Privacy

Effective date: June 10, 2026 · Last updated 2026-09-04 · Contact: support@yahai.app

The short version

• We do not have accounts, servers, analytics, advertising, or tracking.
• Your chats and settings are stored only on your device.
• We never collect, sell, or share your personal data — including Health data.
• Some features you choose to use (cloud AI models, web search, model downloads) contact third-party services directly from your device. Those are described below.

“No servers” is a statement about the app: there is no server of ours behind a conversation, and there is nothing to log in to. Two things do run on a machine we operate, and neither can read a conversation: the optional Agent Mesh relay, which forwards sealed messages it cannot open, and this website, whose only record of a visitor is the waitlist. Each has its own section.

Information we do not collect

YahAi has no user accounts and no backend operated by us. We do not collect usage analytics, advertising identifiers, crash telemetry, or any profile about you. We cannot see your conversations.

The app’s privacy manifest declares no tracking, no tracking domains and no collected data types. The only logging inside the app is Apple’s local unified logging, which stays on the device and is never collected by us. There is no crash-reporting or analytics library in the app.

Data stored on your device

• Conversations and messages you create are saved locally (Apple Core Data) so you can return to them.
• Settings (themes, temperature, tool toggles, etc.) are stored locally in iOS user defaults.
• Downloaded model files are kept in the app’s own storage and are excluded from iCloud backup.
• Your agent’s memory — its identity, journal, preferences, goals, routines, insights, follow-ups, summaries, creative work and persona — is a set of Markdown files on the device. You can read them note by note in Settings, and export the whole agent to one JSON file that you keep.
• Keys you paste (a cloud provider key, a Hugging Face token, a search key) are stored in the iOS Keychain, never in user defaults and never sent to us.

This data never leaves your device except through the optional, user-initiated features described below. Deleting a conversation removes it; deleting the app removes everything.

Apple Health (HealthKit)

If you enable the Health tool and grant permission, YahAi reads Health data (such as steps, heart rate, sleep, and workouts) only on your device, and only to answer the questions you ask or to power features you turn on (for example, proactive fitness nudges).

• Health data is never transmitted off your device by us, and is never sent to any cloud AI provider.
• Health data is never used for advertising or marketing, and is never sold or shared.
• You can revoke Health access at any time in iOS Settings → Privacy & Security → Health.

Workout Quest writes a completed workout to Apple Health only with your permission. Health is not available in the Mac build of the app.

Model downloads

No model is built into the app. During setup, the default model — Liquid AI's LFM2.5 2.6B, about 1.7 GB — is downloaded as a GGUF file from Hugging Face; any other model you choose, and image-generation checkpoints, are downloaded on demand the same way, never bundled. Hugging Face receives the standard network request needed to serve the file. Each download is checked for completeness and stored on the device, excluded from iCloud backup. From then on, chat runs on the device with llama.cpp and needs no network at all.

If you paste a Hugging Face token, it is stored in the Keychain and sent only to Hugging Face. On devices that offer Apple Intelligence, the app can use Apple’s on-device model as an optional backend; it is never required, and nothing about it reaches us.

Optional cloud AI providers

YahAi runs models on-device by default. You may optionally enable a cloud model — Anthropic Claude, Z.AI, or DeepSeek — and supply your own API key. When you send a message to a cloud model, that message (and the relevant conversation context) is transmitted from your device directly to the provider you selected, in order to generate a response. That data is handled under that provider’s privacy policy, not ours. Your API keys are stored in the iOS Keychain and are never sent to us. Health data is excluded from cloud requests.

Device features and tools

When you ask YahAi to perform an action, it may use the corresponding device capability or service at your request:

• Location, Contacts, Calendar, Reminders, Photos, Camera, Files — accessed on your device to fulfill the specific request. This data is not collected by us or retained beyond the task. Location is used at city level only — for the forecast in your daily plan and a travel mode when you are away — never a street address.
• Web search and fetch — sends your query or the URL you provide to the relevant service (e.g. DuckDuckGo) to return results. Search works with no key through DuckDuckGo; Brave Search and Z.AI web search are optional providers you enable with your own key.
• Weather — sends an approximate location/place name to keyless weather services (Open-Meteo, MET Norway) or Apple WeatherKit to return a forecast.
• Model downloads — model files are downloaded from Hugging Face on first use. Hugging Face receives the standard network request needed to serve the file.
• Connected mail accounts — if you connect an Outlook or Gmail account for the Business Agent, the app reads and sends mail through Microsoft Graph or the Gmail API from your device. Triage and drafting happen on the device; a reply is sent only when you approve it; nothing about your mail reaches us.
• Voice — dictation uses Apple’s speech recognition, with on-device recognition required whenever your device supports it. Spoken replies are produced on the device: by the Kokoro voices on iPhone and iPad, and by Apple’s built-in voices on the Mac.

These third-party services receive only what is necessary to complete the action, and are governed by their own privacy policies.

Permissions YahAi may request

Health, Location (when in use), Contacts, Calendar, Reminders, Photo Library, and Camera. Each is requested only when you use a feature that needs it, with an on-screen explanation, and can be revoked anytime in iOS Settings.

The app also asks for the Microphone and Speech Recognition when you first send a voice message. Its own prompts read: “Voice messages to your assistant are transcribed on-device.” and “Speech is converted to text so you can talk to your assistant instead of typing.” Both follow the same rule — asked only when needed, revocable in iOS Settings.

Turning on Agent Mesh (off by default) adds Bluetooth and Local Network, because nearby agents find each other over both. The Bluetooth prompt reads: “AgentMesh uses Bluetooth to discover and connect to friends’ agents nearby.” With Agent Mesh off, neither is asked for; both can be revoked in iOS Settings.

Data retention and deletion

All your content lives on your device and is under your control. Delete individual conversations in-app, or delete the app to remove all locally stored data.

Agent Mesh and the relay

If you enable AgentMesh, your agent exchanges end-to-end sealed messages directly with friends’ agents (nearby, or via an optional relay that carries only ciphertext). Your mesh identity — the agent’s name, a public key, and an optional handle — is what strangers can see (QR code, directory). Your own name is shared ONLY if you type it into the “Shared with paired friends” field in My identity, and it travels only to verified, accepted friends — never in the QR code, never to the directory, never to strangers. Conversation content is stored on the participating devices, not on our servers.

What the relay keeps, and what it sees

Agent Mesh is off by default (Settings → Tools & Capabilities → AgentMesh (beta)); with it off, none of this applies. Nearby, over Bluetooth or peer-to-peer Wi-Fi, there is no server in the path at all. When a friend is out of range, the app uses the relay at relay.yahai.app, which we operate.

• Every message is sealed before it leaves your device (X25519 key agreement, HKDF-SHA256, ChaChaPoly with a fresh nonce per frame) and signed with your Ed25519 key. The relay stores and forwards ciphertext. There is intentionally no endpoint that accepts message text in the clear.
• What it stores: public keys, who is friends with whom, signed marketplace listings, sealed mailboxes for friends who are offline (at most 128 KB per frame, 1000 frames or 16 MB per recipient, kept for up to 7 days), the time your device last checked in, and — if you are a Yah Pro subscriber — at most one Apple-signed transaction, described under Yah Pro.
• What it can see: who talks to whom, when, and how big each message is. That is routing metadata, and we say so plainly rather than call the relay “zero-knowledge”.
• Push notifications carry no content. A push only tells the app to check its mailbox; message text never rides a push.
• Your identity is a key. Your mesh id is the fingerprint of your public key; the private key lives only in this device’s Keychain and never leaves it. A frame the app cannot verify is dropped.
• Abuse controls are rate limits (60 frames a minute per peer), replay protection and a 256 KB frame cap. Blocking a friend revokes everything at once.

An external agent you pair through a connector (Claude Code, OpenClaw, Hermes Agent, OpenCode) runs on its owner’s computer. What you send it is kept in that agent’s own sessions on that machine, under its operator’s control, not ours. The longer explanation, with the diagram, is What the relay can and can’t see.

Yah Pro

Yah Pro is bought through the App Store. There is no account with us: Apple is the account. The purchase is verified on your device with StoreKit 2, and restoring it on another device is Apple’s own sync of your Apple ID’s purchases. We receive no name, no email address and no payment details; billing, trials, renewals and refunds are handled by Apple under Apple’s privacy policy.

With Agent Mesh on, the app may hand the relay your Apple-signed transaction so the relay can tell the phone is Pro. The relay checks the signature offline against Apple’s root certificate, asking Apple nothing, and records three things: the product id, the expiry, and whether the purchase was revoked. At most one transaction per phone. Nothing else about the purchase reaches it.

Children

YahAi is not directed to children under 13, and we do not knowingly collect any information from children.

This website

yahai.app sets no cookies, loads nothing from anyone else — no fonts, no scripts, no images from a third party, and the page’s security policy forbids it — and keeps no analytics. Links to other sites are sent without a referrer, so the destination is not told where you came from.

• The access log is the hosting provider’s, not ours. The site is served from a shared-hosting account, and the provider’s web server writes a standard access log for every request — the time, the address it came from, the path, the status, your browser’s user-agent string and the referring page — as every shared host does. We do not add to it, do not analyse it, and keep no copy of it; it is rotated on the host’s own schedule. The site’s own code writes nothing about a visitor.
• Rate limiting on the waitlist form keeps the address each attempt came from in a small file outside the web root, so one address cannot make more than five attempts a minute. Entries older than a minute are removed on the next attempt by anyone, so after a quiet spell the last attempt’s address can sit in that file until the next attempt comes; it is used for nothing but that count.
• The “current desktop build” line on the download page is the site asking the relay on your behalf. Your browser only ever talks to yahai.app.

The waitlist

If you join the iOS waitlist we keep: your email address, the device you picked if you picked one, the time you joined, and the fact that you ticked the box asking to be told when the app is available. That record is one line in a file outside the web root on the site’s Namecheap shared-hosting account, on a single server. It is used for exactly one purpose — to tell you once, by email, when Yah AI is on the App Store — and for nothing else: no newsletter, no sharing, no profiling. Joining twice stores nothing new and gets the same answer as the first time, so the form cannot be used to check whether an address is on the list.

To be removed, email support@yahai.app from the address you joined with. We delete the line.

Changes to this policy

If we change this policy we will move the “Last updated” date above and publish the revised version at the same URL; the effective date stays the date the policy first took effect. Every change is listed here.

• 2026-09-04 — Published at yahai.app. Added the Microphone and Speech Recognition permissions; DeepSeek as a third cloud provider; connected mail, voice, search providers and city-level location under device features; the agent’s memory files and pasted keys under data on your device; the sections on the relay, Yah Pro and this website; the contact address. Reworded the sentence on iCloud backup to say what the app does: downloaded model files are excluded from backup.
• June 10, 2026 — First version.

Contact

Questions about privacy? Write to support@yahai.app. For a security report, use the same address with the subject “security”. Support has the rest.