Skip to content
CoworkSign in

Privacy policy

Last updated October 17, 2026

Cowork is a personal work assistant. This policy explains what we collect, why, who processes it, and the choices you have. Contact us any time at [email protected].

What we collect

  • Account: your email address, used to send sign-in codes and the emails you opt into. We don't use passwords.
  • Content you add: tasks, notes, knowledge sources, chat messages, automations and settings.
  • Connected services: data from services you choose to connect (see below). Access tokens are encrypted at rest with AES-256-GCM.
  • Security records: session records (browser type and a shortened IP prefix), sign-in attempts and an activity log of actions taken in your account.

We don't use advertising trackers or analytics cookies. The only cookie is your sign-in session.

Google user data

If you connect a Google account, Cowork requests:

  • Gmail read-only (gmail.readonly): to show and sort your inbox, flag urgent mail and include it in your daily briefing.
  • Gmail compose (gmail.compose): to create reply drafts in your Gmail when you ask. Cowork never sends email for you; you review and send drafts yourself in Gmail.
  • Calendar read-only: to show today's meetings in your briefing.
  • Drive read-only, if you add Drive as a knowledge source: to index the documents you select for search.

We store email metadata (sender, subject, date, labels) and short AI-generated summaries. Full message bodies are fetched when needed and not stored. Email text is sent to our AI provider only to classify, summarize or draft for you, and is not used to train models.

Cowork's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

  • use Google data only to provide and improve the user-facing features described above;
  • do not transfer it to others except as needed to provide those features (the processors listed below), to comply with law, or as part of a merger or acquisition with notice to you;
  • do not use or transfer it for advertising, and do not sell it;
  • do not let humans read it, unless you give explicit consent for specific messages, it's needed for security or legal reasons, or it has been aggregated and anonymized;
  • do not use it to develop, improve or train generalized AI or machine-learning models.

How we use data

  • To provide the features you use: briefings, inbox sorting, drafts, tasks, reminders, knowledge search and automations.
  • To send sign-in codes, a welcome email, and update and briefing emails you can switch off in settings or from any email.
  • To keep the service secure: rate limiting, abuse prevention and audit logs.

Processors

We use these service providers to run Cowork. They process data only on our instructions:

  • Vercel: application hosting.
  • Supabase: database.
  • Resend: email delivery.
  • Our configured AI model provider: classifying, summarizing and drafting text.
  • Upstash, if enabled: rate-limit counters (hashed keys, no content).

Retention and deletion

We keep your data while your account is active. You can disconnect any service, delete indexed knowledge, and export your data from Settings at any time. Disconnecting Google revokes our access and deletes the stored tokens. To delete your account and all associated data, email [email protected] and we'll complete it within 30 days. You can also remove access at myaccount.google.com/permissions.

Security

Data is encrypted in transit (TLS) and tokens are encrypted at rest. Sign-in codes, sessions and API tokens are stored only as hashes. Cowork is built so nothing is sent, posted or deleted on your behalf without your explicit click.

Children

Cowork is not intended for children under 16 and we don't knowingly collect their data.

Changes

If we change this policy in a meaningful way, we'll update the date above and tell you by email or in the app.