Sakhai remembers on your phone. Her server runs for your household alone and keeps no record of what you said. What she hears is processed by Google's live voice model under its API terms. Everything below is the detail behind those three sentences — including the places where they need qualifying.
Sakhai is made by Cognio Lab LLC, a company registered in the United States. In this policy, "we" and "us" mean Cognio Lab LLC; "you" means the person using Sakhai, and where relevant the family members paired to that person's household.
For anything in this policy, write to moses@sakhai.care.
The Sakhai app keeps the following on your device, in the phone's own encrypted storage:
| What | Where it lives | Does it leave the phone? |
|---|---|---|
| Reminders — title, time, kind, repeat | App database on the phone | The current list is sent to your household server for the length of a conversation, held in memory, and gone when you disconnect. |
| Things she remembers about you ("my grandson is Arun") | App database on the phone | The same. New facts she learns are sent back down to the phone to be stored there. |
| Her name, your household id, your health consent | The phone's keychain / keystore | The household id and her name go up each time you connect. |
| Cards and songs she made for you, once you've saved them | Your photos and files | Only if you share them. |
Because your reminders and memories live on your phone, the phone is the source of truth. Sakhai is built never to guess at them: when you ask what you have on today, the answer is read from your device, not from a model.
A household runs on its own small virtual machine. It holds the operating facts it needs and very little else:
| What | Contents | Any of your words? |
|---|---|---|
| Household record | Household id, first name, timezone, when the phone was last heard from; the carers paired to it and their notification tokens; pairing codes; that an alert was sent, with its urgency and time | No — the alert's own text is never stored |
| Paired phone numbers | The WhatsApp numbers paired to the household, the name WhatsApp gives for each, when they paired, and when each last wrote | No message text |
| Capabilities and consents | Which capabilities are on, and the sentence in which someone agreed | The consent sentence, by design |
| Medicine adherence | Medicine reminder titles and whether each dose was confirmed | Reminder titles |
| Shopping watch list | Things you asked her to watch: the name, the shop page, the price then and now — at most 30 days | Product names, which you named |
| Voices she answers | For each enrolled person: a name, when it was learned, and 192 numbers describing the voice. Never the audio — it is discarded the moment those numbers exist, and they cannot be turned back into a voice. | No |
| Letters | Which senders or kinds of sender you said matter; and, for a letter she has read, a few words per item it asks of you ("Picture day", "field trip form") and its date, for 30 days. Never the letter itself. | A few words of what a letter asks |
| Cards, plan cards, songs, voice notes | Media she made at your request, deleted after 30 days (voice notes after one day) | The words you dictated, inside the media |
| Call-backs she promised | The number, the time, and up to eighty characters of why — gone once the call happens | A few words, until the call |
| The Purse (if you use it) | Your card's brand and last four digits, the two limits you set, your delivery address, and each purchase. Never a card number. | The names of things you bought |
| What she did lately | A line for each thing she did for you in the last day — "found five flight plans", "set a reminder", "read a letter from the school" — with which door it happened on, and the town your phone last reported. It is how a call knows what the app just did. A day, then gone. | Her words about what she did, and the town |
| System log | The shape of each event — heard, 23 characters — kept 7 days | No |
We maintain a separate development environment where we study conversations in order to improve her. It is never a household. It runs on our own hardware, with our own voices and a synthetic test persona, and no customer household is ever connected to it.
Sakhai's abilities — WhatsApp, telephone calls, reading your letters, the camera, reading documents aloud, shopping, trips, paying for something — are each a separate capability, and each is off by default. The only exception is the emergency path, which is on unless you turn it off, because a safety floor that has to be switched on is not a safety floor.
Turning one on writes a receipt recording who agreed, in what words, and when. Where a family member enables something on behalf of an older person, that person is told what it does and can refuse it — and on their own device the list is readable but not editable by anyone else.
Sakhai cannot work without sending some things to other companies. Each of these only happens when the relevant capability is on. We list every one, including the parts that are less than ideal.
| Who | What reaches them | On what terms |
|---|---|---|
| Google (Gemini) | Your voice, the prompt describing this conversation (her name, the reminders and memories your phone lent for the session), and the results of anything she looked up | Google's API terms. We do not claim zero data retention. We use Google's standard endpoint, and we would have to change our architecture to promise otherwise. We would rather say this than imply a guarantee we cannot make. |
| Meta (WhatsApp) | Your number, every message and voice note in both directions, and the links to any cards or notes she sends | Only with WhatsApp turned on. WhatsApp's Business terms. Meta keeps message and delivery logs on the account. Messages are end-to-end encrypted between Meta and your phone; the business side holds the plain text as it sends. |
| Twilio | Your number and your voice, both ways, for telephone calls | Only with the telephone capability on. Twilio's terms; it keeps call records (numbers and duration) on its account. We do not ask for recordings. |
| Stripe | Your card — typed into Stripe's own form on your phone, never passing through us; then one single-use token per purchase | Only with the Purse on. Stripe's terms. |
| Speechify, Cartesia | The words of a document she is reading aloud, paragraph by paragraph | Only with the reader on, and only when the reading is not being done on the household itself |
| Duffel, airlines and hotels | Airport codes, dates and how many adults — no names, no ages | Only with trips on. No booking is ever made by us. |
| Expo (notifications) | Your carers' notification tokens, and the wording of an alert | Only for the family app's notifications |
| Open-Meteo, Nominatim | Rounded coordinates, or the name of the town you mentioned | Public services, no account, nothing identifying |
| Shops and search | The words you asked to shop for, and one anonymous request per product page — no cookie, no login, no card | Only with shopping on. The shortlist is discarded when the conversation ends. |
We do not sell your information, and we do not share it for advertising. We do not give any of these companies permission to train models on your conversations as part of our arrangement with them; where a provider's own standard terms govern that, those terms are linked above by name and we have described their effect honestly rather than glossed it.
Legal requests. We give information to a government body or a court only on valid written legal process — a subpoena, a court order or a warrant — addressed to Cognio Lab LLC. We read each request for validity and scope, take legal advice where needed, and challenge or narrow one that asks for too much. We hand over the minimum the law requires, tell the person affected first unless the law forbids it, and keep a record of every request. We keep no recording of what you say and very little else, so there is little to give. Anyone else who asks is refused without your consent or legal process. To date we have received no such request.
If you teach Sakhai your voice, she stores a voiceprint: a name, the date, and 192 numbers derived from a few seconds of speech. The audio itself is discarded as soon as those numbers exist, and the numbers cannot be turned back into a recording. Its only purpose is so she answers you and not the television.
Say "forget my voice", or use the setting on your own device, and it is deleted. Nothing else changes except that she will answer anyone again.
You may connect your own mailbox so she can tell you when a letter that matters arrives. If you do:
Your phone reports its position so she can answer about the weather or find a pharmacy near you; she never asks you which town you are in when the phone can say. The fix is rounded to about a kilometre before it leaves the phone — the town, never the house — lives in memory for the conversation, and is not written down. Turn location off and she asks you instead.
If you show her something through the camera or send her a picture, it is read once by Google's model and nothing is written to disk. The image stays in memory so you can ask a follow-up, and is gone when the conversation ends — or, on WhatsApp, after a day. The same holds for a document she reads aloud: the words are extracted on your household server, held in memory, and dropped when you stop.
Media she makes is served from a web address containing a long random name. That name is the secret, because the phone's share sheet has to be able to fetch it without logging in — so we deliberately keep the recipient's name out of the address. Cards and songs are deleted after thirty days, voice notes after one day.
Carers paired to a household can see that the phone has been active, and receive alerts. They cannot read your conversations, your reminders or your memories, because we do not hold them. If she alerts them, they receive the alert's wording; we keep only that it happened.
If the household has been quiet for twenty hours, the family is told. This is deliberately conservative: an app that cries wolf gets its notifications turned off, after which it can warn nobody about anything.
With the Purse turned on, Sakhai can pay one exact amount to one shop after you have heard the real total and said yes to it. Your card is held by Stripe, entered on Stripe's own form; we keep the brand, the last four digits, the two spending limits you set and your delivery address. Every purchase needs two spoken confirmations, and the payment token is good for that one total, at that one shop, for fifteen minutes.
The person whose money it is decides. Nobody else's approval is required, and telling your family about a purchase is a switch you control, off unless you turn it on.
Sakhai's calling engine is also offered to other companies' assistants as an API (sakhai.care/calls). When another assistant asks her to ring a business on its user's behalf, that user is not a Sakhai household: we hold only what the request carried — the business, its number, the errand in one sentence, and the name and number the booking is in — and the written outcome, for that assistant to read back for up to fifty calls. No audio and no transcript reach the assistant or anyone else; the transcript is judged when the call ends and is then gone, as on every call she makes. She refuses, before dialling, any line that would have to look the person up in its own records — a pharmacy, a doctor's office, an insurer, a bank — and never asks for a date of birth or an account number. An assistant's key is tied to a mobile number; we keep that number, a hash of the key and a six-digit sign-up code (also hashed, ten minutes) and nothing else about the developer. Each request must say the assistant's user asked for the call and saw what would be said; that consent is the assistant's to obtain, and its terms govern its user.
| What | Kept for |
|---|---|
| What you said, and her replies | Not kept at all |
| What she did lately | 1 day |
| System log (shapes, not words) | 7 days |
| Voice notes she sent you | 1 day |
| Cards, plan cards, songs | 30 days |
| What a letter asks of you | 30 days |
| Shopping watch list | 30 days, or until you say stop |
| Household record, carers, capabilities, consents | Until the household is closed |
| Voiceprint | Until you say forget |
| Purchase records | As long as tax and accounting law requires |
| Calls made for another assistant (the errand and the written outcome) | The last fifty per key; never the audio or transcript |
Depending on where you live you may also have the right to ask what we hold about you, to correct it, to receive a copy, to object to a use, or to complain to a regulator. Ask at the address above and we will answer within the time the law allows. Because we hold so little, most such requests are answered quickly and with a very short list.
If you are in California, we do not sell or share personal information as those terms are defined under the CCPA, and we will not discriminate against you for exercising any right.
An account must be held by someone 18 or older. A younger person may use Sakhai on a household set up and supervised by a parent or guardian, who is responsible for the account and for the capabilities turned on. Sakhai is not directed at children under 13 and we do not knowingly create a household for one. When the person using her is a student, money-handling abilities are refused in code whatever the switches say, and schoolwork is guided rather than done.
Each household is a separate machine with its own certificate. Secrets are held outside the application's source and never written into logs. Media addresses are unguessable. Notification and pairing routes are signed. No system is perfect, and we will tell you promptly if something happens that affects you.
Household servers run in the United States. The companies listed in section 7 may process information in other countries under their own terms. If you use Sakhai from outside the United States, you are asking us to process your information there.
This page is maintained against the software itself: when what the code does changes, this page changes with it, and the date at the top moves. If a change materially affects what is held or who sees it, we will tell you in the app before it takes effect.
Cognio Lab LLC — moses@sakhai.care