Your data stays yours

The principle in one sentence

Kahya only looks at your screen when you ask for help, analyses it to show you where to click, then forgets it immediately. Nothing is kept or sold, and Kahya is designed to fade away as you become more independent.

What Kahya can see

• One screenshot, only when you ask for help. It is sent for analysis, then immediately discarded and never saved.
• On a web page, the active origin, such as https://www.caf.fr, may accompany that analysis to spot an impersonating site. The path, parameters, fragment and browsing history are never sent.
• If you speak to Kahya, a short audio sample is sent for transcription and then discarded. It is not stored or logged.
• The goal you describe, such as “write to Claire”, is used to guide you and is not kept after the session.

What Kahya never does

• Save or sell your screenshots.
• Log what you type or the content of your pages, including passwords, messages or numbers.
• Click or enter information on your behalf.
• Silently continue a dangerous action: Kahya stops it or asks for a visible confirmation.

Who processes data for us

Kahya relies on a small number of technical providers, each for one specific purpose:

• OpenAI processes the request, the screenshot and, on the web, only the active origin when visual guidance or verification is needed.
• Deepgram may transcribe speech and read instructions aloud, only when that option is enabled.
• Cloudflare provides the technical relay between Kahya and the AI and only logs sanitised metadata.
• Supabase manages support accounts: email address, first name, session and the password protected by its authentication system.
• Resend sends human-support emails when you choose to alert someone you trust.
• Vercel hosts this website.

Technical logs

To monitor the service, we only keep metadata: the length of your goal, never its wording, the model used, the duration and whether the request succeeded. We never keep the screenshot, what you typed or your voice.

Support accounts

A loved one can create an account to follow changes in the level of help and receive safety alerts. An alert contains a category, severity and a few closed signal codes, never the website address, page contents, typed information or a screenshot.

Legal basis and retention

• Legal basis: your consent, requested explicitly before any analysis.
• Screenshots and voice: not retained. Processing lasts only for the request.
• Technical metadata: kept for a limited period to maintain the service.
• Support account: kept while the account exists and deleted on request.

Cookies

This site uses no advertising cookies or trackers. Strictly necessary cookies are only used to keep you signed in to your space if you create an account.

Your rights

Under the GDPR, you can access, correct, erase or object to the use of your personal data. Write to aybek.yildiz@icloud.com to exercise these rights. You may also contact the French data protection authority at www.cnil.fr.

Any questions?

We answer in clear, straightforward language. Write to us through the contact page.