Iris privacy policy

Effective November 4, 2026

Iris is an AI assistant made by Iris AI Labs ("we", "us"), based in Texas, USA. This policy explains what Iris collects, how it's used, who helps us run it, and the choices you have. Questions: hello@irisailabs.com.

The short version

• Your data is used to run Iris for you. We don't sell it, and Iris has no ads.
• Nothing goes out in your name (an email, a reply, a calendar change) without your OK.
• Data from your Google account is never used to train AI models and never used for ads.
• You can disconnect any account at any time, and ask us to delete everything.

What we collect

• Account details: your name and email from the sign-in you choose (Apple or Google), and your settings, such as your brief time and quiet hours.
• Google account data, only if you connect it: your Gmail messages and your Google Calendar events and calendar list. Iris reads these to summarize what matters, draft replies, and send email or change events when you approve it.
• Messages you choose to share: texts and chats sent to Iris by the Iris Shortcut on your iPhone, the Iris Link accessory, or notification access on Android. These can include messages from other people who write to you.
• What you tell Iris: your chats with Iris, the tasks and reminders it keeps for you, and things you ask it to remember.
• Device details: a push-notification token so Iris can alert you, and which devices you've linked.
• Usage: what features you use (for example, asks, card taps, task changes) and how much AI processing your account uses, so we can improve Iris and apply your plan's limits.
• Waitlist: if you join the waitlist, your email, phone type and anything you tell us you'd use Iris for.

How we use it

• To run Iris for you: your daily brief, reminders, summaries, drafts and the actions you approve.
• To keep Iris working and secure, fix problems, and prevent abuse.
• To improve Iris, using usage information about what features people use.
• To contact you about your account, and about Iris if you joined the waitlist.

Google user data

Iris's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Gmail and Google Calendar data only to provide and improve the features you see in Iris.
• We don't use it for advertising, don't sell it, and don't use it to train AI models.
• We don't let people read it, except with your permission, for security reasons, or where the law requires it.
• We share it only with the service providers below who help us run Iris, and only to provide Iris to you.

Who helps us run Iris

We use a small number of service providers. They handle your data only on our behalf, to run Iris:

• Anthropic processes the content Iris works on to produce answers, summaries and drafts. We use Anthropic's commercial API, whose terms don't allow your content to be used to train their models.
• Supabase hosts our database and handles sign-in.
• Railway hosts our servers.
• Google and Apple provide sign-in, and Google provides Gmail and Calendar access when you connect them.
• Expo delivers push notifications to your phone.
• Cloudflare runs our domain and website traffic.

We may also share information if the law requires it, to protect people's safety, or as part of a merger or sale of the company (with this policy still applying to your data).

How long we keep it

• Messages shared through the Shortcut, the Iris Link or Android notifications: 30 days.
• Email summaries Iris makes: 30 days. Package-tracking details: 21 days.
• Your chats with Iris, tasks and things you asked it to remember: until you delete them or close your account.
• When you close your account, we delete your data within 30 days, except what the law requires us to keep.

Security

Data is encrypted in transit. The keys that let Iris reach your Google account are encrypted at rest. Every user's data is kept separate in our database, so one account can't read another's. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you.

Your choices and rights

• Disconnect Google at any time in Iris's Settings, or at myaccount.google.com/permissions.
• Turn off the Shortcut, the Iris Link or notification access whenever you like.
• Access, correct, download or delete your data by emailing hello@irisailabs.com. We'll answer within 45 days. If we turn down a request, you can appeal by replying to our answer.
• We don't sell personal data or use it for targeted advertising.

Children

Iris is for people 18 and older. It isn't meant for children, and we don't knowingly collect information from anyone under 13. If you think a child has given us information, email us and we'll delete it.

Changes

If we change this policy, we'll update the date at the top. For important changes, we'll tell you in Iris or by email before they take effect.