Privacy Policy

1. Information we collect

Information you give Khawi

• Your WhatsApp details: your phone number and the name on your WhatsApp profile. Your phone number is how Khawi knows it's you.
• Your conversation: the messages you send Khawi and its replies, including voice notes (which we turn into text), photos, documents, locations and other content you share.
• What you ask Khawi to keep: things you ask it to remember, your reminders, to-dos and schedules, and settings such as your time zone, working hours and which proactive messages you want.
• Files: files you send Khawi, and files it creates for you, are kept in a private workspace for you so Khawi can work with them.

Information from accounts you connect

You can connect accounts such as Google (Gmail, Google Calendar and Google Drive) and other apps. You do this on the provider's own sign-in page, where you choose what to allow. We then receive access tokens, which we store encrypted, and the email address or username of the account. Khawi reads and acts on information in that account, such as emails, calendar events, contacts and files, when it needs to in order to do what you ask or to run a feature you have on. Section 4 explains how we handle Google user data.

Khawi's browser

Some tasks, such as booking or ordering, need a website rather than an app connection. For these, Khawi uses its own web browser, kept separately for each person. When a website needs you to sign in, Khawi sends you a private link where you sign in yourself; Khawi never types your passwords. That browser keeps your sign-in sessions (cookies) and site data, as your own browser does, so Khawi can use the site for you later. While it works on a task, Khawi views the pages it visits, including screenshots of them. If you choose to save a password or payment card in that browser or with a website, it is stored there.

Information from our website

If you ask for early access at khawi.dev, we collect your name, WhatsApp number and email address, the consent you gave, which button you used, and when. To prevent abuse, we keep a scrambled (hashed) form of your IP address for one day; we don't store your IP address itself. Our website doesn't use advertising or analytics cookies, and doesn't track you across other websites.

Technical information

When you use the Service we record technical information needed to run it, such as timestamps, message delivery status, errors, and how much processing each request takes.

Information about other people

Your messages, email, calendar and files may include information about other people, such as the people you email or meet. We use it only to provide the Service to you. Please share other people's information with Khawi only when you're allowed to.

2. How we use information

• To provide the Service: to understand your requests, answer you, and carry out the tasks you ask for or approve.
• To run features you have on: such as your morning brief, reminders, meeting briefs, nudges about emails that may need a reply, alerts about new email or calendar changes, and watching a web page you asked about. You can turn these off at any time.
• To remember context: to keep the preferences and details you share, so Khawi can help you better over time.
• To keep the Service safe and working: to prevent abuse and fraud, find and fix problems, and protect you, other people and us.
• To talk to you about the Service: for example, to invite you, or to tell you about important changes.
• To meet legal obligations.

We don't sell your personal information or share it for advertising, and we don't use the content of your messages, files or connected accounts to train AI models.

3. AI processing and human review

Khawi is powered by artificial intelligence. To answer you, we send the parts of your conversation, files and connected-account data that a request needs to AI model providers that process them for us. Under our agreements with them, they may use this data only to provide their service to us, may not use it to train their models, and keep it only for a limited time, for example to detect abuse. AI can make mistakes, so check important details before you rely on them.

People at TorchStack don't read your conversations, files or connected-account data, except:

• with your permission, for example when you ask us for help with a specific problem;
• when it's needed for security, such as investigating abuse or a security incident;
• to comply with the law; or
• when the data has been aggregated and de-identified, for running the Service.

4. Google user data

This section explains how Khawi handles information it receives from Google APIs when you connect your Google account. It adds to the rest of this policy.

What Khawi can access

When you connect Google, Google shows you what Khawi asks for, and you decide whether to allow it:

• Your Google account email address, so you can see which account is connected.
• Gmail: to search and read your email, draft replies, send email, and organize messages (for example, labels and archiving). Khawi can't permanently delete your email.
• Google Calendar: to see your events, and to create, change or delete events when you ask.
• Google Drive: to search and read your files, and to create documents when you ask.

Google describes some of this access in broad terms on its consent screen. Khawi uses it only as described in this section.

How Khawi uses it

Khawi uses Google user data only to provide and improve features you use or turn on in Khawi:

• answering your questions about your email, calendar and files, and finding things for you;
• summarizing email and drafting replies, and sending, labeling or archiving email when you ask. By default, Khawi shows you an email and asks before it sends it;
• creating, changing or cancelling calendar events when you ask, and pointing out conflicts;
• your morning brief, meeting briefs, nudges about emails that may need a reply, and alerts about important new email or calendar changes, if you have them on;
• reading the files you ask about, and creating documents in your Drive.

How it is stored

Your Google access tokens are stored encrypted. To alert you to new email and calendar changes, Khawi checks your inbox and calendar for changes and keeps a short record of each new item, such as an email's sender, subject and preview, or an event's title and time. What Khawi reads to answer you becomes part of your conversation history, and details you ask it to remember are kept in its memory. We keep this information until you delete it (see Section 7).

How it is shared

We share Google user data only:

• with service providers that help us run the Service, such as hosting and AI model providers, who may use it only to provide that service to us;
• with the people or services you ask Khawi to contact, such as the recipients of an email you approve;
• when required by law, or to protect against fraud, abuse or security threats; or
• as part of a merger, acquisition or sale of assets, and only after asking for your explicit consent first.

We don't sell Google user data, use it for advertising, share it with data brokers, or use it to decide credit or lending. We don't use Google user data to develop, improve or train generalized AI or machine-learning models, and people at TorchStack don't read it except as described in Section 3.

Your controls

Tell Khawi "disconnect Google" at any time and it deletes your Google access tokens right away. You can also remove Khawi's access from your Google Account at myaccount.google.com/connections. To delete Google data Khawi has already stored, see Section 8.

5. Other connected apps

If you connect other apps, such as Microsoft 365 or Notion, we handle their data the same way: only to do what you ask and to run features you have on, under the same sharing and retention rules as in this policy, and in line with that provider's own terms. You can disconnect any app at any time by telling Khawi.

6. How we share information

• Service providers. Companies that host and secure the Service, provide AI models, process content such as voice notes, and deliver messages. They act on our instructions and must protect your information.
• WhatsApp. Khawi works through WhatsApp, which is operated by Meta. Messages between you and Khawi pass through WhatsApp's business messaging service, which delivers them for us. Your use of WhatsApp itself is covered by WhatsApp's own terms and privacy policy.
• The people and services you ask Khawi to deal with. When you ask Khawi to send an email, book a table or place an order, the recipient or website gets the information needed to do it, such as your name, contact details and booking details.
• Legal and safety reasons. To comply with the law or a valid legal request, and to protect the rights, safety and security of our users, the public and TorchStack.
• Business transfers. If TorchStack is involved in a merger, acquisition or sale of assets, your information may be transferred as part of it, and the new owner must honor this policy. For Google user data, we will ask for your consent first.
• With your consent, in any other case.

7. How long we keep information

• Your conversation history, memory, reminders and settings: while you use Khawi, until you delete them.
• Access tokens for a connected app: until you disconnect the app or delete your data.
• Your sign-in sessions and files in Khawi's browser and workspace: until you delete your data.
• Early-access requests from our website: until you ask us to delete them, or until we no longer need them to contact you about Khawi.
• Technical logs: for a limited time, then they are deleted.

When you delete your data, we remove it from our systems within 30 days. We keep a minimal record (your WhatsApp number, and that and when you asked us to delete your data) so we can honor your request and prevent abuse, and we keep information longer only when the law requires it.

8. Your choices and rights

• Delete in the chat. Ask Khawi to delete what it remembers about you, or to delete everything. It asks you to confirm, then deletes your conversation history, memory, reminders and to-dos, connected-app tokens, and your browser and workspace on Khawi.
• Stop proactive messages. Tell Khawi to stop or change your morning brief, reminders or alerts at any time.
• Disconnect apps. Tell Khawi to disconnect any app, and remove its access in that app's account settings too if you like.
• Ask us. Email us to access, correct, export or delete your information, or with any question about your privacy. We reply within 30 days.

Depending on where you live (for example, Saudi Arabia, the European Union, the United Kingdom or California), you may have more rights under local law, such as to object to or restrict some processing, to withdraw your consent, or to complain to a data protection authority. We honor these rights as the law requires. If you stop using Khawi or block it on WhatsApp, it stops messaging you, but your data stays until you ask us to delete it.

9. Security

We protect your information with encryption in transit, encryption of connected-account tokens at rest, strict limits on who can access our systems, and by keeping each person's browser and workspace separate from everyone else's. No system is completely secure, though. Because Khawi can act for you, it could make a mistake, for example on a website. That's why, by default, it asks before it sends, books, buys or pays, and why you should check what it reports back.

10. Where we process information

Our servers are in the United States, and our service providers may process information in the United States and other countries. If you use Khawi from elsewhere, including Saudi Arabia or Europe, your information is transferred to and processed in those countries. When we transfer information across borders, we take the steps the law requires to protect it.

11. Children

Khawi is for people aged 18 and over. We don't knowingly collect information from anyone under 18. If you believe a child has used Khawi, contact us and we will delete their information.

12. Changes to this policy

We may update this policy. We will change the date at the top, and if a change is significant, we will tell you in the chat or by another reasonable means before it takes effect.

13. Contact us

For questions or requests about your privacy, email privacy@khawi.dev. Khawi is provided by TorchStack LLC.