Privacy policy

What this policy covers

This policy covers Agama: the website at tryagama.ai, the account app at app.tryagama.ai, and the MCP server at mcp.tryagama.ai that AI apps connect to. “We” and “us” mean the people who run Agama. “You” means the person using it. Agama is in early beta, and this policy describes how the service works today.

Information we collect

Your Agama account

• Your email address and name. If you sign in with Google, we also receive the profile picture URL that Google provides. If you sign in with an email link, we only have the email address you enter.
• A session cookie that keeps you signed in on app.tryagama.ai, and a session record that includes the IP address and browser user agent the session started from.

AI apps you connect

• When an AI app such as ChatGPT or Claude connects to Agama, it registers itself with us. We store the name it gives, the addresses it asks us to send you back to, and the access you granted it, including when it was last used.

Accounts you connect

• For each account you connect, such as a Gmail account, we store its identity (for Gmail, the email address), the label you give it (for example “work”), whether it is your default for that product, and its connection status.
• The access and refresh tokens for that account. These are held by our OAuth infrastructure, described under Security, not in our main database.

Approvals

• When an AI app asks to send or change something, we store the request until you approve or deny it. The content of the request (for example the email you are about to send) is encrypted while it waits and deleted once you decide or the request expires.
• We keep a record of each decision: which account, what kind of action, which AI app asked, the outcome, and when. This record does not include the message content.

Security and operations

• IP addresses, used to rate-limit sign-in attempts and app registrations and to protect the service from abuse.
• Service logs. These record metadata such as request times, status codes and errors. Personal information such as email addresses and message content is redacted from them.

Data from connected accounts, including Gmail

When you connect a Gmail account, you grant Agama permission to read your messages and to send email on your behalf. We use that access only to carry out requests you make through an AI app you have connected to Agama.

• Fetched on request. We read Gmail data only when you, through your AI app, ask for it. We do not scan or index your mailbox in the background.
• Passed to the AI app you are using. The results of your request, such as the messages you asked to summarize, are returned to the AI app that made the request. That is how the AI can answer you.
• Not stored by us. We do not keep copies of email bodies. Content you are about to send is held, encrypted, only until you approve or deny it.
• Writes need your approval. Agama never sends email unless you approve that specific message on app.tryagama.ai, and the approval names the account it will be sent from.
• No human reading. People at Agama do not read your Gmail data, except with your explicit permission for a specific message, when needed for security purposes such as investigating abuse, to comply with the law, or when the data has been aggregated and anonymized for internal operations.
• No ads, no selling, no training. We do not use Gmail data for advertising, we do not sell it, and we do not use it to train AI or machine learning models.

Agama’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

• To sign you in and keep your account secure.
• To let the AI apps you connect act on the accounts you connect, as you request.
• To show you approvals and carry out the ones you approve.
• To send you sign-in emails. We do not send marketing email.
• To prevent abuse, enforce rate limits, and fix problems with the service.

Who we share information with

We do not sell your information. We share it only as follows.

AI apps you connect

When you connect an AI app such as ChatGPT or Claude, that app receives the results of the requests you make through it, which can include your email content. What the AI app does with that data is governed by its own privacy policy, not this one. You can revoke an AI app’s access at any time by emailing privacy@tryagama.ai.

Service providers

• Railway hosts our servers and our Postgres database.
• Resend delivers sign-in emails, so it receives your email address and the sign-in message.
• Google handles Google sign-in if you choose it, and provides the Gmail API for Gmail accounts you connect.

Connected-account tokens are held by Nango, open-source OAuth software that we run ourselves on our own hosting, not a separate company’s service.

Legal reasons

We may disclose information if the law requires it, or if it is needed to protect the safety of people or the security of the service.

How long we keep information

• Account and connection details: until you delete your account.
• Pending write content: until you approve or deny it, or until it expires after 24 hours.
• Email bodies you read through Agama: not stored.
• When you delete your account, we revoke every connected account at its provider and delete your account, connection and AI app records. We may keep an anonymized record of past approvals that no longer identifies you.

Security

• Connected-account tokens are held by our OAuth infrastructure (self-hosted Nango) and encrypted at rest. Our main database stores only a reference to each connection.
• AI apps never receive your passwords or tokens. They receive only results.
• All traffic to Agama uses HTTPS.
• Your sign-in cookie is limited to app.tryagama.ai, so no other site or subdomain can read it.

Your choices

• Revoke an AI app. Email privacy@tryagama.ai and we cut off its access.
• Disconnect an account. Email privacy@tryagama.ai and we disconnect it. You can also remove Agama’s access to a Google account at myaccount.google.com/permissions.
• Delete your account. Email privacy@tryagama.ai from the address you sign in with and we will delete it as described above.
• Ask what we hold. Email privacy@tryagama.ai for a copy of the information we have about you, or to correct it.

Children

Agama is not meant for children under 13, and we do not knowingly collect information from them. If you believe a child has an account, email privacy@tryagama.ai and we will delete it.

Changes to this policy

We will update this page when our practices change and change the effective date at the top. If a change affects how we use connected-account data, we will tell you by email or in the app before it takes effect.

Contact

Questions or requests about privacy go to privacy@tryagama.ai. The terms of service cover the rest of how Agama works.