Trust
An AI this close to your life is only worth having if the terms are yours. Here they are, in plain facts.
Where Sathi lives
What leaves, and to whom
Sathi keeps your archive on a server we operate. To help with a task, relevant messages, document or image content, audio and reply text may reach configured model and speech providers. Storage custody is different from processing. The provider entry below describes this boundary; running suitable models ourselves is planned.*
It is yours to take
You can see what Sathi believes about you and why, and correct it. You can take your supported records and files with you as one signed archive, and bring it back to a new Sathi. Deleting removes them, and what Sathi understood from them. Encrypted backups expire on their own schedule, and copies already sent to other people or outside services stay with them. Leaving gives you a signed receipt of what was done; it does not prove that every copy is gone.*
What we will not do
No advertising. No engagement optimization. Sathi never sells your personal data or pools it with anyone else’s to train anything; what a provider may do with a request it serves follows that provider’s terms, described below. Guests are never remembered; guest conversations are kept for testing and feedback for as long as an operator setting allows (30 days by default).
Limits today
Sathi is in beta. The operator still runs the database, and during the beta operator support access is on by default — shown in your account, one tap to switch off — so problems can be found and fixed; it becomes opt-in once Sathi runs reliably without us looking. Every admin request lands in a tamper-evident audit log, but that is application-level enforcement, not yet cryptographic. There is no third-party security audit yet. When any of this changes, this page changes.
About the asterisk
Our product pages describe the experience we are building toward. An asterisk marks something still being implemented, planned, or awaiting verification. During beta, some functions use external providers. We intend to self-host suitable open models as scale makes that practical. The entries below describe today’s behavior and remaining limitations.
A day at home
- Intended experience
- One Sathi helps each person in a household in their own way: a parent's school mail and calendar, a child's question, a grandparent's paper letter, and a parent weighing two job offers.
- Current behavior
- The homepage shows a fictional household. Each moment uses something that works today: reading connected mail and offering a calendar event that is added only when you confirm; answering a question by voice or in writing; reading a photo of a paper letter and explaining it in your language; reading documents you share, quoting your own earlier words with when you said them, and saying what a document leaves out instead of guessing; and offering a draft or an email that goes nowhere until you say yes.
- Remaining work / limits
- Mail and calendar need a connected account, and so does emailing a question for you. Voice and the home speaker are still being tested. Which model reads a photo or document is explained under “Storage, models and serving providers”, and an explanation can be wrong, so check what matters on the original. Anything Sathi reads or changes stays within the permissions each person gave. Which ages Sathi is for has not been decided, and there are no guardian controls yet.
Transcribe and external processing
- Intended experience
- Natural mixed-language transcription, with suitable open models self-hosted as scale makes that practical.
- Current behavior
- The current beta account names Google Gemini for transcription. Audio is sent to Google for processing; Sathi-owned weights are not serving this demo. The request is handled by Sathi’s API.
- Remaining work / limits
- The transcription backend is configurable. Self-hosted models must pass licensing and quality checks. Do not upload sensitive audio on an assumption of zero provider retention: downstream handling follows the applicable provider terms.
Storage, models and serving providers
- Intended experience
- Your archive and understanding stay with your Sathi; external capabilities receive the context they need.
- Current behavior
- Sathi stores the archive on a server we operate. Reasoning, image and speech routes are configurable and may use direct provider APIs or OpenRouter. Relevant context can reach the serving provider; a model’s developer, an intermediary and the actual host are different roles. Google processing and Resend account mail are supported. This source review does not certify each live route.
- Remaining work / limits
- This is not a promise that no data leaves Sathi or that all connectors will become self-hosted. Provider routing and retention must be read with the processing terms; no independent audit is claimed.
Deletion and receipts
- Intended experience
- Delete from your Sathi and carry a clear record of what was removed.
- Current behavior
- Live deletion removes the affected records and derived understanding. Encrypted restic backups are kept separately in Google Drive and on an Oracle Cloud server, with 14 daily, 8 weekly and 12 monthly snapshots. These counts do not guarantee deletion within 12 months: gaps in backups or failed cleanup can leave older copies.
- Remaining work / limits
- Only leaving issues a signed receipt today; erasing does not. A receipt authenticates the recorded operation; it does not prove every backup or downstream copy is gone. Backup expiration is separate from live deletion. External processors have their own retention obligations.
Working with other systems
- Intended experience
- Personal and community systems work together, each keeping what it can do, who it is and who rightly controls it.
- Current behavior
- Sathi is where this is tried first. No reusable framework has been released.
- Remaining work / limits
- Whether separate systems can cooperate without losing what each can do is an open question; so far it has only been tried on one Sathi server. The thinking is on altruistic.ai.
Source review: 20 September 2026. Availability and provider routing depend on live configuration and account permissions.
Every privacy question, answered →