication provider.
- A short-lived security cookie written while you connect a Google or Microsoft calendar, used once to verify that the reply came back from the provider you were sent to. It expires within ten minutes.
Your browser also holds some of your settings locally on your device so the app can start up in the state you left it. That data stays on the device and is not sent to us.
How your data is used
- To run the product: showing your schedule, sending reminders, and answering what you ask.
- To keep your account secure and to prevent abuse.
- To fix problems and improve reliability.
We do not sell your data. We do not share it with advertisers or data brokers. We do not use it to build a profile of you for anyone else.
AI processing
Sorelia answers you using the Google Gemini API, operated by Google LLC, on its paid tier. That is the only artificial intelligence or machine learning service Sorelia uses. There is no second provider, and no aggregator, gateway, router or model hub in the path, so the only models that ever see your data are the Gemini models named below, called directly at Google’s own endpoint.
gemini-3.6-flashanswers you in chat and decides which actions to take on your behalf.gemini-flash-lite-latestclassifies what a message is asking for, so the right tools are available to answer it.gemini-3.1-flash-litetranscribes voice notes you record.
To generate a reply, your message is sent to Google along with the context needed to answer it, which may include recent messages, your reminders, and events from a calendar you have connected.
None of this is used to train or improve any AI or machine learning model, Google’s or ours. Google’s terms for the paid tier of the Gemini API state that Google does not use prompts or responses to improve its products, and Sorelia is configured so that a request cannot be sent on any other tier or to any other provider. We do not train, fine-tune or evaluate any model of our own on your content, and we do not permit anyone else to.
Before anything is sent, saved item fields you have marked as sensitive are redacted, so passwords and document numbers are never included in a request.
This service is not self-hosted. Requests are sent to Google’s API under the commitments described above rather than processed on our own hardware.
If the provider, the tier, or the models ever change, this policy is updated to name the new ones before the change takes effect.
Security
- Sensitive saved fields, such as passwords and document numbers, are encrypted with AES-256-GCM before they are written to the database and are only decrypted when you explicitly ask to see one.
- Every table is isolated per account by Postgres row level security, so the separation is enforced by the database rather than by the interface.
- Data is encrypted in transit.
No system is perfectly secure. If we ever become aware of a breach affecting your data, we will tell you.
Who else processes your data
We use a small number of service providers to run Sorelia. Each one only receives what it needs to do its job.
- Supabase for the database, authentication and file storage.
- Vercel for hosting and delivery.
- Google for AI processing and transcription, through the paid tier of the Gemini API, and for calendar access if you connect a Google account.
- Microsoft for calendar access if you connect a Microsoft account.
- Upstash for scheduling reminder delivery.
How long we keep it
Your content, and the server logs and AI request records tied to your account, are kept for as long as your account exists. When you delete your account, they are erased as described below. We do not currently run a separate schedule that discards logs earlier than that.
Where your data is held
Sorelia is operated from the United States and your data is stored on servers in the United States. If you use Sorelia from outside the United States, you are sending your data to a country whose data protection laws may differ from those where you live. Where the law requires a safeguard for that transfer, we rely on the European Commission’s standard contractual clauses, which our providers have in place.
Why we are allowed to process it
If you are in the EU, the UK, or somewhere with comparable law, we rely on these grounds:
- Performing our contract with you, for everything needed to run the account and the features you use.
- Our legitimate interests, for keeping the service secure, preventing abuse, diagnosing failures, and controlling costs.
- Your consent, for notifications and for connecting a calendar. You can withdraw either at any time, in the app.
- Legal obligation, where we are required to keep or disclose something.
Your rights
Depending on where you live, you may have the right to access, correct, export, restrict or erase your personal data, and to object to its processing. If you are in California or another US state with a privacy law, that includes the right to know what we collect, to delete it, to a copy of it, and not to be treated differently for asking. We do not sell personal information, and we do not share it for cross-context behavioural advertising. Two of these rights you can exercise directly in the app, without asking us:
- Erasure. Settings, then Delete account. This deletes your account and its content, removes your stored voice notes, and revokes the access we hold to any connected Google account. It cannot be undone.
- Correction. Your name and your content can be edited in the app at any time.
To get a copy of your data, write to support@sorelia.ai and we will send you a machine-readable file containing your saved items, reminders, events and conversations. We will reply within one month.
Events that Sorelia added to a calendar you connected stay on that calendar after deletion, because they live in your Google or Microsoft account rather than in ours. You can remove them there.
For anything else, or to complain about how we have handled your data, write to support@sorelia.ai. If you are in the EU or UK you also have the right to complain to your local data protection authority.
Children
Sorelia is not intended for children. Do not use it if you are under 16, or under the minimum age for consent to data processing where you live, whichever is higher.
Changes to this policy
If this policy changes in a way that materially affects you, we will tell you in the app before the change takes effect. The date at the top always reflects the current version.