Security

Family data handling can go wrong in a lot of ways. Here is exactly how Clario protects yours.

How Clario gets your email

By default, Clario has no access to your mailbox. It receives only the individual messages you forward to your private Clario address, and can act on nothing else.

Clario is separately testing a direct Gmail connection with a small invited group. It is off for everyone else and cannot be switched on from inside the app. Where it is enabled, Clario uses Google's read-only Gmail scope: we can read messages to extract family events, and we cannot send, delete, or modify any email. Connecting uses Google's OAuth flow, so you see exactly what you're granting before clicking allow, and you can revoke it at any time from your Google Account or from Settings inside Clario.

Clario does not use Google as a sign-in method.

OAuth tokens are encrypted at rest

Your Google access and refresh tokens are encrypted with AES-256-GCM before they hit our database. The encryption key is held in our server environment, separate from the database. A database breach alone would not expose your tokens.

Tokens are decrypted only at the moment we make a Gmail API call on your behalf, and only on our server — never in your browser or on your phone.

What we store, what we don't

What Clario never receives
  • Any email you don't forward — unless you're a tester who has connected an inbox
  • Your contacts
  • For connected testers: mail Clario has no reason to read stays on Google's servers
What we send to our AI provider (Anthropic)
  • The subject line and sender of the email
  • The message text
  • Any attached file, such as a photographed school flyer or a PDF calendar or handbook
  • Attachments are read once and never stored
What we store in our database
  • Parsed event metadata (title, date, time, location) — encrypted at rest
  • The forwarded message itself (subject and body), encrypted, for 90 days
  • A reference to the original message, so we don't re-parse it
  • Your account info (email, display name, family members you've added)
  • Encrypted OAuth tokens, for testers who have connected an inbox

We keep the forwarded message so you can open the original inside Clario and see where an event came from. It is encrypted at rest and deleted automatically after 90 days.

AI processing

Forwarded email text, and any images attached to it, are sent to Anthropic Claude via Anthropic's API. Anthropic's commercial API terms state that API submissions are not used to train models and are not retained beyond the duration needed to return a response.

Database security

Clario's database is hosted on Supabase, which is SOC 2 Type II certified and uses AES-256 encryption at rest at the storage layer. Every table containing user data has row-level security policies, so each account can only access its own family's data.

In transit

All traffic between your device, our servers, Supabase, Google, and Anthropic uses TLS 1.2 or higher.

Account deletion

You can delete your Clario account from Settings. On deletion:

  • If you connected an inbox, your Google OAuth tokens are revoked through Google's revoke endpoint and the encrypted tokens are deleted
  • All family data — events, to-dos, calendar imports, scan logs and forwarded messages — is removed from our live systems immediately
  • Your forwarding address stops working: mail sent to it afterwards is discarded without being stored
  • Encrypted backups are retained for up to 7 days as part of normal disaster recovery, after which those copies expire too

If you only want to disconnect a connected inbox without deleting your account, you can do that separately from Settings.

Data retention

Beyond what's tied to your account lifetime:

  • Emails you forward are auto-deleted after 90 days
  • Forwarded mail held for review — sent from an address you haven't approved yet — is auto-deleted after 90 days
  • Email scan logs are auto-deleted after 90 days
  • Parsed event records are auto-deleted after 180 days unless still on your calendar
  • Soft-deleted events are permanently deleted after 30 days
  • Usage analytics are auto-deleted after 12 months

Vulnerability scanning

We run GitHub Dependabot weekly to flag vulnerabilities in dependencies, and audit them with npm audit before a release. Critical vulnerabilities are patched before deploy.

Reporting a vulnerability

If you find a security issue, please email security@clarioaiplanner.com with:

  • A description of the issue
  • Steps to reproduce
  • Your contact info (we'll credit you in the fix if you'd like)

Please do not exploit the issue beyond what's necessary to confirm it. We'll respond within 72 hours and work with you on disclosure timing.

Incident response

In the event of a security incident affecting user data, we will notify affected users within 72 hours of discovery and provide details of what happened, what data was affected, and what we're doing about it.

Third-party services

For full transparency, here's every third party that touches your data:

  • Google — Gmail data source, for testers who have connected an inbox
  • Supabase — Database, authentication, file storage
  • Vercel — Application hosting
  • Anthropic — AI parsing of forwarded email text and attached files (flyer photos, PDF calendars and handbooks)

Each is contractually bound to use your data only for the purpose of providing services to Clario.