Google mail and calendar in Orviah

The permissions Orviah asks for

Orviah asks for the narrowest Google permissions that cover what it does. These are the exact scopes requested when you connect a Google account:

openid, email

Know which Google account you connected and its address.

To show the account on the Accounts page, to tell two accounts apart, and to route a reply through the account the message came to.

calendar.events.owned

See, add, change and remove events on calendars you own.

Home shows today's remaining events, Orviah's AI sees your week when it answers you, and an event is created, moved or removed only when you ask for your calendar in words. Orviah does not ask for the broad calendar permission: it never touches sharing, settings or other people's calendars.

gmail.modify

Search and read mail; create drafts and send; add and remove labels; archive; move to Trash; mark read or unread.

To read the emails you ask about, draft the replies you approve and send the one you tap Send on, and to tidy your mailbox when you ask. This permission cannot delete mail permanently, which Orviah never does.

gmail.settings.basic

Create and remove filters.

For a standing rule you ask for, such as always archiving a newsletter. It cannot set up forwarding or delegation, which would need a permission Orviah does not ask for.

Google classes the two Gmail permissions as restricted and the calendar permission as sensitive. Calendar and Gmail come as one Google connection; if you untick a permission on Google's page, Orviah revokes the partial grant at once rather than keeping a token it cannot use properly, and asks you to connect again.

What Orviah reads, and when

Your calendar

Orviah refreshes the events on the calendars you own and shows today's remaining ones on Home. When you talk, the coming days' events are part of what Orviah's AI is given, so that "what's my week like?" and "can Thursday work?" can be answered. Availability is worked out from the events themselves; Orviah never asks for the free/busy permission.

Your mail, only when you ask about it

Orviah does not read your inbox in the background. When a question needs your mail ("what did the landlord say about the fan?", "where are we with the audit?"), Orviah's AI replies with up to four Gmail searches, your phone runs them, and up to forty matching messages are turned into bounded plain text and shown to the AI as evidence. Email content is treated as evidence, never as instructions: a message that tries to instruct Orviah is reported as suspicious, not obeyed. Text is read out of an attachment only when you ask what is in it.

Subscriptions, when you ask to tidy

"Clean up my inbox" reads message headers (sender, subject, list-unsubscribe) to work out who is sending you mailing-list mail, so Orviah can offer to archive and unsubscribe. Bodies are not read for this.

What Orviah writes, and when

Drafts and sending

"Email Daniel about the backup" produces a draft, shown on your screen with its recipients. You can change it by talking or by hand. Nothing leaves until you tap Send on that screen. Orviah's AI cannot send; it can only draft. A reply goes back through the account the message came to.

Mailbox changes

Archive, move to Trash, mark read or unread, labels, rules (filters) and the standard way out of a mailing list happen only when you ask. Anything bulk is offered first ("I'll archive about 1,400 messages and unsubscribe from twelve senders. Go ahead?") and runs only after your yes. Everything except unsubscribing and creating a label is reversible, and Orviah records what it changed so you can undo it. Orviah never deletes mail permanently, never sets up forwarding, and never changes who can access your mailbox.

Calendar changes

An event is created, moved, renamed or removed only when you clearly ask for your calendar ("put that in my calendar", "move my dentist appointment to Friday"). Removing an event is offered first. A to-do and an event are different things: "dentist Tuesday at 11" becomes a to-do, not an event, unless you say both.

Where your Google data goes

• On your phone. Google's tokens are stored in the device's Keychain, protected by the device's passcode and hardware. They are never uploaded. Reading and writing Gmail and Google Calendar happens from your phone directly to Google.
• In one request to Orviah's AI. When an answer needs your mail or calendar, the bounded text that was read is included in the request your phone sends to Orviah's AI, together with your words and the relevant parts of your life. The request travels encrypted to Orviah's infrastructure, is answered by Orviah's own processing computer using a language model from Anthropic (Claude), and is deleted once your phone has read the answer. The processing computer keeps nothing between requests; its log holds timings, never your text. When the primary model is unavailable, the same request is answered through GitHub Copilot under the same rules. See the privacy policy for the processors involved.
• Not on Orviah's servers. No email, event, contact or token is stored on Orviah's servers. The only exception is one you ask for: "add these emails to the kitchen's context" writes dated notes into your life, which lives encrypted on your device and in your sealed backup that Orviah cannot read.
• Not for anything else. Google data is used only to provide the features above. It is not used for advertising, not sold or shared with data brokers, not read by people at Orviah, and not used to develop, improve or train generalised AI or machine-learning models.

Disconnecting and deleting

• In Orviah: Settings → Accounts & connections → the account → Remove. Orviah forgets the account on every device; nothing in your mailbox or calendar is touched.
• At Google: Third-party apps & services in your Google Account lists Orviah and lets you remove its access.
• Deleting your Orviah account (Settings → Delete) removes your account, your sealed backup and every server-side record. Because Google data is not stored on Orviah's servers, there is nothing of it left to remove there; dated notes you asked to keep are part of your life and go with it.

Google's Limited Use policy

Orviah's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Orviah does not use data obtained through Google Workspace APIs to develop, improve or train generalised or non-personalised AI or machine-learning models.

Outlook and Microsoft 365

Orviah can connect Outlook and Microsoft 365 accounts in the same way, through Microsoft's own sign-in library, with mail and calendar on each account. It asks for four delegated permissions, each used only when you ask: User.Read (which account you connected and its address), Mail.ReadWrite (search and read the mail you ask about, create the drafts you approve, archive, move to Deleted Items and mark read when you ask), Mail.Send (send only an email you have read and tapped Send on) and Calendars.ReadWrite (show your events and create, move or remove one when you ask for your calendar). Tokens stay in your device's Keychain; nothing from your mailbox or calendar is stored on Orviah's servers. The connection is built and not yet switched on in the beta; when it is, this page will describe it in the same detail.

Questions about any of this: support@orviah.app.