Privacy Policy

Effective & Last Updated: November 13, 2026 · RightWay AI, Inc.

RightWay AI, Inc. ("RightWay AI," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use, store, protect, and share that information, and the choices available to you across RightWay AI products and services—including Polaris Agent (native macOS desktop workspace), RightWay One, and RightWay School OS (collectively, the "Services").

Google API Services User Data Policy & Limited Use Disclosure: RightWay AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We never sell Google user data, never use Google user data for targeted advertising, and never use Gmail data to train generalized artificial intelligence or machine learning models.

1. Information We Collect

1.1 Account & Profile Information

Basic Identity Data: When you create an account or sign in using Google OAuth (openid, userinfo.email, userinfo.profile), we receive your name, primary email address, and profile avatar URL to authenticate your session and display your account identity.
Educational & Workspace Content: In RightWay One and RightWay School OS, users may voluntarily provide academic backgrounds, target schools, essays, resumes, and planning notes. In Polaris Agent, project files and chat histories are stored locally on your computer in your isolated application data folder.

1.2 Google Workspace & Gmail Data (Polaris Agent Desktop Client)

Connecting Gmail in Polaris Agent is strictly optional and initiated only when you click "Connect" and grant consent on Google's OAuth screen. When connected, Polaris Agent requests the following scopes directly from your device:

https://www.googleapis.com/auth/gmail.modify: Allows you to search, view, and triage your own Gmail messages and update message labels (such as marking emails read/unread or archiving threads) within the desktop client at your direction.
https://www.googleapis.com/auth/gmail.compose: Allows you to create and save email drafts in your Gmail account so you can review and edit messages before sending.
https://www.googleapis.com/auth/gmail.send: Allows the desktop client to send emails or replies on your behalf only after your explicit review and confirmation.

1.3 Technical & Diagnostic Information

Log & Device Metadata: For hosted web services, standard HTTP request metadata (IP address, browser user agent, timestamps, and error diagnostics) is processed to maintain service reliability, security, and fraud prevention.

2. How We Use Your Information

We use collected information strictly to provide and secure the user-facing features you request:

Authenticate your identity and maintain your active user session.
Display, search, label, draft, and send your emails locally in Polaris Agent when you explicitly invoke email actions.
Provide user-requested AI summarization, drafting assistance, and academic or workflow planning for the specific inputs you submit.
Process subscriptions, customer support inquiries, security alerts, and legal compliance obligations.

Strict Restrictions on Google User Data: We do not use data obtained through Google Workspace or Gmail APIs for serving advertisements, creditworthiness checks, data brokering, or training foundational/generalized AI models. Human personnel at RightWay AI do not read your Gmail messages unless you explicitly share a snippet for customer support with your affirmative consent, or where strictly required for security abuse investigation or applicable law.

3. Data Storage, Encryption & Security

Local Keychain Storage for Desktop OAuth Tokens: When you connect Gmail or Outlook in Polaris Agent on macOS, your OAuth 2.0 access and refresh tokens are encrypted locally inside the macOS Keychain on your own computer. RightWay AI does not store your desktop Gmail OAuth tokens or raw Gmail inbox database on RightWay AI cloud servers.
Encryption in Transit & at Rest: All communications between RightWay AI applications, Google APIs, AI model providers, and hosted databases use TLS 1.2+ encryption in transit and industry-standard encryption at rest.
Least-Privilege Access Controls: Hosted educational applications enforce authenticated access controls, tenant isolation, and regular security reviews.

4. Information Sharing & Third-Party Processors

We never sell or rent your personal information or Google user data. Information is shared only in the following limited circumstances:

User-Initiated AI Processing: When you explicitly ask an AI assistant in our applications to summarize or draft content, only the specific prompt context needed to fulfill your request is transmitted over encrypted HTTPS to the configured AI inference provider (such as Google Gemini API) under enterprise/API data-processing terms that prohibit training on API customer data.
Infrastructure Providers: For our hosted web portals, trusted cloud infrastructure providers (such as Supabase for database/authentication, Vercel for web hosting, and Apple/Stripe for billing) process data solely on our behalf under binding confidentiality and security obligations.
Legal Compliance: Where disclosure is required by valid legal process, court order, or applicable law.

5. Data Retention, Revocation & Deletion

Disconnecting Google / Gmail Access: You can disconnect your Gmail account at any time with one click inside Polaris Agent (which immediately deletes your local OAuth tokens from macOS Keychain), or revoke access directly from your Google Account at https://myaccount.google.com/permissions.
Hosted Account Deletion: We retain hosted account records only while your account remains active. You may request complete export or permanent deletion of your hosted personal data at any time by emailing evan@rightway.ai; verified deletion requests are completed within 30 days.

6. Your Privacy Rights (GDPR, CCPA & Global)

Depending on your jurisdiction, you have the right to access, correct, export, restrict processing of, or delete your personal information, and to withdraw consent at any time without penalty. RightWay AI does not sell or "share" personal data for cross-context behavioral advertising under the CCPA/CPRA.

7. Children's Privacy

Our Services are intended for users aged 13 and older (or institutional accounts authorized by schools/parents). We do not knowingly collect personal data from children under 13 without verifiable authorization.

8. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect product, security, or regulatory updates. Material changes will be posted at this URL with an updated effective date.

9. Contact Us

If you have questions or requests regarding this Privacy Policy or our Google API data practices, please contact:
RightWay AI, Inc.
Email: evan@rightway.ai / ran759771@gmail.com
Website: https://trust.rightway.ai/