Placeholder: requires legal review
Privacy Policy
Version 2026-11-15
Conversations with a companion can be personal. This policy explains what Saathi collects, how we protect it, who can see it, and how you can take it with you or delete it.
The short version
- Your messages and memories are encrypted at rest with a key that is unique to your account.
- We never use your conversations to train AI models, ours or anyone else's.
- We do not sell your data and we do not run ads or ad trackers.
- Staff cannot browse your chats. Content is only opened for a specific safety report or legal requirement, and every access is logged with a reason.
- You can export everything or delete your account at any time from settings.
What we collect
Account
- Username, email address (optional if you sign in with Google), and a salted password hash. We never store your password itself.
- Your birth year and month, kept only for accounts that pass the 18+ check. If someone under 18 tries to sign up we keep no date of birth, only a one-way hashed device marker so the same device cannot immediately retry.
- Records of the documents you accepted (which document, which version, when), with a hashed IP address and your browser type.
- Preferences such as display name, pronouns, time zone, language, theme and content settings.
Age verification
If you choose adult mode, a verification provider checks your age by ID document or facial age estimation. We receive and store the result (pass or fail), the method, the date and a reference number. We do not receive or store images of your ID or face.
Your conversations and companions
- Companion profiles you create, the messages you exchange, conversation summaries, memories your companion keeps, journal entries and shared notes.
- Ratings you give replies, and reports you file.
Usage and safety
- Daily usage counts (number of messages, time active, amount of AI processing) used for limits, capacity planning and break reminders.
- Safety events: when a safety check acts on a message we record the type, category, severity and action taken. For the most serious categories we also keep a short encrypted excerpt as evidence. See retention below.
- Basic technical logs (time, request path, error codes, country derived from IP) used to keep the service secure and working.
How we protect your conversations
Message content, summaries, memories, journal entries and notes are encrypted before they are written to our database, using AES-GCM with a data key unique to your account. Your data key is itself encrypted by a master key held separately from the database. A copy of the database alone does not reveal your conversations.
To generate replies and run safety checks, your recent messages are decrypted in memory and sent to the AI model for that request. Where a model provider offers zero data retention settings, we turn them on so the provider does not store your prompts or replies after responding. Your conversations are never used to train or fine-tune models.
Access by our team is limited to trained moderators handling a specific report or automatic safety case. They must give a reason before content is shown, and each access is written to an append-only audit log.
Why we use your data
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Running your account and companions, including memory | Account, conversations, preferences | Contract |
| Age checks and adult mode | Birth month, verification result | Legal obligation; consent for adult content |
| Safety: blocking prohibited content, crisis support, preventing abuse | Messages (automated checks), safety events | Legitimate interests; legal obligation; vital interests in a crisis |
| Security, fraud prevention, service reliability | Technical logs, hashed IP | Legitimate interests |
| Account emails (verification, password reset, important changes) | Email address | Contract |
Conversations about sex life or health can be special category data. We process it only to provide the service you asked for, with your explicit consent given when you opt in, and you can withdraw by deleting the content or your account.
Exporting and deleting your data
- Export: in settings you can download a copy of your profile, consents, companions, conversations (decrypted) and memories in a machine-readable format.
- Delete: when you delete your account it is deactivated immediately and you are signed out everywhere. All of your data is permanently deleted within 30 days, including your encryption key.
- You can also delete individual memories, messages and companions at any time.
How long we keep data
| Data | Retention |
|---|---|
| Account, conversations, memories | While your account is active; deleted within 30 days of account deletion |
| Safety evidence excerpts | 90 days, then automatically purged, unless the law requires us to preserve them longer (for example, material we must report to the authorities) |
| Safety event records (no content) | Kept as aggregate counts for regulatory reporting |
| Consent records and admin audit log | As long as needed to show compliance, and only as the law requires |
| Under-age device markers | A hashed value only, no personal details |
Who we share data with
We share data only with service providers that process it on our instructions under a data processing agreement:
| Subprocessor | Purpose |
|---|---|
| Cloudflare, Inc. | Hosting, database storage and AI inference |
| Resend | Sending account emails |
| Google LLC | Optional sign-in with Google (only if you choose it) |
| [Age verification provider to be confirmed] | Age checks for adult mode |
We disclose data to authorities only when the law requires it, such as reporting apparent child sexual abuse material to NCMEC in the US or the relevant national authority, or when someone's life is in immediate danger. Data may be processed outside your country. Where it leaves the UK or EEA we rely on approved safeguards such as Standard Contractual Clauses.
Your rights
GDPR and UK GDPR. You have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent at any time. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office).
California (CCPA / CPRA). You have the right to know what personal information we collect and why, to delete it, to correct it, and to limit use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising. We will not treat you differently for using these rights.
Most rights can be used directly in settings. For anything else, contact us and we will respond within the time the law requires (usually one month).
Children
Saathi is for adults only. We do not knowingly collect data from anyone under 18. If you believe a minor is using the service, report it from the app or contact safety@[domain to be confirmed]. See Safety.
Contact
[Legal entity name and registered address to be confirmed]. Privacy questions and requests: privacy@[domain to be confirmed]. [Data protection officer and EU / UK representative details to be confirmed.]