Privacy — an audit, not a promise
written by reading the code, not by describing an intentionMost privacy pages are a wish. This one was written a different way: by going through the shipped app and listing every single place it can reach the network, then writing down what was actually found — including the things that do leave your phone. A page that says “nothing leaves” while something quietly does would be worse than saying nothing at all.
The short of it
- No account. Nothing to sign up for. No name, no email, no phone number, no password. (That is the app. The one place this project ever takes an email address is the early-tester form on the website — never from inside the app. It is named in full further down this page.)
- No analytics, no crash reporting, no advertising. There is no measurement kit of any kind inside the app — nothing counts you, follows you, or reports back.
- No profile. Nothing anywhere builds a picture of who you are or what you believe.
- Nothing you say is used to train anything. Not her, not any model, not ever. It never reaches us, so it could not be used even if we wanted it — and we do not.
- Your conversations live on your phone only, and you can delete any one of them, or all of them at once, at any moment.
- She thinks on your phone. Her mind runs on the device; your question is answered there. There is no server behind this app.
A · What leaves the phone — the complete list
Two things, and there is no third.
| What | Where it goes, and what that reveals | |
|---|---|---|
| Her mind, once — a single model file (about 806 MB) | Downloaded from Hugging Face, a public archive that hosts the file. Like any download, the server that serves it can see the request: your network address, your device’s connection signature, and the time. It carries no account, no name, and nothing you have said to her. It happens once; afterwards the app needs no signal at all. We do not see this request either — it does not pass through us. | |
| A copy of your own — only if you ask for one | You tap “keep a copy”, you choose the folder, and the app writes one file there (your conversations, your journal, any character you made, and your stated purpose). It goes exactly where you send it and nowhere else. If you pick a folder that your phone syncs to a cloud, your phone will sync it — that is your choice and your cloud, not ours. We never see it and hold no key to it. |
That copy is not encrypted. It is plain, readable text in a normal file. Anyone who can open that folder can read it. Please keep it somewhere you trust. (Making it lockable with a passphrase is the next thing being built — until it ships, this line stands as written.)
B · What never leaves
| What | Where it lives | |
|---|---|---|
| Everything you say to her | Answered on this phone, saved on this phone. Never sent anywhere. | |
| Your journal — wishes, worries, what you told no one | Written on the phone, in the app’s own storage. | |
| Her own inner life — her wishes, dreams and imaginings | Formed on the phone, kept on the phone. | |
| Any character you shape | Yours alone, on the phone. Never uploaded, never shared, never seen by us. | |
| The purpose you named when you arrived | On the phone. | |
| Her thinking itself | The model runs inside the app on your device. No question is sent out to be answered. | |
| Her memory of her lore | Bundled inside the app when it was built. Nothing is fetched to answer you. |
C · What is never collected at all
| What | ||
|---|---|---|
| Your name, email, phone number — any account at all | The app has no sign-up and nothing to sign up to. One exception, and it is not in the app: if you ask on the website to be an early tester, your email address is taken there — once, by the website, and erased the moment you are added in Google Play. | |
| Your location | The app asks for no location permission. To show the right crisis helpline it reads only the language and region your phone is already set to — the setting itself, never a lookup of where you are. | |
| Your camera, microphone or contacts | The app requests none of these permissions. It cannot listen, look, or read your contacts. | |
| The permissions it does hold — named here so this list is complete | Four: internet (the one download), vibration, file access on older Android versions (Android 12 and below — so you can write a copy of your own, or hand it a model file), and “draw over other apps”. Nothing reads your files unprompted: a folder or a file is reachable only after you pick it yourself in your phone’s own picker. | |
| An advertising ID, or any identifier for you | None is read, made, or stored. | |
| How often you come, how long you stay, what you asked | Not measured. There is no counter and nowhere for a count to go. | |
| Crash reports and diagnostics | No crash-reporting kit is included. If the app breaks, we learn it from you telling us. |
About “draw over other apps”, said before you find it yourself. That permission is in the app’s manifest, and it is the one on this list a careful person should ask about — it is what lets an app paint on top of others. Nothing we wrote uses it. It came in with the development toolkit the app is built with, not from any feature, and there is no line of our code that calls it. It should not be there and it is on the list to be taken out. We are naming it rather than leaving you to discover an undisclosed permission in a page that calls itself an audit.
If someone is in danger
When a message shows that someone may be in danger, the app stops her from answering it at all and shows real helplines instead — and that message is never written into your saved conversations. There is no reply to write down either: she is silenced for that turn, not asked to be wise. The turn is met with help and then let go.
How it chooses the numbers. It reads the language and region your phone is set to — that setting alone — and carries verified lines for 23 countries. If yours is not among them, or your phone is set to another country’s locale, you are given the universal line instead: your local emergency number, and findahelpline.com, which lists a free confidential line for every country. It does not always know the right one, so it never pretends to.
CHILDLINE 1098 is not yet in the app’s card. If the person in danger is a child, in Bhārat that is the number — free, day or night. It is being added to the app; until it is, it is written here and on our Emergency & Help page rather than left unsaid.
One honest exception, stated because it is true today. A conversation is given a short name so you can find it again in your list, and that name is currently made from your own first six words. A conversation is only written to the phone once a turn is actually answered — so if you say something painful and close the app, nothing is saved at all. But if you say it and then keep talking, the conversation lands in your list still wearing those first words as its name. Nothing of it leaves the device — but a person looking over your shoulder could read it, and that is not what we promised. It is being changed so the name comes from her side of the conversation instead. Until that ships, this page says so rather than pretending otherwise.
Where your things are kept, and who else could reach them
Your conversations and journal are stored in the app’s own private storage, which other apps on your phone cannot read.
But Android’s own backup can reach them. The app is currently built with Android’s automatic backup left on, which means the phone’s operating system may copy the app’s data into your Google account as part of a device backup — the same way it backs up your other apps. That copy is yours and goes to your account, not to us; we never see it. If you would rather it did not happen, you can switch off backup for this app in your phone’s settings. We are changing the app so this is off by default.
Erasing everything
You may delete any single conversation, or all of them at once, from inside the app. To erase absolutely everything — conversations, journal, characters, purpose and her downloaded mind — uninstall the app. Nothing survives it on our side, because nothing of it was ever on our side. Any copy you exported yourself is in your folder and only you can delete it.
There is nothing for us to erase on request about the app — nothing of it was ever on our side. There is now one thing this project can hold about you, and it is not in the app: the email address you give if you ask on the website to be an early tester. You may erase that yourself, instantly, with the one-time link you were shown the moment you asked — no email needed, no name asked, no reply waited for. It is erased anyway as soon as Ajin adds you in Google Play, erased at once if he declines, and it erases itself after 30 days if nothing happens. No hash of it is kept. If you have lost your link, or believe anything here is wrong, write to [email protected] and we will act, and answer honestly.
Updates, and other apps
The app does not update itself silently over the air — that mechanism is switched off. Updates arrive only the ordinary way, through the store you installed it from, which is governed by that store’s own privacy terms and not by ours.
This page covers the Bhoomi app only. The website you are reading now is a different thing with its own privacy policy and terms — talking to her in a browser does involve a server, and that page says so.
