Privacy Policy

Effective October 12, 2026

SulcusAI is a desktop app that runs AI models on your own computer. It is open source (source code) and is made by Isaac Lehman. This policy explains what the app does with your information, including information from your Google or Microsoft account if you connect one.

The short version

SulcusAI has no servers that receive your data. There are no SulcusAI accounts, no analytics and no tracking.
Your chats, files, mail and calendars stay on your computer, encrypted.
The AI runs on your computer by default. Nothing is sent to an online AI service unless you turn that on yourself.
We never sell your data, use it for advertising, or use it to train AI models. We never receive it.

What stays on your computer

Everything you create or connect in SulcusAI is stored in the app's data folder on your computer: chats, memories, notes, tasks, meeting recordings and transcripts, pictures, and copies of the mail and calendar events you connect. Chats, your profile, account settings, sign-in tokens, mail and calendar data are encrypted with AES-256-GCM. The key is protected by your operating system account and, if you turn on app lock, by your PIN or passphrase.

Google user data

If you choose Sign in with Google in SulcusAI's Mail or Calendar, the sign-in page opens in your own browser. SulcusAI never sees your Google password. With your permission, the app receives a token that lets it access only the following:

Permission	What SulcusAI does with it
Gmail (`https://mail.google.com/`)	Connects to Gmail over IMAP and SMTP so you can read, search and sort your mail in the app, and send the messages you write or approve. The assistant can search and summarize your mail when you ask it to, and it asks before sending anything.
Google Calendar (`…/auth/calendar`)	Shows your calendars and events in the app, and creates or deletes the events you choose. The assistant can add an event when you ask it to; an event that invites other people always asks you first.
Email address and basic sign-in (`openid`, `email`)	Tells the app which account you connected, so it can label it.

Mail and events are copied into SulcusAI's encrypted store on your computer so you can read and search them offline. Google data is used only to provide these features to you. It is not transferred to anyone except as described under "Online AI services" below, when you choose that. No person at SulcusAI can read it, because it never leaves your computer for us.

Limited Use. SulcusAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve or train generalized AI or machine-learning models.

Microsoft user data

If you choose Sign in with Microsoft, SulcusAI asks for permission to read and send mail over IMAP and SMTP (IMAP.AccessAsUser.All, SMTP.Send), to read and change your calendars (Calendars.ReadWrite), and for your email address and a sign-in token (openid, email, offline_access). It handles this data exactly as described for Google above.

Online AI services (only if you turn them on)

SulcusAI starts in Offline mode. If you switch to Cloud and choose an online AI provider with your own API key (for example OpenAI, Anthropic or Google Gemini), the text the assistant needs for a reply is sent to that provider. If you ask about your mail or calendar while using such a model, that can include the relevant messages or events. The provider handles it under its own terms and privacy policy. SulcusAI can mask personal details such as email addresses and phone numbers before sending (this is on by default). Local models never send anything.

What goes over the internet

Only what you ask for, and every request is recorded in the app's activity log on your computer:

Downloading AI models and engines you choose to install (from Hugging Face and GitHub).
Checking for and downloading SulcusAI updates (from GitHub).
Web searches and pages, when you turn on web access.
Your mail and calendar providers, for accounts you connect.
Online AI providers, if you turn them on.
Sync between your own devices, if you set it up. It is end-to-end encrypted with a key only your devices share; an optional relay you choose passes along encrypted data it cannot read.

Removing your data

Removing a mail or calendar account in SulcusAI deletes its sign-in token and the copied mail or events from your computer.
You can revoke SulcusAI's access at any time at myaccount.google.com/permissions (Google) or account.live.com/consent/Manage (Microsoft).
Uninstalling SulcusAI and deleting its data folder removes everything it stored.

Children

SulcusAI is not directed to children under 13.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.

Contact

Questions: isaacleh1@gmail.com, or open an issue on GitHub.