Your words stay yours.

Your journal

Everything you write, and everything you and Bondhu say, is encrypted on your device before it's saved or synced. We can see how many messages you send, how long your voice recordings are, when, and what they cost. Not what they say.

We do keep your name, email address and username, so you can sign in and so we can write to you about your account. That is account data, not journal content.

When you talk with Bondhu

That conversation is decrypted on your device and sent through our server to the AI model. By default so is your journal, so Bondhu can know you. You can turn that off at any time with "Bondhu can read my journal", and then only the talk is sent. Our server keeps what it receives in memory for the length of the request. It never stores or logs it.

The model runs on zero-data-retention providers through OpenRouter (today, Google Cloud and Amazon Web Services): the text isn't stored after the reply and isn't used to train models.

You can give your companion a name and a personality. That name, those choices, and the goals and notes it remembers about you are encrypted on your device like your journal, and go with every talk, so the model knows who it is and what you asked it to keep. You can see, edit and forget every goal and note in Settings, under Companion.

When it may read your journal, the model can also ask your device to look up older entries. Your device runs the search itself and sends back only what it found. Every lookup and every change to what it remembers is written to an access log, encrypted, that you can read in Settings. What the model searches for and what your device finds pass through our server to the model, like the rest of a talk, and are never stored or logged.

Hiding a talk hides it on your devices. It isn't deleted yet.

When you talk with a coach

Coaches are AI too, and a talk with one travels the same way as a talk with Bondhu. A coach reads only the journals you switch on for it, one by one, and nothing until you do. Entries outside any journal stay with Bondhu.

Each coach keeps its own goals and notes, encrypted like your journal and sent with every talk to that coach. Bondhu's goals and notes never go to a coach. Which coaches you added and what each may read are encrypted on your device too.

Our server sees which coach you talk to and when, never what is said. Removing a coach forgets its goals and notes and its journal access; your past talks with it stay.

Recall and search

So Recall and Bondhu's lookups can find entries by meaning as well as by words, your device prepares search vectors in the background. Each changed piece of an entry your companion may read is sent once, through our server and OpenRouter, to an embedding model that turns it into a vector. The model runs at zero-data-retention providers only (today, Nebius and DeepInfra). The vectors come back and are encrypted on your device like your entries, and synced as ciphertext. Our server keeps none of them, and none of the text.

Turn off "Bondhu can read my journal" and nothing more is sent, and the vectors are deleted. Turn it back on and your entries are sent again to make new ones.

When Bondhu or a coach searches your journal during a talk, the search words are sent the same way to the embedding provider, and so is each question you ask Recall. Neither is stored. To answer a Recall question, your question and the few passages your device found (at most eight) are sent through our server to the AI model, and nothing is kept. Your device checks each quote in the answer against the entry it came from. Recall's access log lists which entries were sent, never your question.

What our server learns is how many pieces were sent and how many questions you asked, and when. Never what they say.

When you speak

Your voice is recorded only while you hold the microphone open, for at most two minutes. While you talk, the audio streams through our server to ElevenLabs, a speech-to-text service, and the words come back as you speak. We never store or log the audio or the text. ElevenLabs processes the audio under its own terms and privacy policy, and may keep it, and use it, as those allow. Its zero-retention terms aren't in place for voice yet. You read the text and edit it before anything is sent to Bondhu.

To tidy punctuation and capitals, the text you dictated is sent once more, through our server, to the AI model, on the same zero-data-retention terms as a talk. Nothing is kept. Your device checks that your words, numbers and negatives are kept, allowing only small spelling fixes, before it uses the tidied text, and "Show original" brings back what you said.

What our team can see

The people who run Bondhu can see your account: your name, email address and username, when you joined and last signed in, how many devices you use, how much storage your encrypted journal takes, and how much AI you've used. They can't see your journal. They can't read your entries, talks or recovery key, and they can't open your journal for you.

If you send a problem report, support can read it. It isn't end-to-end encrypted, so don't paste journal entries into it. A report can carry diagnostics: the app version, your browser and system names, your screen size, how many changes are waiting to sync, and the codes and times of recent errors. You see them before you send, and you can switch them off. Reports are deleted with your account, and 180 days after they're closed.

When something breaks

Bondhu sends crash reports and usage recordings to Sentry, an error-tracking service, in its EU region (Germany), through our server. A crash report holds the error, the page it happened on (the path, never the rest of the address), your browser and system, and your account id, never your name, email address or username. A usage recording shows how you moved through the app (which screens, taps and scrolls, and page addresses, which hold only ids, except that a coach's page address names that coach, so a recording can show which coaches you opened) and how long things took to load. Every word on screen is replaced with stars on your device before anything is sent, and the parts that show your journal and moods, your talks, your keys and your codes are left out entirely, as empty boxes. To stop the recordings and timings, turn off "Help improve Bondhu" in Settings on each device. Crash reports are still sent. To fix sign-in problems, the steps of signing in and opening your journal are recorded as short codes with your account id, such as "this browser remembered" or "recovery key used", never your keys, passkeys or anything you wrote.

Deleting your account

You can delete your account in Settings. Everything we hold for it is deleted at once: your encrypted journal, your passkeys and recovery key, your name, email address and username. Devices that are signed in erase their copy the next time they connect. We keep only totals of what AI use cost each day, with nothing that points to you. Our database provider's backups roll over within 30 days, and then nothing is left.

We can't undo it, and we can't recover a journal for anyone: we never had the key.

What Bondhu is

Bondhu is an AI companion, not a person, and not a substitute for professional care. It isn't a therapist or an emergency service. If you're in danger, contact local emergency services.